Blueprint for Security in Information security

7/29/2019 Blueprint for Security in Information security

1/46


2/46

Slide 2

Information Security Policy,

Standards, and PracticesManagement from all communities of interest

must consider policies as the basis for allinformation security efforts

Policies direct how issues should be addressed

and technologies used

Security policies are the least expensive controlto execute, but the most difficult to implement

Shaping policy is difficult because: Never conflict with laws Stand up in court, if challenged

Be properly administered


3/46

Slide 3

Definitions A policy is

A plan or course of action, as of a government,

political party, or business, intended to influence and

determine decisions, actions, and other matters

Policies are organizational laws

Standards, on the other hand, are more detailed

statements of what must be done to comply with policy

Practices, procedures, and guidelines effectively explain

how to comply with policy

For a policy to be effective it must be properly

disseminated, read, understood and agreed to by all

members of the organization


4/46

Slide 4

Types of Policy

Management defines three types ofsecurity policy:

General or security program policy

Issue-specific security policies

Systems-specific security policies


5/46

Slide 5

Figure 6-1 Policies

Standards & Practices


6/46

Slide 6

Security Program PolicyA security program policy (SPP) is also known

as

A general security policy

IT security policy

Information security policy Sets the strategic direction, scope, and tone for

all security efforts within the organization

An executive-level document, usually drafted by

or with, the CIO of the organization and is

usually 2 to 10 pages long


7/46Slide 7

Issue-Specific Security Policy

(ISSP)As various technologies and processes are

implemented, certain guidelines are needed touse them properly

The ISSP:

addresses specific areas of technology requires frequent updates

contains an issue statement on the organizationsposition on an issue

Three approaches: Create a number of independent ISSP documents

Create a single comprehensive ISSP document

Create a modular ISSP document


8/46Slide 8

Example ISSP Structure

Statement of PolicyAuthorized Access and Usage of

Equipment

Prohibited Usage of EquipmentSystems Management

Violations of Policy

Policy Review and ModificationLimitations of Liability


9/46Slide 9


10/46Slide 10

Systems-Specific Policy

(SysSP)While issue-specific policies are formalized as

written documents, distributed to users, andagreed to in writing, SysSPs are frequentlycodified as standards and procedures used

when configuring or maintaining systems Systems-specific policies fall into two groups:

Access control lists (ACLs) consist of the accesscontrol lists, matrices, and capability tables governing

the rights and privileges of a particular user to aparticular system

Configuration rules comprise the specificconfiguration codes entered into security systems toguide the execution of the system


11/46Slide 11

ACL Policies Both Microsoft Windows NT/2000 and Novell

Netware 5.x/6.x families of systems translateACLs into sets of configurations thatadministrators use to control access to theirrespective systems

ACLs allow configuration to restrict access fromanyone and anywhere

ACLs regulate: Who can use the system

What authorized users can access

When authorized users can access the system

Where authorized users can access the system from

How authorized users can access the system


12/46Slide 12

Rule Policies

Rule policies are more specific to theoperation of a system than ACLs

Many security systems require specific

configuration scripts telling the systems

what actions to perform on each set of

information they process


13/46Slide 13

Policy Management Policies are living documents that must be

managed and nurtured, and are constantlychanging and growing

Documents must be properly managed

Special considerations should be made fororganizations undergoing mergers, takeovers,and partnerships

In order to remain viable, policies must have:

an individual responsible for reviews a schedule of reviews

a method for making recommendations for reviews

a specific effective and revision date


14/46Slide 14

Information Classification The classification of information is an important

aspect of policy

The same protection scheme created to preventproduction data from accidental release to thewrong party should be applied to policies inorder to keep them freely available, but onlywithin the organization

In todays open office environments, it may bebeneficial to implement a clean desk policy

A clean desk policy stipulates that at the end ofthe business day, all classified information mustbe properly stored and secured


15/46Slide 15

Systems DesignAt this point in the Security SDLC, the analysis

phase is complete and the design phase begins

many work products have been created

Designing a plan for security begins by creating or

validating a security blueprint Then use the blueprint to plan the tasks to be

accomplished and the order in which to proceed

Setting priorities can follow the recommendationsof published sources, or from published standards

provided by government agencies, or private

consultants


16/46Slide 16


17/46Slide 17

Information Security

Blueprints

One approach is to adapt or adopt apublished model or framework forinformation security

A framework is the basic skeletal structurewithin which additional detailed planningof the blueprint can be placed as it isdeveloped of refined

Experience teaches us that what workswell for one organization may notprecisely fit another


18/46Slide 18

ISO 17799/BS 7799One of the most widely referenced and often

discussed security models is the Information

Technology Code of Practice for Information

Security Management, which was originally

published as British Standard BS 7799 This Code of Practice was adopted as an

international standard by the International

Organization for Standardization (ISO) and the

International Electrotechnical Commission (IEC)as ISO/IEC 17799 in 2000 as a framework for

information security


19/46Slide 19


20/46Slide 20

ISO 17799 / BS 7799 Several countries have not adopted 17799

claiming there are fundamental problems: The global information security community has not

defined any justification for a code of practice asidentified in the ISO/IEC 17799

17799 lacks the necessary measurement precisionof a technical standard

There is no reason to believe that 17799 is moreuseful than any other approach currently available

17799 is not as complete as other frameworksavailable

17799 is perceived to have been hurriedly preparedgiven the tremendous impact its adoption could haveon industry information security controls


21/46Slide 21

ISO/IEC 17799Organizational Security Policy is needed to

provide management direction and support

Objectives: Operational Security Policy

Organizational Security Infrastructure Asset Classification and Control

Personnel Security

Physical and Environmental Security

Communications and Operations Management

System Access Control System Development and Maintenance

Business Continuity Planning

Compliance


22/46

Slide 22

NIST Security ModelsAnother approach available is described in the

many documents available from the Computer

Security Resource Center of the National

Institute for Standards and Technology

(csrc.nist.gov) Including: NIST SP 800-12 - The Computer Security Handbook

NIST SP 800-14 - Generally Accepted Principles and

Practices for Securing IT Systems

NIST SP 800-18 - The Guide for Developing SecurityPlans for IT Systems


23/46

Slide 23

NIST SP 800-14 Security Supports the Mission of the Organization

Security is an Integral Element of Sound Management

Security Should Be Cost-Effective

Systems Owners Have Security Responsibilities

Outside Their Own Organizations

Security Responsibilities and Accountability Should Be

Made Explicit

Security Requires a Comprehensive and Integrated

Approach

Security Should Be Periodically Reassessed

Security is Constrained by Societal Factors

33 Principles enumerated


24/46

Slide 24

IETF Security Architecture The Security Area Working Group acts as an

advisory board for the protocols and areasdeveloped and promoted through the InternetSociety No specific architecture is promoted through IETF

RFC 2196: Site Security Handbook provides anoverview of five basic areas of security

Topics include: security policies

security technical architecture security services

security incident handling


25/46

Slide 25

VISA Model VISA International promotes strong security

measures and has security guidelines

Developed two important documents thatimprove and regulate its information systems Security Assessment Process

Agreed Upon Procedures

Using the two documents, a security team candevelop a sound strategy for the design of goodsecurity architecture

The only down side to this approach is the veryspecific focus on systems that can or dointegrate with VISAs systems


26/46

Slide 26

Baselining and Best Practices Baselining and best practices are solid methods

for collecting security practices, but they can

have the drawback of providing less detail than

would a complete methodology

It is possible to gain information by baseliningand using best practices and thus work

backwards to an effective design

The Federal Agency Security Practices Site

(fasp.csrc.nist.gov) is designed to provide best

practices for public agencies


27/46

Slide 27

Professional Membership It may be worth the information security

professionals time and money to join

professional societies with information on best

practices for its members

Many organizations have seminars and classeson best practices for implementing security

Finding information on security design is the

easy part, sorting through the collected mass of

information, documents, and publications can

take a substantial investment in time and human

resources


28/46

Slide 28

NIST SP 800-26Management Controls

Risk Management

Review of Security Controls

Life Cycle Maintenance

Authorization of Processing (Certification and Accreditation)

System Security Plan

Operational Controls Personnel Security

Physical Security Production, Input/Output Controls

Contingency Planning

Hardware and Systems Software

Data Integrity

Documentation

Security Awareness, Training, and Education

Incident Response Capability

Technical Controls Identification and Authentication

Logical Access Controls

Audit Trails

Fi 6 16 S h f


29/46

Slide 29

Figure 6-16 Spheres of

Security


30/46

Slide 30

Sphere of UseGenerally speaking, the concept of the sphere is

to represent the 360 degrees of securitynecessary to protect information at all times

The first component is the sphere of use

Information, at the core of the sphere, isavailable for access by members of theorganization and other computer-based systems: To gain access to the computer systems, one must

either directly access the computer systems or go

through a network connection To gain access to the network, one must either directly

access the network or go through an Internetconnection


31/46

Slide 31

Sphere of Protection The sphere of protection overlays each of the

levels of the sphere of use with a layer ofsecurity, protecting that layer from direct orindirect use through the next layer

The people must become a layer of security, ahuman firewall that protects the information fromunauthorized access and use

Information security is therefore designed andimplemented in three layers policies

people (education, training, and awareness programs)

technology


32/46

Slide 32

ControlsManagement controls cover security processes

that are designed by the strategic planners andperformed by security administration of theorganization

Operational controls deal with the operationalfunctionality of security in the organization

Operational controls also address personnelsecurity, physical security, and the protection ofproduction inputs and outputs

Technical controls address those tactical andtechnical issues related to designing andimplementing security in the organization


33/46

Slide 33

The Framework Management Controls

Program Management System Security Plan

Life Cycle Maintenance

Risk Management

Review of Security Controls

Legal Compliance

Operational Controls

Contingency Planning

Security ETA

Personnel Security

Physical Security

Production Inputs andOutputs

Hardware & SoftwareSystems Maintenance

Data Integrity

Technical Controls

Logical Access Controls Identification, Authentication,

Authorization, and

Accountability

Audit Trails

Asset Classification andControl

Cryptography


34/46

Slide 34

SETAAs soon as the policies exist, policies to

implement security education, training, andawareness (SETA) should follow

SETA is a control measure designed to reduceaccidental security breaches

Supplement the general education and trainingprograms in place to educate staff oninformation security

Security education and training builds on thegeneral knowledge the employees mustpossess to do their jobs, familiarizing them withthe way to do their jobs securely


35/46

Slide 35

SETA Elements The SETA program consists of three elements

security education security training security awareness

The organization may not be capable or willing

to undertake all three of these elements but mayoutsource them

The purpose of SETA is to enhance security by: Improving awareness of the need to protect system

resources Developing skills and knowledge so computer users

can perform their jobs more securely Building in-depth knowledge, as needed, to design,

implement, or operate security programs fororganizations and systems


36/46

Slide 36


37/46

Slide 37

Security Education Everyone in an organization needs to be trained

and aware of information security, but not everymember of the organization needs a formaldegree or certificate in information security

When formal education for appropriate

individuals in security is needed an employeecan identify curriculum available from localinstitutions of higher learning or continuingeducation

A number of universities have formalcoursework in information security(See for example http://infosec.kennesaw.edu)


38/46

Slide 38

Security TrainingSecurity training involves providing

members of the organization with detailed

information and hands-on instruction

designed to prepare them to perform their

duties securely

Management of information security can

develop customized in-house training or

outsource the training program


39/46

Slide 39

Security AwarenessOne of the least frequently implemented,

but the most beneficial programs is thesecurity awareness program

Designed to keep information security at

the forefront of the users mindsNeed not be complicated or expensive

If the program is not actively implemented,

employees begin to tune out, and the riskof employee accidents and failuresincreases


40/46

Slide 40


41/46

Slide 41

Design of security ArchitectureDefense in Depth

One of the foundations of security architectures is therequirement to implement security in layers

Defense in depth requires that the organizationestablish sufficient security controls and safeguards,

so that an intruder faces multiple layers of controls Security Perimeter

The point at which an organizations securityprotection ends, and the outside world begins

Referred to as the security perimeter Unfortunately the perimeter does not apply to internal

attacks from employee threats, or on-site physicalthreats


42/46

Slide 42


43/46

Slide 43


44/46

Slide 44

Key Technology ComponentsOther key technology components

A firewall is a device that selectively discriminates

against information flowing into or out of the

organization

The DMZ (demilitarized zone) is a no-mans land,

between the inside and outside networks, where

some organizations place Web servers

In an effort to detect unauthorized activity within the

inner network, or on individual machines, an

organization may wish to implement IntrusionDetection Systems or IDS


45/46

Slide 45


46/46

Date post:	14-Apr-2018
Category:	Documents
Upload:	eswin-angel
View:	223 times
Download:	0 times