Principals of Information Security, Fourth Edition

Principals of Information Security, Fourth Edition

Principles of Information Security, Fourth Edition Chapter 12 Information Security Maintenance 2 Introduction Organizations should avoid overconfidence after improving their information security profile Organizational changes that may occur include: Acquisition of new assets; emergence of new

vulnerabilities; business priorities shift; partnerships form or dissolve; organizational divestiture and acquisition; employee hire and turnover If program does not adjust, may be necessary to begin cycle again More expensive to reengineer information security profile again and again Principles of Information Security, Fourth Edition 3 Security Management Maintenance Models

Management model must be adopted to manage and operate ongoing security program Models are frameworks that structure tasks of managing particular set of activities or business functions Principles of Information Security, Fourth Edition 4 NIST SP 800-100 Information Security Handbook: A Guide for Managers Provides managerial guidance for establishing and

implementing of an information security program Thirteen areas of information security management Provide for specific monitoring activities for each task Tasks should be done on an ongoing basis Not all issues are negative Principles of Information Security, Fourth Edition 5

NIST SP 800-100 Information Security Handbook: A Guide for Managers (contd.) Information security governance Agencies should monitor the status of their programs to ensure that: Ongoing information security activities provide support to agency mission Current policies and procedures are technology-aligned Controls are accomplishing the intended purpose System development life cycle:

The overall process of developing, implementing, and retiring information systems through a multistep process 6 NIST SP 800-100 Information Security Handbook: A Guide for Managers (contd.) Awareness and training Tracking system should capture key information on program activities

Tracking compliance involves assessing the status of the program The program must continue to evolve Capital planning and investment control Designed to facilitate and control the expenditure of agency funds Select-control-evaluate investment life cycle 7

Figure 12-1 Select-Control-Evaluate Investment Life Cycle NIST SP 800-100 Information Security Handbook: A Guide for Managers (contd.) 8 Interconnecting systems The direct connection of two or more information systems for sharing data and other information resources

Can expose the participating organizations to risk When properly managed, the added benefits include greater efficiency, centralized access to data, and greater functionality Performance measures Metrics: tools that support decision making Six phase iterative process 9 Figure 12-3 Information Security Metrics Development Process

NIST SP 800-100 Information Security Handbook: A Guide for Managers (contd.) 10 Security planning: one of the most crucial ongoing responsibilities in security management Information technology contingency planning: consists of a process for recovery and documentation of procedures Risk management

Ongoing effort Tasks include performing risk identification, analysis, and management 11 Figure 12-4 Information Security Metrics Program Implementation Process 12 Figure 12-5 The NIST Seven-Step Contingency Planning Process 13 Figure 12-6 Risk Management in the System Security Life Cycle

NIST SP 800-100 Information Security Handbook: A Guide for Managers (contd.) 14 Certification, accreditation, and security assessments An essential component in any security program The status of security controls is checked regularly Auditing: the process of reviewing the use of a system for

misuse or malfeasance Security services and products acquisition Incident response: incident response life cycle Configuration (or change) management: manages the effects of changes in configurations 15 Figure 12-7 The Information Security Services Life Cycle

16 Figure 12-8 The Incident Response Life Cycle 17 The Security Maintenance Model Designed to focus organizational effort on maintaining systems Recommended maintenance model based on five subject areas: External monitoring

Internal monitoring Planning and risk assessment Vulnerability assessment and remediation Readiness and review 18 Figure 12-10 The Maintenance Model

19 Monitoring the External Environment Objective to provide early awareness of new threats, threat agents, vulnerabilities, and attacks that is needed to mount an effective defense Entails collecting intelligence from data sources and giving that intelligence context and meaning for use by organizational decision makers 20 Figure 12-11 External Monitoring

21 Monitoring the External Environment (contd.) Data sources Acquiring threat and vulnerability data is not difficult Turning data into information decision makers can use is the challenge External intelligence comes from three classes of

sources: vendors, computer emergency response teams (CERTs), public network sources Regardless of where or how external monitoring data is collected, must be analyzed in context of organizations security environment to be useful 22 Monitoring the External Environment (contd.) Monitoring, escalation, and incident response Function of external monitoring process is to monitor activity, report results, and escalate warnings

Monitoring process has three primary deliverables: Specific warning bulletins issued when developing threats and specific attacks pose measurable risk to organization Periodic summaries of external information Detailed intelligence on highest risk warnings 23 Monitoring the External Environment (contd.) Data collection and management Over time, external monitoring processes should capture knowledge about external environment in

appropriate formats External monitoring collects raw intelligence, filters for relevance, assigns a relative risk impact, and communicates to decision makers in time to make a difference 24 Figure 12-12 Data Flow Diagrams for External Data Collection 25 Monitoring the Internal Environment Maintain informed awareness of state of

organizations networks, systems, and security defenses Internal monitoring accomplished by: Doing inventory of network devices and channels, IT infrastructure and applications, and information security infrastructure elements Leading the IT governance process Real-time monitoring of IT activity

Monitoring the internal state of the organizations networks and systems 26 Figure 12-13 Internal Monitoring 27 Monitoring the Internal Environment (contd.) Network characterization and inventory Organizations should have carefully planned and fully populated inventory for network devices,

communication channels, and computing devices Once characteristics identified, they must be carefully organized and stored using a mechanism (manual or automated) that allows timely retrieval and rapid integration of disparate facts 28 Monitoring the Internal Environment (contd.) Making intrusion detection and prevention systems work The most important value of raw intelligence provided

by the IDS is providing indicators of current or imminent vulnerabilities Log files from IDS engines can be mined for information Another IDS monitoring element is traffic analysis Analyzing attack signatures for unsuccessful system attacks can identify weaknesses in various security efforts 29 Monitoring the Internal

Environment (contd.) Detecting differences Difference analysis: procedure that compares current state of network segment against known previous state of same segment Differences between the current state and the baseline state that are unexpected could be a sign of trouble and need investigation 30 Planning and Risk Assessment

Primary objective is to keep lookout over entire information security program Accomplished by identifying and planning ongoing information security activities that further reduce risk 31 Planning and Risk Assessment (contd.) Primary objectives

Establishing a formal information security program review Instituting formal project identification, selection, planning, and management processes Coordinating with IT project teams to introduce risk assessment and review for all IT projects Integrating a mindset of risk assessment across organization 32

Figure 12-14 Planning and Risk Assessment 33 Planning and Risk Assessment (contd.) Information security program planning and review Periodic review of ongoing information security program coupled with planning for enhancements and extensions is recommended Should examine IT needs of future organization and impact those needs have on information security

A recommended approach takes advantage of the fact most organizations have annual capital budget planning cycles and manage security projects as part of that process 34 Planning and Risk Assessment (contd.) Large projects should be broken into smaller projects for several reasons Smaller projects tend to have more manageable impacts on networks and users

Larger projects tend to complicate change control process in implementation phase Shorter planning, development, and implementation schedules reduce uncertainty Most large projects can easily be broken down into smaller projects, giving more opportunities to change direction and gain flexibility 35 Planning and Risk

Assessment (contd.) Security risk assessments A key component for driving security program change is information security operational risk assessment (RA) RA identifies and documents risk that project, process, or action introduces to organization and offers suggestions for controls Information security group coordinates preparation of many types of RA documents

36 Vulnerability Assessment and Remediation Primary goal: identification of specific, documented vulnerabilities and their timely remediation Accomplished by: Using vulnerability assessment procedures Documenting background information and providing

tested remediation procedures for vulnerabilities Tracking vulnerabilities from when they are identified Communicating vulnerability information to owners of vulnerable systems Reporting on the status of vulnerabilities Ensuring the proper level of management is involved 37

Figure 12-15 Vulnerability Assessment and Remediation 38 Vulnerability Assessment and Remediation (contd.) Process of identifying and documenting specific and provable flaws in organizations information asset environment Five vulnerability assessment processes that follow can serve many organizations as they attempt to balance intrusiveness of vulnerability assessment with need for stable and productive production environment

39 Vulnerability Assessment and Remediation (contd.) Penetration testing A level beyond vulnerability testing Is a set of security tests and evaluations that simulate attacks by a malicious external source (hacker) Penetration test (pen test): usually performed

periodically as part of a full security audit Can be conducted one of two ways: black box or white box 40 Vulnerability Assessment and Remediation (contd.) Internet vulnerability assessment Designed to find and document vulnerabilities present in organizations public-facing network

Steps in the process include: Planning, scheduling, and notification Target selection Test selection Scanning Analysis Record keeping 41 Vulnerability Assessment and Remediation (contd.) Intranet vulnerability assessment Designed to find and document selected vulnerabilities present on the internal network

Attackers are often internal members of organization, affiliates of business partners, or automated attack vectors (such as viruses and worms) This assessment is usually performed against selected critical internal devices with a known, high value by using selective penetration testing Steps in process almost identical to steps in Internet vulnerability assessment 42

Vulnerability Assessment and Remediation (contd.) Platform security validation Designed to find and document vulnerabilities that may be present because of misconfigured systems in use within organization These misconfigured systems fail to comply with company policy or standards Fortunately, automated measurement systems are available to help with the intensive process of

validating compliance of platform configuration with policy 43 Vulnerability Assessment and Remediation (contd.) Wireless vulnerability assessment Designed to find and document vulnerabilities that may be present in wireless local area networks of organization Since attackers from this direction are likely to take advantage of any loophole or flaw, assessment is

usually performed against all publicly accessible areas using every possible wireless penetration testing approach 44 Vulnerability Assessment and Remediation (contd.) Modem vulnerability assessment Designed to find and document any vulnerability present on dial-up modems connected to organizations networks Since attackers from this direction take advantage of

any loophole or flaw, assessment is usually performed against all telephone numbers owned by the organization One element of this process, often called war dialing, uses scripted dialing attacks against pool of phone numbers 45 Vulnerability Assessment and Remediation (contd.) Documenting vulnerabilities Vulnerability tracking database should provide details

as well as a link to the information assets Low-cost and ease of use makes relational databases a realistic choice Vulnerability database is an essential part of effective remediation 46 Vulnerability Assessment and Remediation (contd.) Remediating vulnerabilities

Objective is to repair flaw causing a vulnerability instance or remove risk associated with vulnerability As last resort, informed decision makers with proper authority can accept risk Important to recognize that building relationships with those who control information assets is key to success Success depends on organization adopting team approach to remediation, in place of crossorganizational push and pull 47

Vulnerability Assessment and Remediation (contd.) Acceptance or transference of risk In some instances, risk must simply be acknowledged as part of organizations business process Management must be assured that decisions made to assume risk the organization are made by properly informed decision makers Information security must make sure the right people

make risk assumption decisions with complete knowledge of the impact of the decision 48 Vulnerability Assessment and Remediation (contd.) Threat removal In some circumstances, threats can be removed without repairing vulnerability Vulnerability can no longer be exploited, and risk has been removed

Other vulnerabilities may be amenable to other controls that do not allow an expensive repair and still remove risk from situation 49 Vulnerability Assessment and Remediation (contd.) Vulnerability repair Optimum solution in most cases is to repair vulnerability

Applying patch software or implementing a workaround often accomplishes this In some cases, simply disabling the service removes vulnerability; in other cases, simple remedies are possible Most common repair is application of a software patch 50 Readiness and Review Primary goal is to keep information security program functioning as designed and continuously improving

Accomplished by: Policy review Program review Rehearsals 51 Figure 12-16 Readiness and Review

52 Digital Forensics Used to investigate what happened during attack on assets and how attack occurred Based on the field of traditional forensics Involves preservation, identification, extraction, documentation, and interpretation of computer media for evidentiary and/or root cause analysis

Evidentiary material (EM): any information that could potentially support organizations legal or policy-based case against suspect 53 Digital Forensics (contd.) Used for two key purposes: To investigate allegations of digital malfeasance To perform root cause analysis

Organization chooses one of two approaches: Protect and forget (patch and proceed): defense of data and systems that house, use, and transmit it Apprehend and prosecute (pursue and prosecute): identification and apprehension of responsible individuals, with additional attention on collection and preservation of potential EM that might support administrative or criminal prosecution 54 The Digital Forensics Team Most organizations

Cannot sustain a permanent digital forensics team Collect data and outsource analysis Information security group personnel should be trained to understand and manage the forensics process to avoid contamination of potential EM Expertise can be obtained by training 55

Affidavits and Search Warrants Affidavit Sworn testimony that certain facts are in the possession of the investigating officer that they feel warrant the examination of specific items located at a specific place The facts, the items, and the place must be specified When an approving authority signs the affidavit, it becomes a search warrant, giving permission to:

Search the EM at the specified location Seize items to return to the investigator for examination 56 Digital Forensics Methodology All investigations follow the same basic methodology Identify relevant items of evidentiary value (EM)

Acquire (seize) the evidence without alteration or damage Take steps to assure that the evidence is at every step verifiably authentic and is unchanged from the time it was seized Analyze the data without risking modification or unauthorized access Report the findings to the proper authority

57 Figure 12-17 The Digital Forensics Process Evidentiary Procedures 58 Strong procedures for the handling of potential evidentiary material can minimize the probability of an organizations losing a legal challenge Organizations should develop specific procedures with guidance, for example:

Who may conduct an investigation and who is authorized in an investigation What affidavit- and search warrant-related issues are required The methodology to be followed The final report format

Recently Viewed Presentations

  • 1818 ACC Chemistry

    1818 ACC Chemistry

    Complicated math, but . exact agreement with every experimental result to date. Highly confirmed theory. Current study of QM is done by physical chemists and physicists. Basic atomic structure is a collection of . probability electron clouds . called ....
  • DNA Replication

    DNA Replication

    Steps of DNA Replication. When the DNA helix _____, it exposes the nitrogenous bases. For extra information / notes on this process, watch DNA Structure & Replication, Crash Course Biology video #10 (from 8:52 onwards)
  • Coppin State University

    Coppin State University

    The State Institute of Rehabilitation. Building Summary. Objectives. Mechanical Investigation. Electrical Investigation. Overall Evaluation. Conclusion
  • After Modernity Fall 2010 Outline  Marx, Weber, Durkheims

    After Modernity Fall 2010 Outline Marx, Weber, Durkheims

    Langue & Parole. La langue is the whole system of language (spelling, grammar, syntax, vocabulary, etc.) that precedes and makes speech possible. Signs are the basic units of langue. Parole . is the actual use of language, the practical utterances...
  • What is Happening in R&J?

    What is Happening in R&J?

    Hunting thee hence with hunt's-up to the day. O now be gone, more light and light it grows. ROMEO. More light and light, more dark and dark our woes! Enter Nurse hastily. NURSE. Madam! JULIET. Nurse? NURSE. Your lady mother...
  • Working Scientifically 1: Observation Tutor: Sally Spicer S.L.Spicer@warwick.ac.uk

    Working Scientifically 1: Observation Tutor: Sally Spicer [email protected]

    , W. 2011 p6 ASE Guide to primary science education) " …science has not been taught frequently enough for enquiry skills to be developed. The expectation is that science should be taught weekly though no minimum time will be quoted."
  • Opening Title VERSION A

    Opening Title VERSION A

    New degree program. Beginning Fall 2019, CECS will be offering a new Bachelor of Science degree in Materials Science and Engineering. Any student interested will be able to declare Material Science Pending or Material Science Engineering in the fall term.
  • Not Required

    Not Required

    1809 Elective Affinities. Rights only come with responsibilities ... noun [Latin . pauper] A poor person; particularly, one so indigent as to depend on the parish or town for maintenance. 1941 U.S. Supreme Court ruling in Edwards v. California 314...