Your SlideShare is downloading. ×



Published on

Published in: Business, Technology
  • Be the first to comment

  • Be the first to like this

No Downloads
Total Views
On Slideshare
From Embeds
Number of Embeds
Embeds 0
No embeds

Report content
Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

No notes for slide


  • 1. OFFICIAL (ISC)2 GUIDE TO THE CISSP CBK SECOND E D I T I O N© 2010 by Taylor and Francis Group, LLC
  • 2. 27+(5 %22.6 ,1 7+( ,6
  • 3. Š 35(66 6(5,(6 2I¿FLDO ,6
  • 4. Š *XLGH WR WKH ,663Š,66$3Š %.Š +DUROG ) 7LSWRQ (GLWRU ,6%1 2I¿FLDO ,6
  • 7. Š *XLGH WR WKH $3Š %.Š 3DWULFN +RZDUG ,6%1 2I¿FLDO ,6
  • 8. Š *XLGH WR WKH ,663Š,66(3Š %.Š 6XVDQ +DQVFKH ,6%1 ;© 2010 by Taylor and Francis Group, LLC
  • 9. OFFICIAL (ISC) 2 GUIDE T O T H E CISSP® CBK SECOND E D I T I O N Edited by Harold F. Tipton, CISSP-ISSAP, ISSMP Contributors Paul Baker, Ph.D., CPP • Stephen Fried, CISSP Micki Krause, CISSP • Tyson Macaulay, CISSP G a r y M c l n t y r e , CISSP • Kelley O k o l i t a , M B C P Keith Pasley, CISSP • Marcus K. Rogers, Ph.D., CISSP Ken M. S h a u r e t t e , CISSP • R o b e r t M. Slade, CISSP (ISC) SECURITY TRANSCENDS TECHNOLOGY* (g) CRC Press Taylor Francis Group Boca Raton London New York CRC Press is an imprint of the Taylor Francis Group, an informa business AN AUERBACH BOOK© 2010 by Taylor and Francis Group, LLC
  • 10. Auerbach PublicationsTaylor Francis Group6000 Broken Sound Parkway NW, Suite 300Boca Raton, FL 33487-2742© 2010 by Taylor and Francis Group, LLCAuerbach Publications is an imprint of Taylor Francis Group, an Informa businessNo claim to original U.S. Government worksPrinted in the United States of America on acid-free paper10 9 8 7 6 5 4 3 2 1International Standard Book Number: 978-1-4398-0959-4 (Hardback)This book contains information obtained from authentic and highly regarded sources. Reasonable effortshave been made to publish reliable data and information, but the author and publisher cannot assumeresponsibility for the validity of all materials or the consequences of their use. The authors and publishershave attempted to trace the copyright holders of all material reproduced in this publication and apologize tocopyright holders if permission to publish in this form has not been obtained. If any copyright material hasnot been acknowledged please write and let us know so we may rectify in any future reprint.Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmit-ted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented,including photocopying, microfilming, and recording, or in any information storage or retrieval system,without written permission from the publishers.For permission to photocopy or use material electronically from this work, please access ( or contact the Copyright Clearance Center, Inc. (CCC), 222 RosewoodDrive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses andregistration for a variety of users. For organizations that have been granted a photocopy license by the CCC,a separate system of payment has been arranged.Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are usedonly for identification and explanation without intent to infringe. Library of Congress Cataloging-in-Publication Data Official (ISC)2 guide to the CISSP CBK / edited by Harold F. Tipton. -- 2nd ed. p. cm. Includes bibliographical references and index. ISBN 978-1-4398-0959-4 1. Electronic data processing personnel--Certification. 2. Computer security--Examinations--Study guides. 3. Computer networks--Examinations--Study guides. I. Tipton, Harold F. II. Title. QA76.3.T565 2009 005.8--dc22 2009024445Visit the Taylor Francis Web site athttp://www.taylorandfrancis.comand the Auerbach Web site at © 2010 by Taylor and Francis Group, LLC
  • 11. ContentsForeword .......................................................................................................viiIntroduction ...................................................................................................xiEditor ..........................................................................................................xviiContributors .................................................................................................xix 1 Access Control ........................................................................................1 JAMES S. TILLER, CISSP; REVISED BY STEPHEN FRIED, CISSP 2 Application Security ...........................................................................157 ROBERT M. SLADE, CISSP 3 Business Continuity and Disaster Recovery Planning .......................261 KELLEY OKOLITA, MBCP 4 Cryptography .....................................................................................309 KEVIN HENRY, CISSP; REVISED BY KEITH PASLEY, CISSP, CISA, ITIL, GSNA 5 Information Security Governance and Risk Management .................401 TODD FITZGERALD, CISSP, BONNIE GOINS, CISSP, AND REBECCA HEROLD, CISSP; REVISED BY KEN M. SHAURETTE, CISSP 6 Legal, Regulations, Investigations, and Compliance .........................503 MARCUS K. ROGERS, PH.D., CISSP, CCCI-ADVANCED 7 Operations Security............................................................................539 GARY MCINTYRE, CISSP 8 Physical and Environmental Security ................................................579 PAUL BAKER, PH.D., CPP 9 Security Architecture and Design ......................................................667 GARY MCINTYRE, CISSP AND MICKI KRAUSE, CISSP v© 2010 by Taylor and Francis Group, LLC
  • 12. vi ◾ Contents10 Telecommunications and Network Security ......................................731 ALEC BASS, CISSP AND PETER BERLICH, CISSP-ISSMP; REVISED BY TYSON MACAULAY, CISSPAppendix Answers to Practice Questions.................................................853© 2010 by Taylor and Francis Group, LLC
  • 13. ForewordForeword to CBK Study Guide 2009In today’s connected world, business, government, and consumers all want the abilityto access information, communicate, and execute transactions immediately withthe assurance of real-world security. However, every advance in connectivity andconvenience also brings new threats to privacy and security in the global virtualenvironment. That’s why information security has become critical to mitigatingrisks that can destroy a company’s reputation, violate a consumer’s privacy, compromiseintellectual property, and, in some cases, endanger lives. Most organizations now understand that technology alone cannot secure theirdata. In ever-increasing numbers, they are seeking seasoned professionals who cancreate and implement a comprehensive information security program, obtain sup-port and funding for the program, and make every employee a security-consciouscitizen, all while meeting necessary regulatory standards. Educating and certifying the knowledge and experience of informationsecurity professionals has been the mission of the International InformationSystems Security Certification Consortium [(ISC)2] since its inception. Formedin 1989 by multiple IT associations to develop an accepted industry standardfor the practice of information security, (ISC)2 created the fi rst and only CBK,a continuously updated compendium of knowledge areas critical to being a pro-fessional. (ISC)2 has certified security professionals and practitioners in morethan 130 countries across the globe. It is the largest body of information securityprofessionals in the world. Information security only continues to grow in size and significance and hasbecome a business imperative for organizations of all sizes. With the increasingimportance of security, educated, qualified, and experienced information securityprofessionals are viewed as the answer to an organization’s security challenges. Responsibilities are increasing as well—information security professionals areunder increasing pressure to secure not only the perimeter of the organization, butall the data and systems within the organization. Whether researching new tech-nologies or implementing information risk management initiatives, information vii© 2010 by Taylor and Francis Group, LLC
  • 14. viii ◾ Forewordsecurity professionals are being held to even more stringent standards than everbefore and the need for specialized training continues to increase. To ensure that professionals meet these high standards, (ISC)2 offers a suite ofinformation security education materials, certifications, and concentrations thatcover each discipline within the information security field, whether it is planning,design, execution, or management. Although requirements vary from certification to certification, such as minimumnumber of years of relevant work experience and areas of domain knowledge,all candidates applying for (ISC)2 certifications must pass a rigorous exam, beendorsed by a current (ISC)2 credential holder (member), adhere to the (ISC)2 Codeof Ethics, and obtain annual continuing professional education credits to maintaincertification. (ISC)2’s certifications are vendor-neutral, which means they are not tied to aspecific vendor or product, but instead encompass a broad scope of knowledge.These certifications provide organizations with the assurance that its staff has beentested on understanding industry best practices, possessing a broad knowledge ofthe field, and demonstrating sound professional judgment. (ISC)2’s core credentials are accredited by the International Organizationfor Standardizations (ISO) United States representative, the American NationalStandards Institute (ANSI) under ANSI/ISO/IEC Standard 17024, a nationaland global benchmark for the certification of personnel. In fact, the CertifiedInformation Systems Security Professional (CISSP) certification was the firsttechnology-related credential to earn such accreditation, making it the GoldStandard within the information security industry. The CISSP is an invaluabletool that independently validates a candidate’s expertise in developing informationsecurity policies, standards, and procedures as well as managing implementationacross the enterprise. The Official (ISC)2 Guide to the CISSP CBK is the only document that addressesall of the topics and subtopics contained in the CISSP CBK. The authors and edi-tor of this new, comprehensive edition have provided an extensive supplement tothe CBK review seminars that are designed to help candidates prepare for CISSPcertification. Earning your CISSP is a deserving achievement and makes you a member of anelite network of professionals that enjoy such benefits as access to leading industry con-ference registrations worldwide, access to a Career Center with current job listings,subscription to (ISC)2’s members-only digital magazine—InfoSecurity Professional, a“live” help desk to address your questions and issues, and much more. You will alsobe a member of a highly respected organization that is constantly working to raisethe profile of the profession through community goodwill programs such as children’ssecurity awareness programs, an information security career guide for high-school© 2010 by Taylor and Francis Group, LLC
  • 15. Foreword ◾ ixand college-aged students, and academic scholarships for students researching newtechniques and theories in the field. We wish you success in your journey to becoming a CISSP. W. Hord Tipton International Information System Security Certification Consortium, Inc.© 2010 by Taylor and Francis Group, LLC
  • 16. IntroductionIntroduction to the Official (ISC)2Guide to the CISSP CBK TextbookThis marks the second edition of the Official Guide to the CISSP CBK and includesmany important updates and revisions. Recognized as one of the best tools availableto the information security professional, and especially to the candidate studyingfor the (ISC)2 CISSP examination, this edition reflects the latest developments inthe ever-changing and exciting field of information security, and the most up-to-datereview of the CBK available. (ISC)2 has a long history of educating and certifying information securityprofessionals, from its first days as a volunteer organization defining the scope ofinformation security, to its current position as the global leader in information secu-rity. As every modern organization and government depends on stable and securesystems, the relevance and importance of a highly skilled and educated workforcebecomes more and more critical. For this reason, (ISC)2 is pleased to bring youanother great tool in your arsenal that is sure to assist in your daily responsibilitiesand long-term objectives. Information security professionals are key elements in securing, stabilizing,and advancing the mission of the business they support, regardless of whetherthat business is a commercial enterprise, a military organization, or a government.Information security plays a leading role in allowing an organization to leveragethe benefits of new technologies and venture into new lines of business. Long goneare the days of information security being an obstacle to business and locked intoa narrow focus on technology and restrictive procedures. The information securityprofessional must be a business manager first and seek out the creative and cost-effectivemeasures needed to identify and address risks, ensure business continuity, and meetlegal requirements. To write this valuable reference, skilled authors, who are experts in their field,were chosen to contribute to, and update the various chapters as well as share theirpassion for their areas of expertise. This book is an authoritative reference thatcan be used to gain a solid understanding of the CISSP CBK and as a valuable xi© 2010 by Taylor and Francis Group, LLC
  • 17. xii ◾ Introductionreference, holding a prominent position on every information security profession-al’s bookshelf. The (ISC)2 CISSP CBK is a taxonomy—a collection of topics relevant to infor-mation security professionals around the world. The CISSP CBK establishes acommon framework of information security terms and principles that allow infor-mation security professionals around the world to discuss, debate, and resolve mat-ters pertaining to the profession through a common understanding and standardterminology. Understanding the CBK allows intelligent discussion with peers oninformation security issues. The CISSP CBK is continuously evolving. Every year the (ISC)2 CBK commit-tee reviews the content of the CBK and updates it with a consensus of best prac-tices from an in-depth job analysis survey of CISSPs around the world. These bestpractices may address implementing new technologies, dealing with new threats,incorporating new security tools, and, of course, managing the human factor ofsecurity. (ISC)2 also represents the changes and trends in the industry through theaward-winning CISSP CBK review seminars and educational programs. The following list represents the 10 current domains of the CBK and the high-leveltopics contained in each domain. A comprehensive list can be obtained by requestingthe Candidate Information Bulletin from the (ISC)2 Web site at ControlAccess control is the collection of mechanisms that permits managers of a sys-tem to exercise a directing or restraining influence over the behavior, use, andcontent of a system. It permits management to specify what users can do, whichresources they can access, and what operations they can perform on a system.The candidate should fully understand access control concepts, methodologies,and implementations within centralized and decentralized environments acrossthe enterprise’s computer systems. Access control techniques, and detective andcorrective measures should be studied to understand the potential risks, vulner-abilities, and exposures.Application Development SecurityApplication development security refers to the controls that are included withinsystem and application software and the steps used in their development.Applications refer to agents, applets, software, databases, data warehouses, andknowledge-based systems. These applications may be used in distributed or cen-tralized environments. The candidate should fully understand the security andcontrols of the systems development process, system life cycle, application con-trols, change controls, data warehousing, data mining, knowledge-based systems,program interfaces, and concepts used to ensure data and application integrity,security, and availability.© 2010 by Taylor and Francis Group, LLC
  • 18. Introduction ◾ xiiiBusiness Continuity and Disaster Recovery PlanningThe business continuity and disaster recovery planning domain addresses the pres-ervation of the business in the face of major disruptions to normal business opera-tions. Business continuity plans (BCPs) and disaster recovery plans (DRPs) involvethe preparation, testing, and updating of specific actions to protect critical businessprocesses from the effect of major system and network failures. BCPs counteractinterruptions to business activities and should be available to protect critical businessprocesses from the effects of major failures or disasters. It deals with the natural andman-made events and the consequences if not dealt with promptly and effectively.DRPs contain procedures for emergency response, extended backup operation, andpost-disaster recovery should a computer installation experience a partial or totalloss of computer resources and physical facilities. The primary objective of the DRPis to provide the capability to process mission-essential applications, in a degradedmode, and return to normal mode of operation within a reasonable amount oftime. The candidate will be expected to know the difference between business con-tinuity planning and disaster recovery; business continuity planning in terms ofproject scope and planning, business impact analysis, recovery strategies, recoveryplan development, and implementation. The candidate should understand disasterrecovery in terms of recovery plan development, implementation, and restoration.CryptographyThe cryptography domain addresses the principles, means, and methods of disguisinginformation to ensure its integrity, confidentiality, and authenticity. The candidatewill be expected to know basic concepts within cryptography; public and private keyalgorithms in terms of their applications and uses; algorithm construction, key distri-bution and management, and methods of attack; and the applications, construction,and use of digital signatures to provide authenticity of electronic transactions, andnon-repudiation of the parties involved.Information Security Governance and Risk ManagementInformation security governance and risk management entails the identificationof an organization’s information assets and the development, documentation, andimplementation of policies, standards, procedures, and guidelines that ensure con-fidentiality, integrity, and availability. Management tools such as data classification,risk assessment, and risk analysis are used to identify the threats, classify assets, andto rate their vulnerabilities so that effective security controls can be implemented.Risk management is the identification, measurement, control, and minimizationof loss associated with uncertain events or risks. It includes overall security review,risk analysis, selection and evaluation of safeguards, cost–benefit analysis, manage-ment decision, safeguard implementation, and effectiveness review. The candidatewill be expected to understand the planning, organization, and roles of individuals© 2010 by Taylor and Francis Group, LLC
  • 19. xiv ◾ Introductionin identifying and securing an organization’s information assets; the developmentand use of policies stating management’s views and position on particular topicsand the use of guidelines, standards, and procedures to support the policies; security-awareness training to make employees aware of the importance of informationsecurity, its significance, and the specific security-related requirements relative totheir position; the importance of confidentiality, proprietary, and private informa-tion; employment agreements; employee hiring and termination practices; and riskmanagement practices and tools to identify, rate, and reduce the risk to specificresources.Legal, Regulations, Compliance, and InvestigationsLegal, regulations, compliance, and investigations domain addresses computercrimelaws and regulations; the investigative measures and techniques that canbe used to determine if a crime has been committed, and methods to gatherevidence. Incident handling provides the ability to react quickly and efficientlyto malicious technical threats or incidents. The candidate will be expected toknow the methods for determining whether a computer crime has been com-mitted; the laws that would be applicable for the crime; laws prohibiting spe-cific types of computer crimes; methods to gather and preserve evidence of acomputer crime, and investigative methods and techniques; and ways to addresscompliance.Operations SecurityOperations security is used to identify the controls over hardware, media, and theoperators with access privileges to any of these resources. Audit and monitoringis the mechanisms, tools, and facilities that permit the identification of securityevents and subsequent actions to identify the key elements and report the pertinentinformation to the appropriate individual, group, or process. The candidate will beexpected to know the resources that must be protected, the privileges that must berestricted, the control mechanisms available, the potential for abuse of access, theappropriate controls, and the principles of good practice.Physical (Environmental) SecurityThe physical (environmental) security domain addresses the threats, vulnerabilities,and countermeasures that can be utilized to physically protect an enterprise’s resourcesand sensitive information. These resources include people, the facility in which theywork, and the data, equipment, support systems, media, and supplies they utilize. Thecandidate will be expected to know the elements involved in choosing a secure site, itsdesign and configuration, and the methods for securing the facility against unauthor-ized access, theft of equipment and information, and the environmental and safetymeasures needed to protect people, the facility, and its resources.© 2010 by Taylor and Francis Group, LLC
  • 20. Introduction ◾ xvSecurity Architecture and DesignThe security architecture and design domain contains the concepts, principles,structures, and standards used to design, implement, monitor, and secure operat-ing systems, equipment, networks, applications, and those controls used to enforcevarious levels of confidentiality, integrity, and availability. The candidate shouldunderstand security models in terms of confidentiality, integrity, information flow;system models in terms of the common criteria; technical platforms in terms of hardware,firmware, and software; and system security techniques in terms of preventive,detective, and corrective controls.Telecommunications and Network SecurityThe telecommunications and network security domain encompasses the structures,transmission methods, transport formats, and security measures used to provideintegrity, availability, authentication, and confidentiality for transmissions over pri-vate and public communication networks and media. The candidate is expectedto demonstrate an understanding of communications and network security as itrelates to voice communications; data communications in terms of local area, widearea, and remote access; Internet/intranet/extranet in terms of firewalls, routers,and TCP/IP; and communications security management and techniques in termsof preventive, detective, and corrective measures. In today’s global marketplace, theability to communicate with others is a mandatory requirement.This textbook has been developed to help information security professionals whowant to better understand the knowledge requirements of their professions andhave that knowledge validated by the CISSP certification. Since few professionalshave significant work experience in all 10 domains, the authors highly recommendattending a CBK review seminar to identify those areas where more concentratedstudy is necessary. This textbook and the CBK review seminar complement eachother perfectly in providing a multi-vectored approach to learning and understandingthe breadth of this ever-changing field. This composition required a tremendous amount of work from the authors, theeditors, and the printing firm. We extend our heartfelt thanks to each one of them,along with a very appreciative compliment for a task well done. Enjoy your studying, and may the experience of preparing for the examinationand the exploring of all the many facets of this industry continue to ignite yourpassion and satisfaction in working in the field of information security.© 2010 by Taylor and Francis Group, LLC
  • 21. EditorHal Tipton, currently an independent consultant, was a past president of theInternational Information System Security Certification Consortium and a direc-tor of computer security for Rockwell International Corporation for about 15 years.He initiated the Rockwell computer and data security program in 1977 and thencontinued to administer, develop, enhance, and expand the program to accom-modate the control needs produced by technological advances until his retirementfrom Rockwell in 1994. Tipton has been a member of the Information Systems Security Association(ISSA) since 1982. He was the president of the Los Angeles Chapter in 1984, andthe president of the national organization of ISSA (1987–1989). He was added tothe ISSA Hall of Fame and the ISSA Honor Role in 2000. Tipton was a member of the National Institute for Standards and Technology(NIST), the Computer and Telecommunications Security Council, and the NationalResearch Council Secure Systems Study Committee (for the National Academy ofScience). He received his BS in engineering from the U.S. Naval Academy andhis MA in personnel administration from George Washington University; he alsoreceived his certificate in computer science from the University of California atIrvine. He is a certified information system security professional (CISSP), ISSAP, ISSMP.He has published several papers on information security issues for Auerbach Publishers—Handbook of Information Security Management Data Security Management Information Security Journal National Academy of Sciences—Computers at Risk Data Pro Reports Elsevier ISSA “Access” MagazineHe has been a speaker at all the major information security conferences includingthe following: Computer Security Institute, the ISSA Annual Working Conference, xvii© 2010 by Taylor and Francis Group, LLC
  • 22. xviii ◾ Editorthe Computer Security Workshop, MIS Conferences, AIS Security for SpaceOperations, DOE Computer Security Conference, National Computer SecurityConference, IIA Security Conference, EDPAA, UCCEL Security Audit UsersConference, and Industrial Security Awareness Conference. He has conducted/participated in information security seminars for (ISC)2,Frost Sullivan, UCI, CSULB, System Exchange Seminars, and the Institute forInternational Research. He participated in the Ernst Young video “ProtectingInformation Assets.” He is currently serving as the editor of the Handbook ofInformation Security Management (Auerbach publications). He chairs the (ISC)2CBK Committees and the QA Committee. He received the Computer SecurityInstitute’s Lifetime Achievement Award in 1994 and the (ISC)2’s Hal Tipton Awardin 2001.© 2010 by Taylor and Francis Group, LLC
  • 23. ContributorsPaul Baker, Ph.D, CPP, is a security manager with more than 30 years of exten-sive and comprehensive experience in all phases of law enforcement and industrialsecurity. He holds a doctorate in strategic leadership from Regent University alongwith a master of science in criminal justice from Troy University. Dr. Baker beganhis security management journey in the U.S. Marine Corps and continued as aMaryland State Trooper working extensively on narcotics and intelligence. Afterhis retirement in 2001, he embarked on the next phase of his security career, work-ing as a physical security supervisor for the MITRE Corporation in Washington,D.C. He is currently employed as a security manager for Capital One Bank.Dr. Baker has been involved in numerous security assessment projects and hasdesigned complete physical protection systems for a multitude of facilities.Alec Bass, CISSP, is a senior security specialist in the Boston area. During his 25year career, Alec has developed solutions that significantly reduce risk to the digi-tal assets of high-profile manufacturing, communications, home entertainment,financial, research, and federal organizations. He has helped enterprises enhancetheir network’s security posture, performed penetration testing, and administeredclient firewalls for an application service provider. Before devoting his career to information security, Alec supported the IT infra-structure for a multinational Fortune 200 company and fi xed operating systembugs for a leading computer firm.Peter Berlich, CISSP-ISSMP, is working as an IT security manager on a largeoutsourcing account at IBM Integrated Technology Services, coming from a pro-gression of IT security- and compliance-related roles in IBM. Before joining IBM,he was global information security manager at ABB, after a succession of technicaland project management roles with a focus on network security management. Peteris a member of the (ISC)2 European Advisory Board and the Information SecurityForum Council. He is the author of various articles on the subject of security andprivacy management in publications such as Infosecurity Today. xix© 2010 by Taylor and Francis Group, LLC
  • 24. xx ◾ ContributorsTodd Fitzgerald, CISSP, CISA, CISM, is the director of information systems secu-rity and a systems security officer for United Government Services, LLC (UGS),Milwaukee, Wisconsin. Todd has written articles on information security forpublications such as The Information Security Management Handbook, The HIPAAProgram Reference Book, Managing an Information Security and Privacy Awarenessand Training Program (Auerbach Publications) and magazines such as InformationSecurity. Todd is frequently called upon to present at national and local confer-ences, and has received several security industry leadership awards.Stephen Fried, CISSP, CISM, is a seasoned information security professional withover 25 years experience in information technology. For the last 12 years, Stephenhas concentrated his efforts on providing effective information security leadershipto large organizations. Stephen has led the creation of security programs for twoFortune 500 companies and has an extensive background in such diverse securityissues as risk assessment and management, security policy development, securityarchitecture, infrastructure and perimeter security design, outsource relationshipsecurity, offshore development, intellectual property protection, security technol-ogy development, business continuity, secure e-business design, and informationtechnology auditing. A frequent speaker at conferences, Stephen is also active inmany security industry organizations. He is a contributing author to the InformationSecurity Management Handbook, and has also been quoted in magazines such asSecure Enterprise and CIO Decisions.Bonnie A. Goins, CISSP, NSA IAM, GIAC, CISM, ISS, PCI QSA, is a nationallyrecognized subject matter expert in information security management. With over17 years of experience in management consulting, and information technology andsecurity, Bonnie is chosen by executive management for her depth of knowledgeand experience in information technology and security strategy development andrefinement; risk and security assessment methods; security program design, devel-opment, and implementation; regulatory compliance initiatives, such as HIPAA,Sarbanes–Oxley, PCI, GLBA, NERC/FERC, FISMA, and others; policy, proce-dure, and plan creation; technology and business process reengineering; securenetwork infrastructure design and implementation; business continuity and inci-dent response initiatives; application security methods; and security/technology/regulatory training. Her experience extends over multiple verticals and includeshealthcare, financial services, government, utilities, retail, higher education, tele-communications, manufacturing, public health, pharmaceuticals/biotech, andmanufacturing.Kevin Henry, CISSP-ISSEP, ISSMP, CAP, SSCP, is a well-known speaker and con-sultant in the field of information security and business continuity planning. Heprovides educational and consulting services to organizations throughout the worldand is an official instructor for (ISC)2. He is responsible for course development and© 2010 by Taylor and Francis Group, LLC
  • 25. Contributors ◾ xxidelivery for several (ISC)2 programs. Kevin has a broad range of experience in bothtechnology and management of information technology and information securityprograms. He has worked for clients ranging from the largest telecommunicationsfirms in the world to governments, military, and small home-based operations. Heis a highly respected presenter at conferences, seminars, and educational programsworldwide. With over 20 years of telecommunications and government experience,he brings a relevant and interesting approach to information security and providespractical and meaningful solutions to the information security challenges, threats,and regulations we face today.Rebecca Herold, CISSP, CISM, CISA, FLMI, is an information privacy, security,and compliance consultant, author, and instructor with over 16 years of experienceassisting organizations of all sizes in all industries throughout the world. Rebeccahas written numerous books, including Managing an Information Security andPrivacy Awareness and Training Program (Auerbach Publications) and The PrivacyManagement Toolkit (Information Shield), along with dozens of book chapters andhundreds of published articles. Rebecca speaks often at conferences, and developsand teaches workshops for the Computer Security Institute. Rebecca is a residenteditor for the IT Compliance Community and also an adjunct professor for theNorwich University master of science in information assurance program.Micki Krause, CISSP, has held positions in the information security profession forthe last 20 years. She is currently the chief information security officer at PacificLife Insurance Company in Newport Beach, California. Micki has held severalleadership roles in industry-influential groups including the ISSA and the (ISC)2and is a long-term advocate for professional security education and certification. In2003, Krause received industry recognition as a recipient of the “Women of Vision”award given by Information Security magazine. In 2002, Krause was honored asthe second recipient of the Harold F. Tipton Award in recognition of sustainedcareer excellence and outstanding contributions to the profession. She is a reputedspeaker, published author, and coeditor of the Information Security ManagementHandbook series.Tyson Macaulay, the security liaison officer for Bell Canada, is responsible fortechnical and operational risk management solutions for Bell’s largest enterpriseclients. Tyson leads security initiatives addressing large, complex, technology solu-tions including physical and logical (IT) assets, and regulatory/legal compliancerequirements. In this role, he leads worldwide engagements involving multinationalcompanies and international governments. Tyson’s leadership encompasses a broadrange of industry sectors from the defense industry to high-tech start-ups. Hisexpertise includes large-scale security implementations in both public and privatesector institutions, working on projects from conception through development toimplementation. Tyson is a respected thought leader with publications dating from© 2010 by Taylor and Francis Group, LLC
  • 26. xxii ◾ Contributors1993. His work has covered authorship of peer-reviewed white papers, IT securitygovernance programs, technical and integration services, and incident managementprocesses.Kelley Okolita, MBCP, is currently the program manager for business continu-ity and disaster recovery for the Hanover Insurance Group. Widely recognizedas an industry expert with more than 25 years experience, Kelley developed andimplemented programs that were put to the test and proved successful for a vari-ety of recoveries both large and small including from the events of September 11,2001 and Hurricane Katrina. Kelley is sought after as a speaker and subject-matterexpert by organizations such as Gartner, Sungard, and IBM. She has publishedarticles in professional magazines and journals and was selected by (ISC)2 to be theexpert to rewrite Chapter 3 for their CISSP study guide and ISSAP study guide.Kelley has had a 10-year affiliation with DRI International (DRII)—six years onthe Certification Commission for DRII, two as a chair and two as a member oftheir board of directors. She continues to serve on various committees. She is alsoan alternate on the NFPA 1600 Technical Committee. She has spoken at confer-ences from North America to Australia to Singapore and is currently completingher book on enterprise-wide business continuity planning, which is to be publishedby Taylor Francis.Keith Pasley, CISSP, CISA, ITIL, GSNA, is an information security professionalspecializing in helping companies understand information security requirements,regulatory compliance to help maximize security technology to reduce costs andcomplexity. Keith has over 20 years of hands-on experience in the information tech-nology industry, and has spent the last 13 years specializing in information security. In various roles, Keith has designed security architectures and implementedsecurity strategies for government, education, and commercial sectors. Keith is asecurity researcher and a contributing author to such publications as the InformationSecurity Management Handbook and the HIPAA Program Reference (both publishedby Auerbach Publications). Keith has also published online and in-print articles onvarious security-related subjects.Marcus K. Rogers, Ph.D, CISSP, CCCI, is the director of the Cyber ForensicsProgram in the Department of Computer and Information Technology at PurdueUniversity. He is a professor, a faculty scholar, and a research faculty member atthe Center for Education and Research in Information Assurance and Security.Dr. Rogers is a member of the quality assurance board for (ISC)2’s SCCP designa-tion; the international chair of the Law, Regulations, Compliance and InvestigationDomain of the Common Body of Knowledge (CBK) committee; the chair of theEthics Committee Digital Multimedia Sciences Section—American Academy ofForensic Sciences; and the chair of the Certification Committee Digital ForensicsCertification Board. Dr. Rogers is the editor in chief of the Journal of Digital© 2010 by Taylor and Francis Group, LLC
  • 27. Contributors ◾ xxiiiForensic Practice and serves on the editorial board of several other professional jour-nals. He is the author of numerous book chapters and journal publications in thefield of digital forensics and applied psychological analysis.Ken M. Shaurette, CISSP, CISA, CISM, is an experienced security and audit pro-fessional with a strong understanding of complex computing environments, legisla-tive and regulatory requirements, and security solutions. He is a founding memberand a past president of the Western Wisconsin InfraGard Chapter; a past presidentof ISSA-Milwaukee (International Systems Security Association); the current presi-dent and founding member of ISSA-Madison; a past chairman MATC MilwaukeeSecurity Specialist Curriculum Advisory Committee; a member of HerzingUniversity’s Department of Homeland Security Degree; and a member of theWestern Wisconsin Association of Computer Crime Investigators. Ken has pub-lished security information in several books and trade magazines. In his spare time,he finds time to work as a director of IT services for Financial Institution ProductsCorporation (FIPCO®), a subsidiary of the Wisconsin Bankers Association. Hecan be reached via e-mail at M. Slade is an information security and management consultant fromNorth Vancouver, British Columbia, Canada. Initial research into computer viralprograms developed into the writing and reviewing of security books, and eventu-ally into conducting review seminars for CISSP candidates. Slade also promotes theCommunity Security Education project, attempting to increase security awarenessfor the general public as a means of reducing overall information security threats.More information than anyone would want to know about him is available at or It is nextto impossible to get him to take “bio” writing seriously.James S. Tiller, CISSP, CISA, is an accomplished executive with over 14 years ofinformation security and information technology experience and leadership. Hehas provided comprehensive, forward-thinking solutions encompassing a broadspectrum of challenges and industries. Jim has spent much of his career assist-ing organizations throughout North America, Europe, and most recently Asia, inmeeting their security goals and objectives. He is the author of The Ethical Hack:Framework for Business Value Penetration Testing and A Technical Guide to IPsecVirtual Private Networks (Auerbach Publications). Jim has been a contributingauthor to the Information Security Management Handbook for the last five years,in addition to several other publications. Currently, Jim is the vice president ofSecurity North America for BT Global Services.© 2010 by Taylor and Francis Group, LLC
  • 28. Chapter 1Access ControlJames S. Tiller, CISSP;Revised by Stephen Fried, CISSPContentsIntroduction ..........................................................................................................1 CISSP Expectations ..........................................................................................2Key Access Control Concepts ................................................................................3Access Control Principles ....................................................................................11Information Classification ...................................................................................16Access Control Requirements ..............................................................................25Access Control Categories ...................................................................................29Access Control Types .......................................................................................... 34System Access Control Strategies .........................................................................53Identity Management ..........................................................................................92Access Control Technologies................................................................................99Data Access Controls......................................................................................... 116Intrusion Detection and Intrusion Prevention Systems ......................................124Threats ..............................................................................................................132Summary and Conclusion ................................................................................. 153Review Questions ..............................................................................................154IntroductionThe field of information security is complex, dynamic, and infinitely challenging.This single discipline contains elements of advanced technology, human behavior, 1© 2010 by Taylor and Francis Group, LLC
  • 29. 2 ◾ Official (ISC)2 Guide to the CISSP CBKbusiness strategy, statistical analysis, mathematics, and a host of other technicaland personal skills. In fact, the field can be so complex that to categorize it for theCBK® takes ten distinct domains, each with its own unique skill and knowledgerequirements. Despite all this complexity, however, the fundamental purpose of allinformation security efforts remains the same; to protect the confidentiality, integ-rity, and availability of information assets. Furthermore, the most fundamentalway of doing this is to ensure that only those who have a specific need for an asset,combined with specific authoritative permission, will be able to access that asset. That, in a nutshell, is access control. Access control provides the basic building blocks for enabling information secu-rity and is the foundation upon which all security efforts, including the other nineCBK domains, are based. The ability to develop and implement an effective andcomprehensive access control strategy will lay the groundwork toward establishingan effective overall security program for the organization. Likewise, an ineffective,incomplete, or haphazard access control strategy will do nothing to assist the orga-nization’s security efforts and may, in fact, hinder those efforts considerably. This chapter introduces the security professional to all aspects of access control,from the theoretical to the highly detailed. The reader will be given the definitionsand basic concepts necessary to understand access control processes and will beshown various methods of providing access control functionality in a variety ofphysical and technical situations. Finally, detailed technical discussions of variousaccess control technologies will demonstrate the large number of options availablefor addressing specific access control needs.CISSP ExpectationsAccording to the (ISC)2 Candidate Information Bulletin, an information security pro-fessional should fully understand access control concepts, methodologies, and imple-mentation within centralized and decentralized environments across the enterprise’scomputer systems. Access control techniques and detective and corrective measuresshould be studied to understand the potential risks, vulnerabilities, and exposures. Key areas of knowledge are ◾ Control access by applying the following concepts, methodologies, and techniques − Policies − Types of controls: preventive, detective, corrective, etc. − Techniques, e.g., nondiscretionary, discretionary, and mandatory − Identification and authentication − Decentralized and distributed access control techniques − Authorization mechanisms − Logging and monitoring ◾ Understand access control attacks ◾ Assess effectiveness of access controls© 2010 by Taylor and Francis Group, LLC
  • 30. Access Control ◾ 3Key Access Control ConceptsBefore beginning a complete dissection of the access control domain, it is importantto have an understanding of some key concepts that will be important throughoutthe chapter. These concepts form the basis for understanding how access controlworks, why it is a key security discipline, and how each individual component to bediscussed in this chapter relates to the overall access control universe. The most basic and important piece of knowledge to understand is a precisedefinition of what is meant by the term “access control.” For the rest of this chapter,indeed for the rest of this book, the following definition will be used: Access control is the process of allowing only authorized users, programs, or other computer systems (i.e. networks) to observe, modify, or otherwise take possession of the resources of a computer system. It is also a mechanism for limiting the use of some resources to authorized users.In short, access controls are the collection of mechanisms that work together to pro-tect the assets of the enterprise. They help protect against threats and vulnerabilitiesby reducing exposure to unauthorized activities and providing access to informa-tion and systems to only those who have been approved. Although access control isa single domain within the CISSP Common Body of Knowledge (CBK), it is themost pervasive and omnipresent aspect of information security. Access controlsencompass all operational levels of an organization: ◾ Facilities: Access controls protect entry to, and movement around, an orga- nization’s physical locations to protect personnel, equipment, information, and, other assets inside that facility. ◾ Support systems: Access to support systems (such as power, heating, ventilation and air conditioning (HVAC) systems; water; and fire suppression controls) must be controlled so that a malicious intruder is not able to compromise these systems and cause harm to the organization’s personnel or the ability to support critical systems. ◾ Information systems: Multiple layers of access controls are present in most modern information systems and networks to protect those systems, and the information they contain, from harm or misuse. ◾ Personnel: Management, end users, customers, business partners, and nearly everyone else associated with an organization should be subject to some form of access control to ensure that the right people have the ability to interface with each other, and not interfere with the people with whom they do not have any legitimate business.Additionally, all physical and logical entry points to the organization need sometype of access control. Given the pervasive nature and importance of access controls© 2010 by Taylor and Francis Group, LLC
  • 31. 4 ◾ Official (ISC)2 Guide to the CISSP CBKthroughout the practice of security, it is necessary to understand the four key attri-butes of access control that enable good security management. Specifically, accesscontrols enable management to 1. Specify which users can access a system 2. Specify what resources those users can access 3. Specify what operations those users can perform 4. Enforce accountability for those users’ actionsEach of these four areas, although interrelated, represents an established and indi-vidual approach to defining an effective access control strategy. The information inthis chapter will assist the security professional in determining the proper course ofaction to satisfy each of the attributes as it applies to a particular system, process,or facility.Joining the C-I-A: The common thread among all good information securityobjectives is that they address at least one (if not all three) of the core security prin-ciples: confidentiality, integrity, and availability (more commonly referred to as theC-I-A). Confidentiality refers to efforts made to prevent unauthorized disclosure ofinformation to those who do not have the need, or right, to see it. Integrity refersto efforts made to prevent unauthorized or improper modification of systems andinformation. It also refers to the amount of trust that can be placed in a systemand the accuracy of information within that system. For example, many systemsand applications will check data that come into the system for syntactic and seman-tic accuracy to ensure that incoming data do not introduce operational or process-ing errors, thus affecting its overall integrity. Availability refers to efforts made toprevent disruption of service and productivity. The goals of information security areto ensure the continued C-I-A of an organization’s assets. This includes both physi-cal assets (such as buildings, equipment, and, of course, people) and informationassets (such as company data and information systems.) Access controls play a key role in ensuring the confidentiality of systems andinformation. Managing access to physical and information assets is fundamentalto preventing exposure of data by controlling who can see, use, modify, or destroythose assets. In addition, managing an entity’s admittance and rights to specificenterprise resources ensures that valuable data and services are not abused, misap-propriated, or stolen. It is also a key factor for many organizations that are requiredto protect personal information in order to be compliant with appropriate legisla-tion and industry compliance requirements. The act of controlling access inherently provides features and benefits that pro-tect the integrity of business assets. By preventing unauthorized or inappropriateaccess, organizations can achieve greater confidence in data and system integrity.Without controls to manage who has access to specific resources, and what actionsthey are permitted to perform, there are a few alternate controls that ensure that© 2010 by Taylor and Francis Group, LLC
  • 32. Access Control ◾ 5information and systems are not modified by unwanted influences. Moreover,access controls (more specifically, records of access activity) offer greater visibilityinto determining who or what may have altered data or system information, poten-tially affecting the integrity of those assets. Access controls can be used to matchan entity (such as a person or a computer system) with the actions that entity takesagainst valuable assets, allowing organizations to have a better understanding of thestate of their security posture. Finally, access control processes go hand in hand with efforts to ensure the avail-ability of resources within an organization. One of the most basic rules to embracefor any valuable asset, especially an asset whose criticality requires that it must beavailable for use over elongated periods of time, is that only people with a need touse that particular asset should be allowed access to that asset. Taking this stanceensures that the resource is not blocked or congested by people who have no busi-ness using it. This is why most organizations only allow their employees and othertrusted individuals into their facilities or onto their corporate networks. In addi-tion, restricting access to only those who need to use a resource reduces the likeli-hood that malicious agents can gain access and cause damage to the asset or thatnonmalicious individuals with unnecessary access can cause accidental damage.Determining a Default Stance: An organization’s access control strategy is directlyinfluenced by its overall approach and philosophy concerning information security.For example, educational institutions and public social organizations generally pro-mote more open and unfettered access to systems and information. They wouldmost likely have fewer restrictions and controls on what information and servicesusers can access. Their philosophy is based on allowing access to any informationunless there is a specific need to restrict that access. Such an access philosophy isoften referred to as allow-by-default. More formally, this philosophy dictates thatany access that is not specifically denied is permitted. Even though such an orga-nization may have security measures in place (like firewalls, for example), thosedevices are configured to allow access to a resource unless a specific resource isdefined as requiring more restricted access. This approach provides a much moreopen environment for sharing information and resources, but at the potential costof losing control over the confidentiality, integrity, and availability of the informa-tion and resources that organization manages. Figure 1.1 shows a conceptual viewof an allow-by-default environment. In Figure 1.1, the firewall is configured to allow most network protocols (e.g.,FTP, HTTP, and SMTP) through to the organization’s intranet. However, peer-to-peer (P2P) protocols (such as file-sharing and instant messaging programs) areblocked at the firewall, presumably because the organization fears the introductionof malicious software through such programs. Other organizations have a much stricter access control philosophy. These wouldinclude most commercial enterprises, government systems, and military installa-tions. Their philosophy is one of deny-by-default, or, more formally, any access that© 2010 by Taylor and Francis Group, LLC
  • 33. 6 ◾ Official (ISC)2 Guide to the CISSP CBK FTP HTTP Is the protocol Intranet SMTP denied? P2PFigure 1.1 Conceptual view of an allow-by-default not specifically permitted is denied. In contrast to the allow-by-default approach,deny-by-default will block all attempts to access information and resources unlessthat access is specifically permitted. This approach provides an environment thatprotects information resources much more strongly, but at a cost of requiring muchgreater management and administration of those resources. In addition, workers ina deny-by-default environment may find that access to, and sharing of, informationin such an environment is much more difficult. Figure 1.2 shows a conceptual viewof an allow-by-default environment. In this diagram, the more restrictive environment blocks most protocols fromentering the intranet. The exception is the SMTP protocol (used by most e-mailsystems), which is allowed to pass through the firewall. This would allow e-mail traf-fic to travel in and out of the organization. In practice, few organizations fall purely in the allow-by-default or deny-by-default camps. Some areas of an organization may be more permissive (e.g.,employee recreational information or cafeteria meal schedules), while other areas FTP HTTP Is the protocol Intranet SMTP allowed? P2PFigure 1.2 A conceptual view of an allow-by-default environment.© 2010 by Taylor and Francis Group, LLC
  • 34. Access Control ◾ 7will be much more restrictive (such as employee health and salary information orcompany financial records.) Nevertheless, most organizations will have one or theother of these core philosophies as their underlying guiding principle. Definingyour core philosophy will be very important to your access control strategy, as it setsthe tone for all other access control decisions to follow.Defense in Depth: The practice of implementing appropriate access control mech-anisms is also the first line of defense in an organization’s defense-in-depth strategy.Defense in depth is the practice of applying multiple layers of security protectionbetween an information resource and a potential attacker. If one of those layersshould fail the successive layers will continue to function and protect the resourceagainst compromise. A sound access control strategy provides the first layer ofprotection. By carefully managing all attempts to access a resource and blockingthose that are not preauthorized, it ensures that all the other layers protecting thatresource have a much greater chance of successfully protecting it. Defense in depth is applicable to both the physical and virtual environments.For example, imagine a modern office complex where top-secret data are stored, asdepicted in Figure 1.3. In such an environment, a tall perimeter fence might provide Biometric Access Door Locked File Cabinet Card Access DoorFigure 1.3 Physical defense in depth.© 2010 by Taylor and Francis Group, LLC
  • 35. 8 ◾ Official (ISC)2 Guide to the CISSP CBKthe first layer of defense to keep intruders out. If an intruder gets through the fence,the building may have an armed guard at the front door. Should the intruder man-age to knock out and disarm the guard, he may find that the building requires anaccess card to get past the main lobby. If the intruder can find an access card (per-haps from the security guard he just knocked out), and get into the main part of thebuilding, he may find that all the cabinets with secret data are locked and the key isnowhere to be found! The goal in all of this is to ensure that access to target assets(in this case the secret data) is protected by multiple layers of controls. A properly protected virtual environment, such as that depicted in Figure 1.4,should present similar challenges. If that same intruder decided to break into thecompany’s data center over the Internet he may find that the company’s network isprotected by a strong firewall. However, this intrepid villain does not let that stophim and manages to find a hole through the firewall to the company’s payroll server.The server, however, requires a password. If the attacker keeps going he will findthat the applications on the server also require passwords, the system is protectedby a host-based Intrusion Prevention System (more on that later), and the databasefiles are encrypted. As it was with the physical security example, the more layers ofprotection placed between an attacker and a potential target the less likely it is thatthe failure of any single control will cause compromise or loss of the asset. Access controls can be found in many places within a computing environment.For example, firewalls employ rules that permit, limit, or deny access to variousnetwork services. By reducing the exposure to threats, controls protect potentiallyvulnerable system services, ensuring that network’s availability. By reducing expo-sure to unwanted and unauthorized entities, organizations can limit the number ofthreats that can affect the availability of systems, services, and data. Network Access Controls Firewalls Server Access Controls Data Access Controls Application Access ControlsFigure 1.4 Network defense in depth.© 2010 by Taylor and Francis Group, LLC
  • 36. Access Control ◾ 9Access Control—A General Process: There are many different approaches toimplementing an access control scheme—almost as many as there are security pro-fessionals. However, there is a very general approach that is applicable to almostany situation and provides a useful framework for beginning on the access controljourney. This three-step process is defined as 1. Defining resources 2. Determining users 3. Specifying the users’ use of the resourcesStep 1—Defining Resources: The first step to enable an effective access controlstrategy is to specifically define the resources that exist in the environment forusers to access. Essentially, this step answers the fundamental security question,“What are you trying to protect?” While this may seem intuitive, this is not a stepthat should be overlooked, nor should its importance or potential complexity beunderestimated. The definition of what exactly constitutes a “resource” to an orga-nization may take considerable discussion, but once it is decided it will clarify andsimplify the process of identifying those resources that are important enough forthe organization to protect. The proper definition of the available resources in your organization must alsobe coupled with a determination as to how each of those resources may be accessed.Do users need a specific organizational status to access a particular resource, oris it enough just to be a member of a specific project? Accessing information on acompany’s benefit plans may simply require a person to be an employee, whereasaccessing quarterly financial projects may specifically require a person to be part ofthe finance organization. Addressing these issues during this step will also lay thefoundation for effectively implementing role-based or domain-based access con-trols, which will be discussed later in this chapter. It is also essential to bind a user, group, or entity to the resources each is access-ing. Resources can include data, applications, services, servers, storage, processes,printers, or anything that represents an asset to the organization that can be utilizedby a user. Every resource, no matter how mundane, is an asset that must be affordedprotection from unwanted influences and unauthorized use. This includes obviouslyimportant resources like internally developed software, manufacturing systems,employee personnel files, or secret product formulas. However, it may also includeoften-overlooked resources like printers, fax machines, and even office supplies. Theactual amount of protection to give each resource may be based on a cost–benefitanalysis of the effort required to provide the protection or it may be based on a par-ticular risk or threat model favored by the organization. Once the required resourcesare determined, then controls can be defined to specify the level of access.Step 2—Determining Users: The next step in managing access control is definingwho can access a given resource. The concept of identifying who are permitted© 2010 by Taylor and Francis Group, LLC
  • 37. 10 ◾ Official (ISC)2 Guide to the CISSP CBKaccess and providing the credentials necessary for their role is fundamental to secu-rity and ancient in practice. In early tribal cultures, a right of passage consisted ofobtaining a specific garment, marking, or even a scar signifying you were approvedfor various activities within the tribe, which translated to access. As populationsgrew and became more sophisticated, new methods were developed to provideaccess to an approved community. Over 4000 years ago, the Egyptians developedthe first lock-and-key systems. Wooden locks were operated by a wooden key thatcontrolled pins to disengage a bolt and permit access to the protected object. Thekey would be provided only to those who had been identified as needing access.Although seemingly primitive by today’s standards (after all, how long would awooden lock protect a modern file cabinet?), the technology and social conventionsof the day allowed this to be quite an effective mechanism in ancient Egypt. Todaysecurity professionals continue the tradition of using the latest in available technol-ogy to protect valuable assets. A typical environment must manage employees, contractors, consultants, part-ners, clients, or even, on occasion, competitors that organizations need to identifyas requiring access of one kind or another. The act of specifying which users canhave access to a system is typically driven by an operational demand, such as pro-viding access to an accounting system so that users in the financial department canrecord and pay bills. Access control decisions are often based on organizational,social, or political considerations as well. One’s personal or functional status withinthe organization may dictate the type or scope of access to organizational assetsthat may be allotted. A company CEO is rarely denied access to any organizationalasset he may request, despite the fact that his explicit need to have that informationmay not be readily apparent. While this may not be the preferable method of deter-mining access rights, a real-world information security manager should be preparedto deal with such situations. The most significant aspect of determining which users will be provided accessis a clear understanding of the needs of the user and the level of trust given tothat person or entity. An identification process must exist that takes into consider-ation the validity of the access need in the light of business needs, organizationalpolicy, legal requirements, information sensitivity, and security risk. It is impor-tant to understand that with each new user or community, the threat profile of anorganization changes. For example, an organization may determine that one of itspartners needs access to a given system. Upon providing that access, the potentialthreats to the organization now include that partner organization. Not only mustthe relationship be founded on trust, established by legal or other mechanismsbetween the two entities, but it must also now consider the increase in the numberof users, thereby increasing the potential sources of threat. The more sophisticated the access control system, the greater the number ofoptions to support various access demands in a secure fashion. It is not uncommonfor organizations to have several different access control strategies to accommodatevarious needs, resulting in the provisioning of multiple unique access solutions.However, this is not considered as a security best practice, and the objective is to© 2010 by Taylor and Francis Group, LLC
  • 38. Access Control ◾ 11have a consistent access control strategy to avoid too much complexity. The morethe complexity that exists in any system, including access control systems, the morelikely it is that unexpected interactions will cause security flaws to be exposed.Simplicity is the key to any effective security system. The overall goal, then, is tostrike an effective balance between the need to manage the complex access needs ofan organization and the need to keep the access control system as simple as possibleto understand and manage.Step 3—Specifying Use: The final step in the access control process is to specifythe level of use for a given resource and the permitted user actions on that resource.Take, for example, the files and data resident on a typical computer. Most file systemsprovide multiple levels of permissions, such as read, write, and execute. Dependingon the file system used to store data, there may be methods of permitting much moregranular controls. These may include the ability to provide access to a specific user,but only permitting him or her to perform a certain task. For example, a user withthe role of “data backup” will be allowed to perform administrative functions suchas “copy to tape,” but not to erase or alter the information. (Access permissions willbe covered in greater detail later in this chapter.) Additionally, a user may have theneed to run an application, and therefore be provided execute privileges. However,he may not have write privileges, to ensure that he cannot modify the application. The same philosophy can be applied to any resource, and access controls shouldbe used to support an organization’s business functionality. For example, you maywish to restrict the users’ ability to access specific printers based on a particularorganizational structure. This would, as an example, allow a department to restricthigh-cost color printing to only the members of the graphics or marketing depart-ments. Not only would this properly restrict access to valuable and expensiveresources, it might also aid the organization’s cost allocation efforts by ensuringthat charges for those expensive resources are allocated only to those who mustuse them. As another example, an organization that needs to restrict printing andduplication of sensitive or classified documents may allow any user to send a printjob to a particular printer, but require another level of approval from an authorizedofficial to actually print the document in order to avoid policy violations. Ultimately, once a user is identified and authenticated, an access control systemmust be sensitive to the level of authorization for that user to use the identifiedresources. Therefore, it is not enough to simply identify and authenticate a user inorder to access resources. It is also necessary to control what actions are permittedfor a specified resource based on the user’s role (unless, of course, “unlimited access”is the organizational policy).Access Control PrinciplesAccess Control Policy: The first element of an effective access control programis to establish an access control policy and associated standards and procedures.An access control policy specifies the guidelines for how users are identified and© 2010 by Taylor and Francis Group, LLC
  • 39. 12 ◾ Official (ISC)2 Guide to the CISSP CBKauthenticated and the level of access granted to resources. The existence of an accesscontrol policy ensures that decisions governing the access to enterprise assets arebased on a formalized organizational directive. The absence of a policy will resultin inconsistencies in provisioning, management, and administration of access con-trols. The policy will provide the framework for the definition of necessary proce-dures, guidelines, standards, and best practices concerning the oversight of accessmanagement.Separation of Duties: It is often possible to enable effective access controls byaltering the way people perform their work functions. The primary objective ofseparation of duties is the prevention of fraud and errors. This objective is achievedby distributing the tasks and associated privileges for a specific process among mul-tiple people. It acts as a deterrent to fraud or concealment because collusion withanother individual is required to complete a fraudulent act, ensuring that no indi-vidual acting alone can compromise the security of a system or gain unauthorizedaccess to data. Of course, just because separation of duties is established for a givenprocess does not mean that fraud is impossible to carry out; it just means that it ismore difficult. People are generally averse to include others in the planning of crim-inal acts, so forcing collusion to happen in order to carry out such an act reducesthe overall risk of its occurrence. The first action to employ separation of duties in a process or work function isdefining the individual elements of that process. Processes are typically a collectionof tasks that must be performed to achieve an objective. Examples of common pro-cesses include performing backups, copying files, or granting system access. Workfunctions can also encompass highly complex and potentially vital (or dangerous)business elements that should not be in the control of any one person. A commonexample is the process of creating and approving requisitions for purchasing expen-sive items. The person who requests the expenditure should not also be allowed toapprove the expenditure. This prevents a single person from creating and receivingfraudulent payments. A less common, though more dangerous, example from themilitary is the ability to launch nuclear missiles. One person may have the abilityto arm the missile but not execute the launch sequence. Another person may havethe ability to launch the missile but not arm its payload. Finally, neither personcan do anything without receiving proper authorization from the President. In thiscase, all three people are needed in order to successfully launch an armed missile.This safeguard ensures that a single person with a political agenda (or just having aparticularly bad day) will not be able to start a global nuclear war. To determine the applicability of separation of duties, two distinct factors mustbe addressed: the sensitivity of the function under consideration and the elementswithin a process that lend themselves to distribution. Sensitivity of the functiontakes into consideration the criticality of the job performed and potential exposureto fraud, misuse, or negligence. It will be necessary to evaluate the importanceof a given transaction and its relationship to enterprise security risk, operations,© 2010 by Taylor and Francis Group, LLC
  • 40. Access Control ◾ 13and, of course, C-I-A factors. It is important to be aware that seemingly mundanetasks may also sometimes require separation of duties practices. For example, asingle user performing both backup and restore procedures would have the abilityto manipulate or destroy the backup data to cover unauthorized activity, changeinformation, or destroy valuable resources undetected. There are other activities within an organization that are not only important whenconsidering separation of duties, but their technical and procedural architecture alsoassists in establishing these controls as well. For example, in application developmentthere are typically separate development, testing, and production environments. Theintegrity of libraries used for the development is critical, and it is important that livesystems and proprietary information should not be used within the testing environ-ment to mitigate the risk of exposing sensitive information. Therefore, the develop-ment environment needs to follow strict separation of duties throughout the processin order to ensure that code and data follow strict change management processes andaccess by personnel between these areas is restricted. This reduces the risk of changesbeing made to the code once it has been tested and ensures the integrity of the testedcode and that the production code is maintained. The second factor when determining the applicability of separation of dutiesis understanding what elements within a function are prone to abuse, which onesare easily segmented without significantly disrupting operations, and what skillsare available to the pool of users performing the different elements of the function.These can be summarized as ◾ Element identification, importance, and criticality ◾ Operational considerations ◾ User skills and availabilityElement identification, importance, and criticality: Each function will have one ormore elements that must be performed to complete the transaction. Some elementswithin a function, known as milestone elements, may lend themselves to offer oppor-tunities for fraud or abuse. Such cases would then require a different user withunique privileges to complete that element. To ensure that a process runs as effi-ciently as possible within a separation of duties environment, it may be possible tocollect different elements into groups that together represent a milestone element.The key is to evaluate each element and the role it plays in performing the function.Once each element is assessed against the potential for abuse, they can begin to bedistributed to various users. In the event that a collection of elements within a function does not offer a clearpoint of segmentation, it may be necessary to incorporate a new milestone elementas a validation and approval point within the function. For example, at a specificpoint in a process, a manager can send an e-mail, apply a digital signature, or adda validation mark to the data. That additional notification or mark must be presentfor the primary user to continue the remaining processes.© 2010 by Taylor and Francis Group, LLC
  • 41. 14 ◾ Official (ISC)2 Guide to the CISSP CBK Operational considerations: One of the key attributes of a successful security pro-gram is integrating effectively within the business or operational goals of the orga-nization. When considering separation of duties, the impact to the function and itsrole in the business are essential to overall success. When implemented poorly, orwithout taking overall business goals into account, security-related processes likeseparation of duties can hinder the process and make it prone to circumvention.The impact to the operations must be taken into account whenever establishingseparation of duties practices for a function. The security manager must considerthe impact to the efficient operation of the function as well as the meaningful alter-native options in the event there is a system failure or outage. It is important not tosacrifice security, but rather to have alternate compensating controls that can meetthe objectives for security. In addition, the cost of implementing separation of duties within a businessprocess must be weighed against the overall risk that process represents to the orga-nization and whether the benefits of separation outweigh the time and effort coststo the organization. In the separation of duties example of arming and launchingnuclear missiles, it can be nearly universally agreed that the cost of implementingseparation in such a circumstance is greatly outweighed by the risk and poten-tial harm that could come from a non-separated nuclear environment. Conversely,most would agree that implementing separation of duties in a cafeteria’s tuna sand-wich-making process would not make a great deal of sense. While it is true that amalevolent sandwich maker could intentionally inflict illness or even death uponunsuspecting patrons, the actual incidence of such an occurrence is relatively lowand the addition of the extra personnel required for such a low-risk situation wouldbe very costly to the organization. User skills and availability: Clearly, separation of duties requires multiple partici-pants, and each of those participants must have the appropriate skills and training toperform the specific element of a given function. Additionally, there must be enoughpersonnel to perform all the elements that have been distributed. In organizations thathave small staffs, pure separation of duties may not be feasible. For example, a com-mon separation practice is to ensure that those who develop software programs shouldnot have access to the production environments where those programs are run. Thosewho run and maintain the production environment should be a separate and distinctgroup from the development team. This separation prevents a rogue developer fromintroducing malicious code directly into a production system. Unfortunately, manysmall development shops and start-up companies cannot afford the extra personnelthat such a separation environment requires. Staffing those extra positions may justmean the difference between a successful business and bankruptcy. Given the trade-off between the benefits of separation (prevention against malicious code) and thecost of separation (double the salary expense), a reasonable business owner might optagainst separation, preferring instead to instill other mitigating controls to reduce therisk, such as a strong change management process and code reviews.© 2010 by Taylor and Francis Group, LLC
  • 42. Access Control ◾ 15Least Privilege: The principle of least privilege is one of the most fundamental char-acteristics of access control for meeting security objectives. Least privilege requiresthat a user or process be given no more access privilege than necessary to performa job, task, or function. The objective is to limit users and processes to access onlyresources and tools necessary to perform assigned functions. Th is often requireslimits not only on what resources can be accessed, but also includes limiting theactions that can be performed by the user even if they have authorized access tothe resource. For example, a user may be restricted to only read-only, update, andexecute permission on a system without the ability to create or delete files anddatabases. Ensuring least privilege requires identifying what the user’s job is, deter-mining the minimum set of privileges required to perform that job, and restrictingthe user to a domain with those privileges and nothing more. Denying users accessprivileges that are not necessary for the performance of their duties ensures thatthose privileges cannot be used to circumvent the organization’s security policy.Need to Know: A companion concept to least privilege is the notion of need toknow. If the goal of least privilege is to reduce access to a bare minimum, needto know defines that minimum as a need for that access based on job or businessrequirements. For example, although the CIO in an organization has the appropri-ate rank in the organization to view upcoming quarterly financial forecasts, theorganization’s comptroller may decide that the CIO does not have a need to knowthat information and, thus, restrict access to it. Need to know is also used heavily insituations where operational secrecy is a key concern, such as in military operations.Military leaders often keep operational plans on a need to know basis to reduce thenumber of people who know about the plans and reduce the risk that someone willleak that information to the enemy.Compartmentalization: Finally, compartmentalization completes the least privi-lege picture. Compartmentalization is the process of separating groups of peopleand information such that each group is isolated from the others and informationdoes not flow between groups. For example, an organization might compartmen-talize (both logically and physically) a team working on mergers and acquisitions sothat the information that team is working on will not leak to the general employeepopulation and lead to a potential insider trading problem. Compartmentalizationis helpful in situations where information needs to stay contained within a singlegroup or area and strong protections need to be taken to keep that informationfrom leaking outside the area.Security Domain: A security domain is an area where common processes and secu-rity controls work to separate all entities involved in these processes from otherentities or security domains. For example, all systems and users managing financialinformation might be separated into their own security domain, and all systemsinvolved in e-commerce activity might get their own security domain. A securitydomain is based on trust between resources or services in areas or systems that share© 2010 by Taylor and Francis Group, LLC
  • 43. 16 ◾ Official (ISC)2 Guide to the CISSP CBK High security network High clearance Medium user security network Medium clearance user Low security Low clearance network userFigure 1.5 Three distinct and separate security domains exist on the server.Only those individuals or subjects authorized can have access to the informationon a particular domain.a single security policy and a single management structure. The trust is the uniquecontext in which a program is operating. There may be multiple security domainswithin an organization and an entity may, at times, belong to more than one secu-rity domain based on its responsibilities and functions at any given time. The sepa-ration between domains can be either physically or logically managed. Securitydomains support a hierarchical relationship where subjects can access objects inequal or lower domains; therefore, domains with higher privileges are protectedfrom domains with lesser privileges. In Figure 1.5, three distinct and separate security domains exist on the server,and only those individuals or subjects authorized can have access to the informa-tion on a particular domain. A subject’s domain, which contains all of the objects that the subject can access,is kept isolated. Shared objects may have more than one access by subjects, and thisallows this concept to work. For example, if a hundred subjects have access to thesame object, that object has to appear in a hundred different domains to allow thisisolation.Information ClassificationMany organizations have thousands, or even millions, of data files containing valu-able information on all aspects of the organization’s business. Information is created© 2010 by Taylor and Francis Group, LLC
  • 44. Access Control ◾ 17in great volumes on a daily basis from a variety of transactional systems, as wellas aggregated into databases and data warehouses to provide decision-making sup-port. The information is stored on backup tapes, copied to portable USB drives, andburned to CDs and DVDs for portability. Information is stored on portable comput-ers and network drives, and in e-mail systems to support the sharing of information.The same information is printed and filed, and stored off site for business continuityand disaster recovery purposes. A file will typically have multiple versions, will bestored in multiple locations, and is capable of being accessed by different individualsin each of these locations. Fundamental security questions are raised in this type ofenvironment. Where is the organization’s information? How should the informationbe handled and protected? Who should have access to it? Who owns the informa-tion? Who makes the decisions around these parameters? These questions form theimpetus for implementing an information classification strategy. Information classification is the practice of evaluating the risk level of the organiza-tion’s information to ensure that the information receives the appropriate level of pro-tection. The application of security controls to information has a cost of time, people,hardware, software, and ongoing maintenance resources that must be considered.Applying the same level of control to all of the company’s assets wastes resources andmoney by overprotecting some information and underprotecting other information.In an effort to simplify security budget management, security dollars are often spentuniformly to protect all assets at the same level. Not all assets have the same value orneed the same level of protection. The budget could be better allocated, and the secu-rity of the organization better managed, by providing only basic protection to assetsof little value and providing increased protection to those assets considered to be ofgreater value or higher sensitivity. By applying protection controls to the informationbased upon the classification, the organization gains efficiencies and thus reduces theoverall cost of information security. The primary objective of information classifica-tion, therefore, is to group an organization’s information assets by levels of sensitivityand criticality. Once this is done, the organization then applies the appropriate level ofprotection controls to each asset in accordance with the classification assigned to it.Information Classification Benefits: There are many benefits in classifying infor-mation within an organization. First, classification helps to establish ownership ofthe information, which provides a central point of control for all aspects of securityand access to the information. This increases the likelihood that the information willbe used in the proper context and those accessing the information will be properlyauthorized. Information classification also increases the confidentiality, integrity, andavailability of information by focusing an organization’s limited security funds on theresources requiring the highest level of protection and providing lesser controls for theinformation with less risk of loss. By understanding the information and its location,the organization can identify areas that may need higher levels of protection. Information classification can also have a positive effect on the knowledge andawareness of security within an organization. A classification program allows forgreater understanding of the value of the information to be protected, and provides© 2010 by Taylor and Francis Group, LLC
  • 45. 18 ◾ Official (ISC)2 Guide to the CISSP CBKa clearer direction for the handling of sensitive information. In addition, a periodicreview of the classification scheme and controls helps personnel maintain awarenessof the importance of protecting information. Finally, the process itself helps create agreater organizational awareness of the need to protect company information. Information classification can also have an operational benefit to the organiza-tion. Critical information can be identified to support business recovery scenariosby focusing the recovery efforts on the most critical areas. Placement of informationwith higher levels of classification on more reliable storage and backup mecha-nisms helps reduce recovery times. Finally, an organization can reduce the expenseof inefficient storage for nonsensitive information in data storage or physical filecabinets.Establishing an Information Classification Program: Establishing an informa-tion classification strategy and developing plans for implementation may seem a bitonerous for an organization that has never had such a program before. However,once the work of defining the classification levels and determining the classificationof the individual information has been completed, the value to the organization iswell worth the effort. The following sections walk through the steps of establishingand sustaining an information classification program. Although the exact path eachorganization takes may be a bit different, the steps identified are a good representa-tion of the major steps involved in programs of this type. The exact sequence or thesteps included may also vary or be combined, depending upon the size, complexity,and culture of the organization. The basic steps are 1. Determine information classification program objectives. 2. Establish organizational support. 3. Develop an information classification policy and supporting procedures. 4. Develop information classification process flows and procedures. 5. Develop tools to support the process. 6. Identify process or application owners. 7. Identify information owners and delegates. 8. Distribute standard templates. 9. Classify information and applications. 10. Develop auditing procedures. 11. Load classification information into a central repository. 12. Train users. 13. Periodically review and update information classifications.Step 1—Determine Information Classification Program Objectives: It is helpful todocument the specific program objectives to give the program a clear vision ofits goals and to help define and explain the program to others in the organiza-tion. Defining clear objectives also helps to contain the scope of the effort anddetermine when deliverables are completed, so that these accomplishments may becelebrated to sustain those involved in later phases of the project. The objectives are© 2010 by Taylor and Francis Group, LLC
  • 46. Access Control ◾ 19also important for obtaining the support of those needed to both endorse and carryout the program. It is very important when defining the overall program objectives to clearlyestablish that information classification is a program, not a project. A project is aseries of tasks that lead to a known end state. A program, on the other hand, isa change in organization process and behavior that will have long-term lastingimpact to the organization. Implementing information classification in an organi-zation will change the way the organization thinks about and manages informationpermanently and, thus, has no defined end state to speak of. It is truly a program inall meaningful respects and should always be referred to as such.Step 2—Establish Organizational Support: Senior management support is essentialto the start-up and continued operation of the information classification program.There may be a perception within the organization that all information should betreated as confidential and is adequately secured by physical barriers to the facility,firewalls, and other security controls protecting the environment. This view pro-motes the concept that all information should be protected equally. Unfortunately,the reality is that information resources should be given the appropriate protectionbased on their overall risk and threat profile: no more and no less. The securityprofessional should work through the cost/benefit discussion with senior manage-ment to illustrate how the appropriate application of security controls is the mosteffective approach to benefit the business. Although security professionals understand the importance of informationclassification, without the proper positioning of the effort, the organization’s seniormanagement and end users may perceive the effort as another project requiringtheir resources, with little payback to individual departments. The program shouldbe socialized with senior management by using business-focused benefits, as wellas highlighting enhancements to the effectiveness of the organization. Examples ofsuch benefits include ◾ Ensuring confidentiality of information by restricting who can access or copy the information ◾ Increased accuracy and integrity of information by controlling who can mod- ify or update the information ◾ Increased availability of information by restricting the ability to overwrite or erase important or critical data ◾ Avoiding damage to the organization’s reputation by reducing the risk of unauthorized disclosures ◾ Reduction in costs of overprotection ◾ Ability for managers to enforce accountability ◾ Protection of intellectual property and trade secrets ◾ Protection of customer or consumer confidential information ◾ Compliance with industry regulation or legal requirements to protect person- ally identifiable information© 2010 by Taylor and Francis Group, LLC
  • 47. 20 ◾ Official (ISC)2 Guide to the CISSP CBKStep 3—Develop an Information Classification Policy and Supporting Procedures: Theinformation classification policy communicates the requirement to the organiza-tion to classify the information assets. The policy also communicates the primarypurpose of information classification, which is to ensure that the appropriate pro-tections are applied according to the level of sensitivity, risk, and criticality. Thepolicy statement is a description of the requirement, including the scope of usersand systems to which the policy applies, as well as what is expected of those affectedby the program. The policy should describe the overall information classificationframework and the meaning of each level or categorization within the framework.The policy may also indicate the responsibilities of users and management in han-dling the information. Policies are generally written at a high level, with the details reserved for sup-porting procedures. The procedures communicate how to determine the classifi-cation of a particular information item, as well as how that information shouldbe subsequently handled and protected. Involvement with business or applicationowners, as well as the IT department, is important in determining the variousprocedure and control matrices. This establishes business owners buy-in to theprocedures, and provides an operational perspective for determining how theinformation should be managed.Step 4—Develop Information Classification Process Flow and Procedures: Documentedprocedures assist in the ongoing operation of classifying information. Because theorganization may have many files that have not been looked at through the infor-mation classification lens, the start-up effort to develop these flows and proceduresmay require a large amount of resources. Ongoing efforts will also require that theinformation is reviewed and updated on a periodic basis. The initial gathering of theinformation classifications and the process utilized must be driven by a documentedprocedure so that all of the parties involved in the effort are aware of their individualroles and requirements to complete the classification. Flowcharts in addition to thedocumented written processes can be helpful, as individuals receive and retain infor-mation through different means. The documentation of the process also helps ensurethat the classification process is handled uniformly throughout the organization.Step 5—Develop Tools to Support Process: Various tools, such as word processingdocuments, spreadsheets, databases, and presentations, support the collection pro-cess. Standardized templates facilitate collection as well as the ability to gener-ate reports by data type to ensure that the designations are consistent across theenterprise and follow the prescribed information classification policy and associatedstandards. Once the spreadsheets are distributed to the individuals completing theinformation, the results can be exported to a database for consolidation, review, andongoing maintenance.Step 6—Identify Process or Application Owners: The business owner of each applica-tion provides the functional requirements for what data is necessary for the business.© 2010 by Taylor and Francis Group, LLC
  • 48. Access Control ◾ 21The owner will have the most intimate knowledge of the data and how they areused. Apart from the business owner, the systems or information technology ownermay act primarily as a data custodian of the information and will understand theprocessing, technical, storage, and security protections of the information. Bothindividuals contribute to an understanding of the classification requirements andshould be identified as part of the process.Step 7—Identify Information Owners and Delegates: Information owners are thosepeople in the organization who understand the information in their area of the busi-ness and have the ultimate responsibility for making decisions about the usage ofthe information. They may manage the responsibility or assign designees or infor-mation delegates that are empowered to make the day-to-day operational decisionsas to who is allowed to read, modify, or delete the business information. The ownersand delegates are the primary individuals who are involved in the classification pro-cess, as they have the greatest business knowledge of the information in question.Step 8—Distribute Standard Templates: Providing standard information classifica-tion templates to data owners promotes uniform data gathering and makes the sub-sequent tasks of tracking and analysis of the information much easier. The templatesmay be part of the tools developed in Step 5. These templates should be distributedto the information owners or delegates to collect the classification information onthe data managed by their departments.Step 9—Classify Information and Applications: Once the templates have been dis-tributed, the data owners (or their delegates) use the information classification pol-icy and standards to classify the information. Typically there are three to four levelsof information classification used by most organizations: ◾ Public: Information that may be disclosed to the general public without concern for harming the company, employees, or business partners. No special protections are required, and information in this category is some- times referred to as unclassified. For example, information that is posted to a company’s public Internet site, publicly released announcements, market- ing materials, cafeteria menus, and any internal documents that would not present harm to the company if they were disclosed would be classified as public. ◾ Internal use only: Information that could be disclosed within the company, but could harm the company if disclosed externally. Information such as customer lists, vendor pricing, organizational policies, standards and pro- cedures, and internal organization announcements would need baseline security protections, but do not rise to the level of protection as confidential information. ◾ Confidential: Information that, if released or disclosed outside of the orga- nization, would create severe problems for the organization. For example,© 2010 by Taylor and Francis Group, LLC
  • 49. 22 ◾ Official (ISC)2 Guide to the CISSP CBK information that provides a competitive advantage is important to the tech- nical or financial success (like trade secrets, intellectual property, or research designs), or protects the privacy of individuals would be considered confi- dential. Information may include payroll information, health records, credit information, formulas, technical designs, restricted regulatory information, senior management internal correspondence, or business strategies or plans. These may also be called top secret, privileged, personal, sensitive, or highly confidential. ◾ Restricted: Information that requires the utmost protection or, if discovered by unauthorized personnel, would cause irreparable harm to the organization would have the highest level of classification. There may be very few pieces of information like this within an organization, but data classified at this level requires all the access control and protection mechanisms available to the organization. Even when information classified at this level exists, there will be few copies of it around, and tracking who has this information, when they received it, and when they returned it are extremely important. Information of this type includes merger and acquisition information, financial forecasts, or anything that (if publicly known) would materially affect the market status or stock price of the company.An important point to consider is that this process may take a long (a very, verylong) time to complete, especially if you are analyzing and classifying a largeenvironment with complex data relationships. When faced with such a seeminglydaunting task, data owners will often react by arguing against the process based onthe cost of the analysis alone or relegating the project to back-burner status where itwill receive little, if any, attention. It is important to work with all the data ownersand senior management to ensure that the program remains on track. There are some steps you can take to reduce the amount of time required forthe initial classification effort. For example, a data owner may have a database withthousands of intermingled data elements fitting into all three classification levels.Rather than classifying each individual data element and applying appropriate con-trols at the element level, the owner may elect to reorganize the database into publicand nonpublic data sets and apply the appropriate controls in aggregate to eachdata set. While the process of such aggregation may lead to the oversimplificationproblem mentioned earlier, if applied judiciously it can lead to enormous time sav-ings during the classification process and cost savings during the implementationof protection controls. During the planning and design of the classification program some consider-ation should be given to the classification of aggregate data. This is informationthat would not be considered sensitive when taken alone, but, when combined withother data, suddenly becomes sensitive and worthy of additional protection. Forexample, a bank routing number (the number found at the bottom of a check thatuniquely identifies a U.S. financial institution) by itself would not be considered© 2010 by Taylor and Francis Group, LLC
  • 50. Access Control ◾ 23particularly sensitive by a data owner. Routing numbers are public informationeasily found through a simple Internet search. However, when that routing numberis combined with an individual account number at that bank, the combination ofthe two suddenly becomes very sensitive, because a thief can use that combina-tion to access that individual’s bank account. Data owners need to be aware of thedangers of aggregate data and account for them during the classification of theirinformation. In many circumstances one organization will be managing information onbehalf of another organization. For example, many companies outsource theirpayroll processing to third parties and many banks outsource their IT systems(including account management) to third-party service providers. In these cases,the company that owns the information and the service provider may each haveits own classification systems. It is important that each party understand the other’sclassification system and the information owner must ensure that the classificationassigned to its information by the service provider (as well as the underlying protec-tion mechanisms for that classification) meets its needs for adequate informationprotection.Step 10—Develop Auditing Procedures: Once information is classified, classifica-tions rarely change unless the information has been misclassified, the informationthat previously required protection is now public knowledge, or time has madewider disclosure of the information less harmful to the organization. In most cases,if there was a reason to protect the information initially to a certain level, then theinformation will continue to be protected at this same level through its useful life.However, new data are always being generated and needs to be classified. Existingdata should also be periodically reviewed to ensure that the classifications are cor-rect. Information classification auditing is the process of reviewing the classifica-tions to ensure the accuracy of the information, thus ensuring that the appropriatesecurity protections continue to be applied. An information classification auditoften relies on performing “spot” tests such as observations of sensitive informationleft unprotected in work spaces (also known as a clean desk/clear screen check) andchecking of trash receptacles for discarded sensitive information as a method tomeasure compliance with the information classification policy.Step 11—Load Classification Information into a Central Repository: The classificationinformation obtained through the classification procedures and templates is loadedinto a central repository to support the analysis of the collections, as well as to serveas the database for the ongoing updating of the classifications. A database tool pro-vides the ability to examine the information from multiple perspectives, such as list-ing all of the data types owned by a particular data owner, all of the data types of aparticular classification level, or what data types are associated with which applica-tions. Depending on the amount of assets being classified and the complexity of theclassification scheme, the database may grow to considerable size. Careful planningis important to ensure adequate space and processing capacity for the future.© 2010 by Taylor and Francis Group, LLC
  • 51. 24 ◾ Official (ISC)2 Guide to the CISSP CBKStep 12—Train Users: If the end user or employee does not understand what infor-mation is public, internal user only, or confidential, or if the user does not under-stand the requirements and differences in how to handle each type of information,then the investment in information classification will have limited success. It iscritical that the user community gets proper training in the classification pro-gram because they (the users) are the ones who will work with the program on adaily basis. The training program must convey the purpose and importance of theprogram and provide the proper motivation for users to support the classificationeffort. Training should include information on the overall policies and the variousclassification levels the organization will use. Most importantly, the training shouldgive practical examples of different types of information the users will come in con-tact with and how to properly handle and protect that information using the officialstandards and protection controls.Step 13—Periodically Review and Update Information Classifications: Informationwithin an organization rarely remains static. To ensure that the organization con-tinues to match current threats with appropriate information protections, the clas-sifications assigned to information must be reviewed on a periodic basis. It is mostlikely that the classifications will not change dramatically, but adjustments may beneeded. Scheduling auditing procedures on a periodic basis increases the quality ofthe information classification program, as does providing the capability to updateand add new information classifications outside of the normal cycle.Labeling and Marking: The labeling and marking of media with classification lev-els provides the ability to manage the information contained within the media withthe handling instructions appropriate to the respective classification. For example,a backup tape may be labeled with a serial number and “Company Confidential”to indicate how the information should be treated. Organizations may decide notto label individual information, but rather control all the information within abusiness area or location according to restrictions based upon a single classifica-tion type. For example, all backup tapes in the tape library may be classified as“Confidential” and have appropriate controls placed on the whole library. Labeling and marking information also apply to all forms of systems and mediathat manage or display classified information. This includes application displays,printouts, and reports generated from organization systems. All these must have theappropriate classification verbiage displayed or printed alongside the information toensure that all who come in contact with that information know the classificationlevel and are able to take the appropriate protective measures.Information Classification Assurance: Periodically testing the information clas-sifications provides assurance that the activities are being properly performed. Theaudit procedures will uncover those data types that need to be added or reclassified.Random audits of user areas, such as checking desktops for confidential documentsnot returned to file drawers, information left overnight in open shredding bins, files© 2010 by Taylor and Francis Group, LLC
  • 52. Access Control ◾ 25in electronic file folders accessible by anyone within the organization, confidentialinformation posted to a public Web site, or information left on copiers, printers,and fax machines, can provide information regarding organizational compliance.Encouraging end users to report security incidents related to mishandling of classi-fied information can also be a source to provide assurance. The information security manager should work closely with the organization’sinternal audit manager to establish information classification reviews as part of thestandard audit program. In this way, the audit group can assist in ensuring the con-tinual monitoring of the classification program including the assurance that newinformation is classified appropriately as it enters the environment.Access Control RequirementsAs simple as it may seem, implementing an effective access control system—whetherfor a single application or for an entire enterprise—takes careful planning, research,foresight, and (of course) a great deal of persuasive skill to bring together all thedisparate interests in the organization to agree on the best way to move forward.However, none of this can proceed without first considering the basic requirementsthat any access control system must meet. While each enterprise or applicationwill have its own specific access control needs, there are some basic considerationsthat all security professionals must look for in an access control system, process, ortechnology. This section will discuss several of those requirements.Reliability: First and foremost, any access control system under consideration mustbe reliable enough to give consistent results every time. The reliability of a systemhas both physical and logical components. Both are important to consider whendetermining the best path for an organization to take. An access control system must operate within the same physical environmentalconstraints under which its users operate. This means that all the environ-mental factors that assist or hinder its users will have the same effect on the accesscontrol system. Factors such as heat, humidity, complexity, wear and tear on com-ponents, and user attitude will all have an effect on the long-term viability of theenvironment. For example, if a badge reading system is used in a busy area (likea hospital emergency room or fire house) it will most likely be subject to physicalabuse as users hurry to swipe their cards through the reader, perhaps knocking orbanging it repeatedly in the process. It will get heavily abused as frustrated and busyusers take out their frustration on the reader. Likewise, an access control systemlocated at a boat marina or at a military facility in the desert will be subject to heatand moisture extremes that must be considered and tested before final acceptance. While the physical aspects of reliability are important, they can usually beaddressed by better material selection, manufacturing quality, and testing. What isoften more difficult to determine during the research and product selection stage© 2010 by Taylor and Francis Group, LLC
  • 53. 26 ◾ Official (ISC)2 Guide to the CISSP CBKis the product’s ability to work reliably and accurately over a long period of time.The product must have the ability to minimize false positives and negatives, makeaccurate authentication and authorization decisions, follow organizational policies(as defined within the product) unambiguously, and function predictably accord-ing to the expectations of the organization. Reliability of the system is a fundamen-tal requirement, for without it the organization cannot place any confidence in thesystem or its results. An access control system that fails may even cause a completedenial of service to the organization. The inability to trust in the accuracy and reli-ability of an access control system will cause the entire access control infrastructureto collapse.Transparency: Security (more specifically, the implementation of most securitycontrols) has long been a sore point with users who are subject to security controls.Historically, security controls have been very intrusive to users, forcing them tointerrupt their work flow and remember arcane codes or processes (like long pass-words or access codes), and have generally been seen as an obstacle to getting workdone. In recent years, much work has been done to remove that stigma of securitycontrols as a detractor from the work process adding nothing but time and money.When developing access control, the system must be as transparent as possible tothe end user. The users should be required to interact with the system as little aspossible, and the process around using the control should be engineered so as toinvolve little effort on the part of the user. For example, requiring a user to swipe an access card through a reader is aneffective way to ensure a person is authorized to enter a room. However, implement-ing a technology (such as RFID) that will automatically scan the badge as the userapproaches the door is more transparent to the user and will do less to impede themovement of personnel in a busy area. In another example, asking a user to under-stand what applications and data sets will be required when requesting a system IDand then specifically requesting access to those resources may allow for a great dealof granularity when provisioning access, but it can hardly be seen as transparent.A more transparent process would be for the access provisioning system to have arole-based structure, where the user would simply specify the role he or she has inthe organization and the system would know the specific resources that user needsto access based on that role. This requires less work and interaction on the part ofthe user and will lead to more accurate and secure access control decisions becauseaccess will be based on predefined need, not user preference. When developing and implementing an access control system or process—indeed when establishing any type of security control—special care should be takento ensure that the control is as transparent to the end user as possible and interruptshis work flow as little as possible.Scalability: Setting up an access control system for five people can be hard. Settingup an access control system for 5,000—or 50,000—people is really hard. Ensuringthe same system originally developed for five will work just as well for 50,000 can© 2010 by Taylor and Francis Group, LLC
  • 54. Access Control ◾ 27be next to impossible. When establishing an access control system, the securityprofessional should always assume that the system will grow way beyond origi-nal expectations and ensure the capacity of the technology and the process scalesaccordingly. A good rule of thumb is the Double Comma rule of estimation. Thedouble comma rule states: When estimating capacity for any new technology, start with an accurate estimate of the number of units (for example, people, packets, or badges) that will reasonably be required. Then, take that number, double it, then add enough trailing zeroes to force the addition of another comma in the final number.So, for example, if an administrator needs to size a password database for 100users, enough space should be allocated in the password database for 2000 users.If calculated estimates indicate that an access control system will need to process20,000 access requests an hour, the system should be sized to handle 4,000,000requests per hour. Of course, the double comma rule will need to be adjusted for aparticular implementation based on available budget and technology limitations.For instance, the security professional should consider if any access technology canprocess 4,000,000 requests per hour, if the organization can afford the equipmentrequired for that capacity, and if the network infrastructure is capable of handlingthat volume of traffic. The results of those considerations will adjust the final capac-ity estimate for the technology. Nevertheless, the concept should be clear. Initialcapacity estimates may suffice for a project’s original needs and purposes, but thesecurity professional should assume that the system will grow well beyond originalestimates and should plan, as much as reasonably possible, to ensure that any givensolution has the ability to scale with that growth.Integrity: Integrity was generally defined earlier in the chapter as the ability toensure that systems and information have not been altered in any unauthorized way.When applied to an access control system, the system should have adequate tech-nology, process, and audit features to ensure that the system consistently performsaccurately and within stated specifications so that the organization can be assuredthat the system provides accurate access control decisions at all times. Maintainingthe integrity of the system includes many facets. Most notably it includes assuringthat only authorized personnel have access to the administrative functions of thesystem. An attacker gaining the ability to manage the configuration of the accesscontrol system would have the ability to establish valid user credentials, alter orerase log and audit data, cause denial-of-service situations, or establish operationalrules to selectively allow or deny users access to the protected system. Ensuring thatonly authorized personnel have access to administer the system goes a long waytoward ensuring the integrity of the access control function. Regular testing of the access control function will ensure that the service main-tains its integrity over time. As the system remains in continuous use it may begin© 2010 by Taylor and Francis Group, LLC
  • 55. 28 ◾ Official (ISC)2 Guide to the CISSP CBKto lose sensitivity, components may begin to wear out, or continuous administra-tive updates may introduce conflicts or obsolescence in the access rule set. Regularadministrative care and testing will ensure that the system continues to operatewithin expected functional parameters and that any deviations from those param-eters are caught early and corrected.Maintainability: The access control system should require a minimum of mainte-nance to function properly over an extended period of time. Naturally, the physicalcomponents of the system may wear out over time, such as card readers, keypads,or support systems, and the cost and effort to maintain these components shouldbe calculated into the overall business case for the system. However, the person-nel effort to maintain the system should not be underestimated or overlooked.Depending on the type of technology in use, the administrative effort required tokeep the system in proper working order can be considerable or require specializedskills that may be expensive to acquire or maintain. Overall, however, an effective access control system is one that requires a mini-mum of maintenance oversight or continuous tuning. Administrative effort and finetuning should be concentrated on updating rule sets, managing user populations,and policy development. The management of these functions should also requireas little effort as possible. The administrative controls over the system should bestraightforward to understand and simple to operate. A system that is overly com-plicated to understand or difficult to maintain is one that will either quickly fallinto disorder or be replaced with a system that is easier to manage.Authentication Data Security: Equally as important as the access control systemis to an organization are the controls that protect the authentication data itself.The authentication data include user identities, passwords, biometric information,access capabilities, and a host of other sensitive information which, if obtainedby an attacker, would provide a roadmap for infiltrating and navigating aroundan organization’s information systems. The protections around the authenticationdatabase should be researched and tested before the system is implemented. Dataencryption should be in place, system- and file-level access controls should be pres-ent, and strong authentication for administrative functions should be investigated.Auditability: Even if the access control system operates perfectly within expectedparameters and there are no apparent instances of system failure or unauthorizedaccess, a complete audit trail of system activities is necessary to provide documentedassurance that the system is functioning properly. The system should have the abil-ity to provide a complete record of all access control activity. This includes authen-tication requests, data access attempts, changes to privilege levels, and exercise ofadministrative capabilities. It is extremely important that this activity is recorded forsuccessful activity as well as failures. Too often, systems record only failed instancesof the above activity. Unfortunately, if an attacker succeeds in gaining authorized© 2010 by Taylor and Francis Group, LLC
  • 56. Access Control ◾ 29access to the system, or if an authorized insider attempts to perform nefarious acts,the system that only records event failures will fail to capture the activity of theseindividuals. This will lead to an inability to understand precisely what these indi-viduals did within the system and a failure to properly investigate and prosecute(organizationally or legally) their activities.Access Control CategoriesIn the development of an access control architecture for an enterprise, it is necessaryto fully understand the different categories and types of potential controls. Thissection will describe those different categories and discuss how each fits into theoverall access control universe. This will also establish a foundation for later discus-sion on access control technology, practices, and processes. There are literally hundreds of different access approaches, control methods,and technologies, both in the physical world and in the virtual electronic world.Each method addresses a different type of access control or a specific access need.For example, access control solutions may incorporate identification and authen-tication mechanisms, filters, rules, rights, logging and monitoring, policy, and aplethora of other controls. However, despite the diversity of access control methods,all access control systems can be categorized into seven primary categories. Theseven main categories of access control are 1. Directive: Controls designed to specify acceptable rules of behavior within an organization 2. Deterrent: controls designed to discourage people from violating security directives. 3. Preventive: controls implemented to prevent a security incident or informa- tion breach 4. Compensating: controls implemented to substitute for the loss of primary con- trols and mitigate risk down to an acceptable level 5. Detective: controls designed to signal a warning when a security control has been breached 6. Corrective: controls implemented to remedy circumstance, mitigate damage, or restore controls 7. Recovery: controls implemented to restore conditions to normal after a secu- rity incidentFigure 1.6 shows a continuum of controls relative to the time line of a securityincident:Directive Controls: Directive controls, sometimes referred to as administrativecontrols, provide guidance to personnel as to the expected behavior with respect to© 2010 by Taylor and Francis Group, LLC
  • 57. 30 ◾ Official (ISC)2 Guide to the CISSP CBK Level of Threat to Organization HIGH Detective controls Corrective Medium controls Compensating controls Recovery controls Preventative controls Low Directive controls Establish Discovery and Adjust and Planning defenses INCIDENT! reaction regroup TimeFigure 1.6 Continuum of controls relative to the time line of a security within the organization. Directive controls provide users with the generalguidelines they must follow if they are to be permitted access to information orsystems. Directive controls are not only applicable to an organization’s employeesbut contractors, guests, vendors, and anyone else who will have access to the orga-nization’s information systems must additionally abide by them. The most common examples of directive controls are the organization’s securitypolicies and procedures. These documents provide the basis for information secu-rity throughout the organization and provide personnel with the model that mustbe adhered to as they perform their work. Although directive controls are gener-ally implemented in the form of documented statements of organizational intent,they should not be considered optional or modifiable by organization personnel.Directive controls have the weight of law within the organization and should be asstrongly followed as any technical or procedural limitation. Many organizations compile their directive controls into a single acceptable usepolicy (AUP). The AUP provides a concise listing of the proper (and, in many casesimproper) procedures, behaviors, and processes that all personnel must follow in orderto gain and maintain access to information and systems within the organization. It isconsidered a best practice for all employees to agree to and sign the AUP before beinggranted access to any organizational resource. If the employee is unable (or unwill-ing) to abide by the terms of the AUP, no access will be granted. Many organizationsrequire their employees to sign the AUP annually, either as part of the regular securityawareness training or as part of the annual performance review process.© 2010 by Taylor and Francis Group, LLC
  • 58. Access Control ◾ 31Deterrent Controls: Access controls act as a deterrent to threats and attacks by thesimple fact that the existence of the control is enough to keep some potential attackersfrom attempting to circumvent the control. This is often because the effort requiredto circumvent the control is far greater than the potential reward if the attacker is suc-cessful, or, conversely, the negative implications of a failed attack (or getting caught)outweigh the benefits of success. For example, by forcing the identification andauthentication of a user, service, or application, and all that it implies, the potentialfor incidents associated with the system is significantly reduced because an attackerwill fear association with the incident. If there are no controls for a given access path,the number of incidents and the potential impact become infinite. Controls inher-ently reduce exposure to risk by applying oversight for a process. This oversight acts asa deterrent, curbing an attacker’s appetite in the face of probable repercussions. The best example of a deterrent control is demonstrated by employees and theirpropensity to intentionally perform unauthorized functions, leading to unwantedevents. When users begin to understand that by authenticating into a system toperform a function, their activities are logged and monitored, and it reduces thelikelihood they will attempt such an action. Many threats are based on the ano-nymity of the threat agent, and any potential for identification and associationwith their actions is avoided at all costs. It is this fundamental reason why accesscontrols are the key target of circumvention by attackers. Deterrents also take theform of potential punishment if users do something unauthorized. For example,if the organization policy specifies that an employee installing an unauthorizedwireless access point will be fired, that will deter most employees from installingwireless access points. The effect deterrent controls have on a potential attacker will vary with both thetype of control and the motivation of the attacker. For example, many organiza-tions post a warning message to computer users during the login process indicatingthat their activities may be monitored. While this may deter a casual user fromperforming unauthorized activities, it will not stop a determined attacker fromhis goals. Likewise, implementing a multifactor authentication mechanism on anapplication will greatly reduce system compromises through such mechanisms aspassword guessing, but a sophisticated attacker may then turn to the use of a vul-nerability scanning tool to determine if the system can be compromised througha host or network vulnerability. As the sophistication and the determination of anattacker rises, so does the sophistication and cost of an effective deterrent to preventthat attacker from attempting his attack.Preventative Controls: Preventative access controls keep a user from performingsome activity or function. Preventative controls differ from deterrent controls inthat the control is not optional and cannot (easily) be bypassed. Deterrent controlswork on the theory that it is easier to obey the control rather than to risk the conse-quences of bypassing the control. In other words, the power for action resides withthe user (or the attacker). Preventative controls place the power of action with thesystem—obeying the control is not optional. The only way to bypass the control isto find a flaw in the control’s implementation.© 2010 by Taylor and Francis Group, LLC
  • 59. 32 ◾ Official (ISC)2 Guide to the CISSP CBK There are many examples of preventative controls in common use. Firewallsare preventative controls because they block (prevent) all traffic except that whichis specifically allowed. Authentication methods are preventative controls becausethey prevent all except authorized users into a system. Door locks are a preventativecontrol because a person cannot go through the door unless he or she has the appro-priate key. Some might say that door locks are a deterrent mechanism because anattacker can always pick the lock, but such an act would constitute “finding a flawin the control’s mechanism” and, thus, fall squarely in the preventative camp. This last example, however, brings up an interesting point about the relation-ship between deterrent and preventative controls. In reality, there is a fine linebetween the two, and the distinction is not always clear. What some may considerpreventative control would be for most people merely a deterrent to a sophisti-cated or accomplished attacker. This brings into clear focus the notion that allaccess control—indeed, all security measures—must take into account the level ofsophistication of the potential attacker. Once that is understood, the appropriatesophistication of the security controls can be established.Compensating Controls: Compensating controls are introduced when the existingcapabilities of a system do not support the requirement of a policy. Compensatingcontrols can be technical, procedural, or managerial. Although an existing systemmay not support the required controls, there may exist other technology or processesthat can supplement the existing environment, closing the gap in controls, meetingpolicy requirements, and reducing overall risk. For example, the access control policymay state that the authentication process must be encrypted when performed over theInternet. Adjusting an application to natively support encryption for authenticationpurposes may be too costly. Secure Socket Layer (SSL), an encryption protocol, canbe employed and layered on top of the authentication process to support the policystatement. Other examples include a separation of duties environment, which offersthe capability to isolate certain tasks to compensate for technical limitations in thesystem and ensure the security of transactions. In addition, management processes,such as authorization, supervision, and administration, can be used to compensate forgaps in the access control environment. Keep in mind that it may not be possible tocompletely eliminate the risk in a given area. The use of compensating controls allowsyou to reduce that risk down to a level that is acceptable, or at least more manageable. Finally, compensating controls can be temporary solutions to accommodate ashort-term change, or support the evolution of a new application, business develop-ment, or major project. Changes and temporary additions to access controls maybe necessary for application testing, data center consolidation efforts, or even tosupport a brief business relationship with another company. The critical points to consider when addressing compensating controls are ◾ Do not compromise stated policy requirements. ◾ Ensure that the compensating controls do not adversely affect risk or increase exposure to threats.© 2010 by Taylor and Francis Group, LLC
  • 60. Access Control ◾ 33 ◾ Manage all compensating controls in accordance with established practices and policies. ◾ Compensating controls designated as temporary should be removed after they have served their purpose and another, more permanent control should be established.Detective Controls: Detective controls are those that provide notification to appro-priate personnel if the deterrent, preventative, and compensating controls are notable to thwart an attack. Detective controls warn when something has happened,and are the earliest point in the post-incident timeline. Access controls are a deterrent to threats and can be aggressively utilized to preventharmful incidents through the application of least privilege. However, the detectivenature of access controls can provide significant visibility into the access environmentand help organizations manage their access strategy and related security risk. As mentioned previously, strongly managed access privileges provided to anauthenticated user offer the ability to reduce the risk exposure of the enterprise’sassets by limiting the capabilities that authenticated user has. However, there arefew options to control what a user can perform once privileges are provided. Forexample, if a user is provided write access to a file and that file is damaged, altered,or otherwise negatively impacted (either deliberately or unintentionally), the use ofapplied access controls will offer visibility into the transaction. The control environ-ment can be established to log activity regarding the identification, authentication,authorization, and use of privileges on a system. This can be used to detect theoccurrence of errors, the attempts to perform an unauthorized action, or to validatewhen provided credentials were exercised. The logging system as a detective deviceprovides evidence of actions (both successful and unsuccessful) and tasks that wereexecuted by authorized users. Detection aspects of access control can range from evidentiary, such as post-incident investigations, to real-time alerting of inappropriate activities. This philos-ophy can be applied to many different characteristics of the security environment.Access detection can be triggered by intrusion detection systems (IDSs), viruscontrols, applications, Web filtering, network operations, administration, logs andaudit trails, and security management systems. Visibility into the environment is akey factor in ensuring a comprehensive security posture and the ability to promptlydetect problems in the environment.Corrective Controls: When a security incident occurs, elements within the secu-rity infrastructure may require corrective actions. Corrective controls are actionsthat seek to alter the security posture of an environment to correct any deficienciesand return the environment to a secure state. A security incident signals the failureof one or more directive, deterrent, preventative, or compensating controls. Thedetective controls may have triggered an alarm or notification, but now the correc-tive controls must work to stop the incident in its tracks. Corrective controls can take many forms, all depending on the particular situ-ation at hand or the particular security failure that needs to be dealt with. The© 2010 by Taylor and Francis Group, LLC
  • 61. 34 ◾ Official (ISC)2 Guide to the CISSP CBKsheer number of corrective actions possible makes them difficult to successfullyquantify. They can range from “quick fi x” changes like new firewall rules, routeraccess control list updates, and access policy changes to more long-term infrastruc-ture changes like the introduction of certificates for wireless 802.1x authentication,movement from single-factor to multifactor authentication for remote access, or theintroduction of smart cards for authentication. The difficulty in quantification isfounded on the fact that access controls are universal throughout the environment.Nevertheless, it is important that a consistent and comprehensive managementcapability exists that can coordinate and employ corrective changes throughout theenterprise to enable policy compliance.Recovery Controls: Any changes to the access control environment, whether inthe face of a security incident or to offer temporary compensating controls, need tobe accurately reinstated and returned to normal operations. There are several situations that may affect access controls, their applicability,status, or management. Events can include system outages, attacks, project changes,technical demands, administrative gaps, and full-blown disaster situations. Forexample, if an application is not correctly installed or deployed, it may adverselyaffect controls placed on system files or even have default administrative accountsunknowingly implemented upon install. Additionally, an employee may be trans-ferred, quit, or be on temporary leave that may affect policy requirements regardingseparation of duties. An attack on systems may have resulted in the implantation ofa Trojan horse program, potentially exposing private user information, such as creditcard information and financial data. In all of these cases, an undesirable situationmust be rectified as quickly as possible and controls returned to normal operations.Access Control TypesThe access control categories discussed in the previous section serve to classify differ-ent access control methods based on where they fit into the access control time con-tinuum shown in Figure 1.6. However, another way to classify and categorize accesscontrols is by their method of implementation. For any of the access control catego-ries, the controls in those categories can be implemented in one of three ways: ◾ Administrative Controls: Sometimes called Management Controls, these are procedures implemented to define the roles, responsibilities, policies, and administrative functions needed to manage the control environment. ◾ Technical (Logical) Controls: These are electronic hardware and software solutions implemented to control access to information and information networks. ◾ Physical Controls: These are controls to protect the organization’s people and physical environment, such as locks, fire management, gates, and guards.The categories discussed earlier can be mapped against these three access controltypes to demonstrate various control examples and options as shown in Figure 1.7.© 2010 by Taylor and Francis Group, LLC
  • 62. Directive Deterrent Preventative Detective Corrective Recovery Compensating Administrative Policy Policy User Review Termination DR Plan Supervision registration violation procedure reports Job rotation Logging Technical Config Warning Password Logs Unplug, Backups CCTV Standards Banner based login isolate, terminate connection IPS IDS Keystroke monitoring Physical Authorized Beware of Fence Sentry Fire Rebuild Layerd defense Personel Dog sign extinguisher Access Control Only Signs, Traffic Lights CCTV ◾Figure 1.7 Control examples for types and categories. 35© 2010 by Taylor and Francis Group, LLC
  • 63. 36 ◾ Official (ISC)2 Guide to the CISSP CBKThe figure shows how elements of an access control solution or device can be repre-sented in the form of categories to ensure that all aspects that define the capabilitiesof access control are met. The value of this matrix is that it can be applied to theentire organization, a specific domain within the environment, or a single accesspath, such as employee remote access.Administrative Controls: Administrative controls represent all the actions, poli-cies, processes, and management of the control system. These include any aspect ofthe access control environment that is necessary to oversee and manage the confi-dentiality, availability, and integrity of the access controls, and manage the peoplewho use it, set policy on use, and define standards for operations. Administrative controls can be broad and can vary depending on organiza-tional needs, industry, and legal implications. Nevertheless, they can be brokeninto six major groups: ◾ Operational policies and procedures ◾ Personnel security, evaluation, and clearances ◾ Security policies ◾ Monitoring ◾ User management ◾ Privilege managementOperational Policies and Procedures: The first aspect of administrative oversight isthe operations management of the control environment and how it should alignwith the enterprise architecture. Access control is realized by aligning the capa-bilities of many systems and processes, collaborating to ensure that threats arereduced and incidents prevented. Therefore, other operational elements of theenvironment must be addressed in some fashion within the access control strat-egy. These include ◾ Change control ◾ Business continuity and disaster recovery ◾ Performance ◾ Configuration management ◾ Vulnerability management and patch management ◾ Product life-cycle management ◾ Network managementWhen changes to the environment are required to accommodate a need, they mustbe defined, approved, tested, applied, verified, deployed, audited, and documented.Changes can be minor, such as a static route being added to a network, or more sig-nificant, such as the redesign of a storage solution. Every organization must have achange control process to ensure that there is a formalized methodology for makingand documenting changes to the environment. Given the scope of access control, it© 2010 by Taylor and Francis Group, LLC
  • 64. Access Control ◾ 37is important that the change control process includes aspects of the access strategyand policy. In some cases, this is obvious, such as adding a new virtual private net-work (VPN) gateway for remote access. Clearly this will affect the access controlenvironment. Some changes, such as network redesign, which can affect variousestablished access paths to information, are much less obvious, but can have signifi-cant impacts to access controls. Many organizations have business continuity and disaster recovery (BCP/DRP)plans to ensure that the organization can maintain critical operations in case of acatastrophic event or failure. BCP/DRP plans can be simplistic, such as ensuringthere are regular backups performed, or highly complex solutions incorporatingmultiple data centers. The scope and complexity of the BCP/DRP plan are typicallydefined by the business environment, risks, and system criticality. Regardless of the type of BCP/DRP plan, the availability of access controlsduring an event is essential and must be incorporated into the plan. For example,if a system failure occurs and an alternate system is temporarily employed withoutthe expected, original controls, the exposure to critical data can be significant. Alltoo often, security is a secondary consideration in disaster recovery operations. Ifan event was to occur, a company could have its most valuable assets completelyexposed. However, critical systems are most important in the context of BCP/DRP.Therefore, a system included in the BCP/DRP plan is important and the informa-tion on that system is valuable. One of the first steps to ensure security incorporated into the BCP/DRP plan isdefining the access controls for the temporary systems, services, and applications tobe used during disaster recovery. This includes the access control system itself. Forexample, a RADIUS server may seem unimportant on the surface, but its absencein a disaster could be detrimental to security. In addition, a disaster scenario, bydefinition, is an unusual event with many extenuating arrangements that will needto be made to enable the organization to continue its work. Subsequently, theremay be different access needs defined than what the organization would normallyhave in place. The notion of “acceptable security” may be very different during adisaster than it would be under ordinary circumstances, so proper planning andconsideration of alternative access control needs and methods must be consideredand incorporated into the BCP/DRP plan. Traditional networks and applications are typically engineered to provide a highlevel of performance to users, systems, and services. The network is the cardiovas-cular system of most companies, and if its performance is low, the productivity ofthe organization will suffer. The same holds true for the access control environment. If it takes a user anexcessive amount of time to log-on, this could have a negative impact to operationsand potentially encourage users to find ways to bypass the access control system. Toreduce the time associated with access controls, the performance optimization pro-cesses for the network and system environments should include the performance ofcontrols overseeing authentication and access.© 2010 by Taylor and Francis Group, LLC
  • 65. 38 ◾ Official (ISC)2 Guide to the CISSP CBK Like change control, configuration management represents the administrativetasks performed on a system or device to ensure optimal operations. Configurationscan be temporary or permanent to address a multitude of the organization’s opera-tions and security needs, and configuration management of devices, systems, ser-vices, and applications can greatly affect the access control environment. Changesto a system’s configuration must take into account what, if any, impacts on useraccess may occur after the configuration is modified. Given the common separa-tion of the security group from the IT group, it is not uncommon for the IT groupto make a seemingly innocuous modification to a system configuration and impactthe access controls associated with that system. Therefore, it is important to ensurethat the resources responsible for configuration management, such as networkadministrators, system owners, and application developers, are aware of the secu-rity control environment and the importance of their domain of influence on thesecurity of the organization. This often ties in closely with any change managementprocesses an organization might have in place, so it is a natural fit for processes tobe enacted that tie in access control considerations as part of any change manage-ment or configuration management program. Vulnerability management will typically include activities such as identifyingsystem vulnerabilities, recommending potential remediation, and implementingsystem patches to accommodate a security issue, update a system service, or addfeatures to a system or application. When patches are installed, there may be keysystem modifications that can negatively affect the security of the system, server,or application. Patches must be applied through the change control system to pro-vide a comprehensive record of system modifications and accurate documentation.Ensuring that the current state of a system is well documented allows organiza-tions to gain more visibility into the status of their environment in the event a newvulnerability is published. This promotes rapid assessments to evaluate potentialrisks in the face of an attack or vulnerability. In addition, data from the changecontrol system utilized during the application of patches offer documentation ofthe current state of a system that can be consulted prior to applying new patches orinstalling new software. A key attribute of vulnerability management is the importance of minimiz-ing the time for deploying patches or other system updates in order to mitigate avulnerability. Vulnerabilities surface in a multitude of ways. For example, a vul-nerability may be published by a vendor who has discovered a security issue andprovides a patch. Usually, at this point, both attackers and organizations are madeaware of the vulnerability. While companies are exercising due diligence in apply-ing fi xes, attackers are developing methods and tools to exploit the vulnerability. Incontrast, an incident may have occurred that exposes the vulnerability in a systemand constitutes an immediate threat. The most dangerous example of this kind ofthreat is zero day attacks, where an attacker identifies and exploits the vulnerabilitybefore that vulnerability is known to the vendor or the general user community.The attackers can exploit the vulnerability on a massive scale, understanding that© 2010 by Taylor and Francis Group, LLC
  • 66. Access Control ◾ 39time is on their side. It is very common for attackers to discover a vulnerability,develop tools and tactics to exploit it, then execute those exploits before anyoneknows of the vulnerability or how to defend against it. Vulnerable organizationsmust find alternative measures to compensate for the threat while vendors rush toproduce a patch, each consuming time as the attacks expand. Given the complexity of each potential scenario, time is always a critical ele-ment in protecting assets. The ability to use time effectively to deploy a patch oremploy compensating controls until a patch is published directly corresponds tothe level of risk and the overall security posture of the organization. Emphasis onefficient testing and deployment of system patches or compensating controls shouldbe the core of any vulnerability management program. However, time must be balanced against effective deployment. Initially, thedocumentation provided by the configuration management and change controlprocesses can be investigated to determine which systems are vulnerable and repre-sent the greatest risk, then prioritized accordingly. As the process continues, otheraffected systems are addressed by a manual or automated (or combination) patchmanagement process that is used to deploy the update throughout the organiza-tion. The vulnerability management program must then verify that the patch was,in fact, implemented as expected. Although this may seem inherent to the objec-tive, it cannot be assumed. In the case of manual deployment, users and systemowners may not respond accordingly or in a timely fashion. Even if timely deploy-ment is executed, the patch may have failed. This is somewhat compensated for inautomated deployment; nevertheless, both scenarios require validation of an effec-tive installation. The installation of a patch or control does, by itself, represent the completemitigation of an identified vulnerability. Many systems are unique to a specificenvironment, representing the potential that a change mitigating one vulnerabilityunintentionally introduces another. Or, in some cases, it is assumed that the imple-mentation of a patch or control eliminated the vulnerability altogether. Therefore,a vulnerability management system must not only address the testing, deployment,and verification that the patch was implemented as expected, but also include test-ing to ensure that the target vulnerability was mitigated and new problems werenot introduced by the process. In the final analysis, vulnerability management isa comprehensive and integral process that every security program must develop,maintain, and test regularly. In every organization there comes a time to upgrade or replace devices andsystems. Reasons for the upgrade vary, but can include product obsolescence, theavailability of newer technology with previously unavailable desirable features, orthe need for advanced operational capabilities. Baselines must be established withinthe access control architecture that define the minimum access control require-ments for all new systems to ensure that appropriate and acceptable controls areestablished. By doing so, the organization has a clear foundation by which to evalu-ate products for implementation without sacrificing security or expected controls.© 2010 by Taylor and Francis Group, LLC
  • 67. 40 ◾ Official (ISC)2 Guide to the CISSP CBKDo not assume that all new products have the security capabilities the organizationneeds. Each organization’s needs vary and each environment may be different fromthat for which the product was designed. It is important to test all new products foraccess control functionality. Finally, many networks are supported by a separate management network thatallows administrators to manage devices without affecting the production environ-ment. This is another form of separation of duties, where the production networkand the management network have separate purposes, separate network connec-tivity, and separate access and control requirements. Given the ability to changeaspects of the network environment, it is necessary to have strong access controlsestablished on the management network to reduce risk to systems and networkdevices. If network management is performed using the same network as generalproduction traffic, strong authentication and authorization are required to ensurethat unauthorized personnel cannot modify network devices. Personnel Security, Evaluation, and Clearances: One of the more overlookedaspects of access control is a review of the requirements of people requesting accessto a resource. Prior to granting access of any kind, the credentials of the personrequesting the access should be checked for validity and his need for access thor-oughly evaluated. This does not mean that every user needs to have a completebackground check prior to checking her e-mail. Clearly, the level of validation ofan individual should be directly proportional to the sensitivity of the assets and thelevel of permissions available to the user. Nevertheless, it is critical that processesexist to evaluate users and ensure that they are worthy of the level of trust that isrequested and, ultimately, granted. First and foremost, security requirements—at some level—should be includedin all defined job roles and responsibilities. Job roles defined by the organizationshould have alignment to defined policies and be documented appropriately. Theyshould include any general responsibilities for adhering to security policies, as wellas any specific responsibilities concerning the protection of particular assets relatedto the given role. Once the security requirements for a role are defined and clearly documented,the process for validation of individuals to obtain credentials for a role can be definedand exercised. The definition of a screening process is typically related to the sen-sitivity of the assets being accessed. However, there may be contractual demands,regulatory compliance issues, and industry standards that define how a person isscreened to reach a certain level of access. The best example of this type of screeningcomes from the military and the allocation of clearances. Depending on the clear-ance level requested, a person may be subjected to intense background checks, friendand family interviews, credit checks, employment history, medical history, polygraphexaminations, and a plethora of other potentially unpleasant probing. Of course, onceattained, the clearance translates to a level of trustworthiness and, therefore, access. A typical organization will need only a standard process and some additional fac-tors in the light of applicable legal requirements or regulations. These may include acredit check and criminal background checks that simply assure management that© 2010 by Taylor and Francis Group, LLC
  • 68. Access Control ◾ 41an applicant has not falsified information during the application process. Typicalaspects of staff verification may include ◾ Satisfactory character references ◾ Confirmation of claimed academic and professional qualifications ◾ Independent identity validation, such as a passport ◾ A credit check for those requiring access to financial systems ◾ Federal, state, and local law enforcement records checkThe relevance of credit checks and other personal history can be valuable in deter-mining a person’s propensity for unlawful acts. Personal or financial problems,changes in behavior or lifestyle, recurring absences, and evidence of stress or depres-sion might lead an employee to fraud, theft, error, or other security implications.The type of background check performed may vary based on the type of employeeand his or her placement in the organization. For example, a file clerk or recep-tionist may need only a basic background check, whereas an applicant for a seniorofficer position may require a more extensive background investigation. In the event the employee is temporary, the access provided must take intoconsideration the potential exposure of proprietary information given the transientposition. Organizations that use staffing agencies to supply temporary help shouldrequire those agencies to perform employee validation checks and provide a reliabil-ity report on the temporary workers supplied to the organization. The requirementsfor background checks should be incorporated into the underlying contract with thestaffing agency and its implementation should be reviewed and audited on a regularbasis. Management should also evaluate the supervision and provisioning of accessto new or inexperienced staff. It should not be necessary to provide a new employeewith the keys to the kingdom until he or she has satisfied a probationary period. Employees should also be periodically reevaluated to ensure that significantchanges to key elements about them or their lives have not occurred that wouldalter their security worthiness. Also, it is important to remember that all infor-mation collected about an individual is private and confidential and should beafforded security controls like any other sensitive material. Finally, confidentialityor nondisclosure agreements should be read and signed annually by all employeesto ensure there is no doubt on the part of employees that the information they willhave access to is confidential, secret, protected, and valuable to the organization. Security Policies: The organization’s requirements for access control should bedefined and documented in its security policies. Access rules and rights for eachuser or group of users should be clearly stated in an access policy statement. Theaccess control policy should consider ◾ Statements of general security principles and their applicability to the organization ◾ Security requirements of individual enterprise applications, systems, and services© 2010 by Taylor and Francis Group, LLC
  • 69. 42 ◾ Official (ISC)2 Guide to the CISSP CBK ◾ Consistency between the access control and information classification poli- cies of different systems and networks ◾ Contractual obligations or regulatory compliance regarding protection of assets ◾ Standards defining user access profiles for organizational roles ◾ Details regarding the management of the access control systemMonitoring: The ability to monitor the access control environment effectively isessential to the overall success and management of the security program. It is onething to apply controls, but it is another to validate their effectiveness and ongoingstatus. The capacity for ensuring that controls are properly employed and work-ing effectively and for being aware of unauthorized activity is enabled by the exis-tence of monitoring and logging within the environment. This is not unique toaccess controls, security, or even IT: it is an essential aspect of business to monitoractivity. Systems should be monitored to detect any deviation from established accesscontrol policies and record all successful and unsuccessful authentication pro-cesses, credential assertion, user management, rights usage, and access attempts.The procedures and technology should also monitor the ongoing status of controlsto ensure conformity to policies and expectations. This last point is typically over-looked and represents a significant potential to mask or hide unauthorized activi-ties. For example, if the control activities are monitored, yet the status of controlsis not, attackers can disable various controls, grant themselves access, and then re-enable the controls without detection. The logging and monitoring of the activitieswill then not raise any suspicion because they are now valid operations, thanks tothe attacker. Systems and activity logs are (typically) electronic records of any activitythat has occurred within a system or application. They provide the documentedrecord of what has happened and can be extremely useful when investigating anoperational or security incident. Logs and their contents are important to securitymanagement and maintenance of an effective access control solution. A log caninclude ◾ User IDs used on systems, services, or applications. ◾ Dates and times for log-on and log-off. ◾ System identities, such as IP address, host name, or media access control (MAC) address. It may also be possible to determine the network location of a device through local area network (LAN) logging, wireless access point identification, or remote-access system identification, if applicable. ◾ Logging of both successful and rejected authentication and access attempts. Knowing when and where people are utilizing their rights can be very helpful to determine if those rights are necessary for a job role or function. It is also© 2010 by Taylor and Francis Group, LLC
  • 70. Access Control ◾ 43 helpful to know where access rights are denied to have a better understanding of what a user is trying to do. This can help determine if you have a user who does not have adequate rights to perform his or her job.Audit logs should be retained for a specified period, as defined by organizationalneed and (potentially) regulatory requirements. In the latter case, this is preor-dained and not open to interpretation. However, there are cases where no legal orregulatory demands exist. If this is the case, the retention time will probably bedefined by organizational policy and the size of available storage. The security ofthe logs is critical. If a log can be altered to erase unauthorized activity, there is littlechance for discovery, and if discovered, there may be no evidence. Logs must alsobe protected from unauthorized reading as well as writing, as they can contain sen-sitive information such as passwords (for instance, when users accidentally type thepassword into a user ID prompt). Log security is also critical if the logs are neededas evidence in a legal or disciplinary proceeding. If logs are not secure and can beproven as such before, during, and after an event, the logs may not be accepted asvalid legal evidence due to the potential for tampering. The fundamental approachto logs is that they must be an accurate reflection of system activity and, as such,must be secured and maintained for an appropriate period of time in order to pro-vide a reference point for future investigative activity. Once the events are properly logged, it is necessary to periodically review thelogs to evaluate the impact of a given event. Typically, system logs are voluminous,making it difficult to isolate and identify a given event for identification and inves-tigation. To preserve potential evidence, many organizations will make a copy ofthe log (preserving the original) and use suitable utilities and tools to perform auto-mated interrogation and analysis of the log data. There are several tools availablethat can be very helpful in analyzing a log file to assist administrators in identifyingand isolating activity. Once again, separation of duties plays an important role inreviewing logs. Logs should never be initially reviewed or analyzed by the “subject”of the logs. For example, a system administrator should not perform the log reviewfor a system he manages. Otherwise, it may be possible for the person to “overlook”evidence of her unauthorized activity or intentionally manipulate the logs to elimi-nate that evidence. Therefore, it is necessary to separate those being monitored fromthose performing the review. User Access Management: An organization must have a formal procedure tocontrol the allocation of credentials and access rights to information systems andservices. The procedure should cover all stages in the life cycle of user access, fromthe initial registration of new users to the final decommissioning of accounts thatare no longer required. To provide access to resources, the organization must first establish a processfor creating, changing, and removing users from systems and applications. Theseactivities should be controlled through a formal process, based on policy, which© 2010 by Taylor and Francis Group, LLC
  • 71. 44 ◾ Official (ISC)2 Guide to the CISSP CBKdefines the administrative requirements for managing user accounts. The processshould define expectations, tasks, and standards concerning the user management.For example, elements of the process should include ◾ Approval of user access, including information from human resources, the user’s manager, or a business unit that has approved the creation of the user account. The owner of the system who is providing information or services should concur with the approval request. Approval processes should also address the modification of user accounts and their removal. ◾ Standards defining unique user IDs, their format, and any application-specific information. Additionally, information about the user should be included in the credential management system to ensure the person is clearly bound to the user ID defined within the system. ◾ A process for checking that the level of access provided is appropriate to the role and job purpose within the organization and does not compromise defined segregation of duties requirements. This is especially important when a user’s role and job function change. A process must exist to evaluate existing privileges compared to the new role of the user and ensure changes are made accordingly. ◾ Defining and requiring users to sign a written statement indicating that they understand the conditions associated with being granted access and any asso- ciated liabilities or responsibilities. It is important to understand that user confirmation should occur whenever there is a change in rights and privi- leges, not simply upon creation of the account. ◾ A documentation process to capture system changes and act as a record of the transaction. Keeping a log of the administrative process and relative technical information is essential to an effective access control system. The informa- tion will be used in assessments, audits, change requests, and as evidence for investigative purposes. ◾ Access modification and revocation procedures to ensure that users who have left the organization or changed job roles have their previously held access privileges immediately removed to ensure elimination of duplications and removal of dormant accounts. ◾ Specific actions that may be taken by management if unauthorized access is attempted by a user or other forms of access abuse are identified. This must be approved by the organization’s human resources and legal departments.A more in-depth look at user management will be found later in this chapter whenidentity management is discussed. In addition to overall user management, it is necessary to define policies, proce-dures, and controls regarding passwords. The use of passwords is a common prac-tice for validating a user’s identity during the authentication process. Given that,in most traditional authentication solutions, the password is the only secret in the© 2010 by Taylor and Francis Group, LLC
  • 72. Access Control ◾ 45transaction, great care should be considered in how passwords are created and man-aged by users and systems. A process governing user password should consider the following: ◾ Users should be required to sign a statement agreeing to keep their pass- words safe and confidential and to not share, distribute, or write down their passwords. ◾ All temporary passwords should be permitted to be used only once—to reset the user’s password to something that only he or she knows. ◾ Passwords should never be stored unprotected and in clear text. ◾ Passwords should have a minimum and maximum length and require the use of various characters and formats to increase their complexity and reduce their susceptibility to brute force and guessing attacks. ◾ Passwords should be changed regularly. ◾ Accounts should be locked if excessive failed password attempts occur (typi- cally within three to five tries). ◾ A history of passwords should be maintained to prevent users from repeating old passwords as they are changed. ◾ Passwords should not be disclosed to support personnel, and those personnel should not ask users for their passwords.There is some debate over the security realized by a username and password com-bination used for authentication. For example, depending on the system, a longer,more complex password can actually make it more prone to compromise if it resultsin the user writing it down. The potential for exposure of passwords, poor passwordselection by users, and the sheer number of passwords most users need to track laythe foundation for potential compromises. However, alternatives to passwords (such as will be examined later in thischapter) can be expensive, cumbersome, and annoying to end users, potentiallynegating any security or business benefit they may provide. Before moving awayfrom the use of passwords toward an alternative technology or method, the secu-rity professional must always consider the value of the information or system thatthe passwords are protecting. Current password technology and processes (includ-ing the use of minimum complexity standards, lockouts, and reuse restrictions)will provide the organization with a certain level of security protection. If, in theopinion of the organization, that level of protection is sufficient to protect theresources behind the password, then password technology is sufficient. If, however,the organization feels that password protection does not adequately protect theresources behind the password, then it must seek out alternative authenticationmethodologies. Nevertheless, and despite all the negative connotations passwords have in thesecurity space, passwords are today’s standard. The best approach to ensure consis-tency and control is© 2010 by Taylor and Francis Group, LLC
  • 73. 46 ◾ Official (ISC)2 Guide to the CISSP CBK ◾ Clearly defined password policies ◾ Well-implemented system controls ◾ Understanding of the technical considerations ◾ Comprehensive user training ◾ Continuous auditing Privilege Management: The importance of access privileges demands that theirallocation, administration, and use should have specific processes and consider-ations. The lack of effective privilege management can result in core failures inotherwise sophisticated access control systems. Many organizations will focusexclusively on identification, authentication, and modes of access. Although allthese are critical and important to deterring threats and preventing incidents, theprovisioning of rights within the system is the next layer of control. The typicalcause of problems in the allocation of rights is due primarily to the vast number ofaccess options available to administrators and managers. The complexity of poten-tial access configurations leads to inadequate and inconsistent security. This aspectof privilege management demands clear processes and documentation that definesand guides the allocation of system rights. In the development of procedures for privilege management, careful consider-ation should be given to the identification and documentation of privileges asso-ciated with each system, service, or application, and the defined roles within theorganization to which they apply. This involves identifying and understanding theavailable access rights that can be allocated within a system, aligning those to func-tions within the system, and defining user roles that require the use of those func-tions. Finally, user roles need to be associated with job requirements. A user mayhave several job requirements, forcing the assignment of several roles and result ina collection of rights within the system. Be careful, however, of the consequencesof aggregate access rights. Many systems have rules of precedence that dictate howaccess rules are applied. Should a rule that restricts access conflict with, and beoverridden by, a rule that allows access, the unintended consequence is that the userwill be granted more access permission than was intended. Remember the primarymantra of least privilege: only rights required to perform a job should be providedto a user, group, or role. An authorization process and a record of all privileges allocated should be main-tained. Privileges should not be granted until the authorization process is completeand validated. If any significant or special privileges are needed for intermittentjob functions, these should be performed using an account specifically allocatedfor such a task, as opposed to those used for normal system and user activity. Thisenables the access privileges assigned to the special account to be tailored to theneeds of the special function rather than simply extending the access privilegesassociated with the user’s normal work functions. For example, an administratorof a UNIX system might have three accounts: one for daily routines, another for© 2010 by Taylor and Francis Group, LLC
  • 74. Access Control ◾ 47specific job requirements, and “root” (the all-omniscient access ID on UNIX sys-tems) for rare occurrences where complete system access must be utilized.Technical (Logical) Controls: Technical controls are those mechanisms employedwithin the digital and electronic infrastructure of an organization that enforcethat organization’s security policy. Given the pervasive nature of technology, tech-nical access controls may take on a wide variety of forms and implementations.Technology controls can include elements such as firewalls, filters, operating sys-tems, applications, and even routing protocols. Technology controls can be broadlycategorized in the following groups: ◾ Network access ◾ Remote access ◾ System access ◾ Application access ◾ Malware control ◾ Encryption Network Access: Network access controls are those employed within the commu-nication infrastructure to restrict who may connect to, and use, that infrastructure.Usually, this is implemented through access control lists, remote-access solutions,virtual local area networks (VLANs), access control protocols, and security deviceslike firewalls and intrusion detection or intrusion prevention systems. The role ofnetwork access controls is usually to limit communications between two networksor resources. For example, a firewall will limit what protocols and protocol featuresare permitted from a given source to a defined destination. However, there are other network-level controls that can be used to employsecurity services that increase the level of access management in the environment.The most common example is a proxy system: a device or service that is located inthe middle of the communication between a user and an application and employscontrols that monitor and regulate the traffic between the user and the application.Proxy systems can apply specific logic in managing service-level communicationswithin the network. For example, a proxy system may control access to Web-basedservices via the hypertext transfer protocol (HTTP). Just as a firewall would blockspecific ports, a proxy system would block or control certain aspects of the HTTPsession to limit exposure. Many proxy systems are used to authenticate sessions forinternal users attempting to access the Internet and potentially filter out unwantedWeb site activity, such as Java applets, active server page (ASP) code, plug-ins, oraccess to inappropriate Web sites. VLANs can be utilized to segment traffic and limit the interaction from onenetwork to another. VLANs are used in situations where many systems are onthe same physical network but they need to be logically separated to enforce theaccess control requirements of the organization. Conversely, VLANs can be used© 2010 by Taylor and Francis Group, LLC
  • 75. 48 ◾ Official (ISC)2 Guide to the CISSP CBKto virtually connect systems in multiple physical locations to appear as if they areall on the same logical network segment. Wireless networks can also employ several access control mechanisms, such asMAC filtering, multiple forms of authentication, encryption, and limitations onnetwork access. One of the more recent interesting aspects of network access control is the abil-ity to restrict access to systems based on network-wide policy. The current industryterm for this is network access control (NAC). Prior to allowing a system to join thenetwork, the NAC service queries the system to ensure it is adhering to establishedpolicies. Policies can be as simple as ensuring an antivirus package is present on thesystem and as complex as validating the system is up to date with security patches.In the event the system does not meet security policy, it may be denied access orredirected to a secure area of the network for further testing or to allow the user toimplement the necessary changes required prior to gaining full access the network. Remote Access: In today’s environment, users working from outside the tradi-tional office space make up a significant portion of the user community. Remote-access solutions offer services to remote users requiring access to systems and data.One of the more commonly utilized technical solutions is the virtual private network(VPN). VPNs allow users to authenticate themselves and establish a secure com-munications channel over an insecure medium like the Internet. Typically, a VPNdevice is placed on the organization’s Internet connection or behind a firewall toallow remote users to access the network, authenticate, and establish a protectedsession with various internal systems. VPN access controls typically use authentication mechanisms in combina-tion with encryption methods. For example, a VPN solution can be configuredto permit access by users with the appropriate specific (company branded) clientsoftware or version of a browser, limit access to certain portions of the network,limit the types of services permissible, and control session time windows. In addi-tion, because the connection is occurring over an insecure and publicly accessiblenetwork like the Internet, most VPN solutions employ multifactor authenticationto positively identify the user. Multifactor authentication will be covered in moredetail later in the chapter. System Access: The term “system” comprises a wide variety of technologies andcomponents, but the definition most often used is one or more computers that pro-vide a service or assist in a process. When most people think of a system they thinkof their personal computer, and that provides a good model for discussing systemaccess controls. The most prevalent system access control is the user ID and password combina-tion. Almost all modern systems have this unless it has been specifically disabledfor a particular reason. The user ID/password combination may be replaced in somesystems by other forms of authentication, such as a smartcard or a one-time pass-word token. Nevertheless, all these methods serve the same purpose: to restrictsystem access to authorized users.© 2010 by Taylor and Francis Group, LLC
  • 76. Access Control ◾ 49 All computer systems have an underlying operating system that controls all itsfunctions and regulates how the various components of the system interact. Thereare literally hundreds of different operating systems, but most users (includingsecurity professionals) work primarily in one of the three major publicly availableoperating systems: Microsoft Windows®, Apple’s MacOS, and UNIX (includingthe many variants of Linux and, ironically, later versions of MacOS). Each of theseoperating systems has internal controls and layers built in that manage access con-trol between components of the system. In particular, they all tightly control pro-grams that directly access the hardware components of the system, such as thekernel (the part of the system that interfaces between the OS and the system hard-ware) and various device drivers that allow application programs to use devices likekeyboards and printers. The ability to directly manipulate the system hardware isa powerful tool and must be tightly controlled by the operating system to preventmisuse by malicious programs. Finally, almost all operating systems have some sort of file system to store infor-mation for later retrieval. The file system will also have controls to restrict whomay access various files and directories. Some of these controls are imposed by theoperating system itself, while others may be assigned by individual users to protecttheir personal files. These controls are very important to ensure that information isnot disclosed to unauthorized individuals who may have access to the system. Application Access: Applications will usually employ user and system accesscontrols to deter threats and reduce exposure to security vulnerabilities. However,applications can also incorporate mechanisms to supplement other controls andensure secure operations. For example, applications can monitor user sessions,apply inactivity time-outs, validate data entry, and limit access to specific servicesor modules based on user rights and defined user roles. Moreover, the applicationitself can be designed and developed to reduce exposure to buffer overflows, raceconditions (where two or more processes are waiting for the same resource), andloss of system integrity. The architecture of an application plays a significant role in its ability to thwartattack. Object-oriented programming, multitiered architectures, and even databasesecurity are important to controlling what services are provided to users and whattasks can be performed. Access controls associated with all aspects of an applica-tion are important to sound security. Many applications are complicated and offer awide range of services and access to potentially sensitive information. Additionally,applications may be critical to the operational needs of the business. Therefore,their sensitivity to disruption must be considered when designing or using theaccess control features of the application. Applications can also be segmented into modules or layers to further enforceaccess control policies. For example, a typical e-mail application can be segmentedinto modules for composing a message, managing address book information, con-necting to network resources, and managing mail delivery and retrieval. Doing thisallows the application designer to specify how each module can be accessed, what© 2010 by Taylor and Francis Group, LLC
  • 77. 50 ◾ Official (ISC)2 Guide to the CISSP CBKservices each module will present to the user and to other applications, and whatprivileges each provides to the user. For example, the address book managementmodule may be accessible from an e-mail application but not by any other applica-tion to prevent the possibility of a virus examining and using a user’s address book.It is important to manage the interaction between application modules within anapplication as well as the interaction between these modules and other applica-tions to ensure that malicious users or programs do not try to use them to performunauthorized activities. A more detailed discussion of application security issues isfound in Chapter 2. Malware Control: Malicious code, such as viruses, worms, Trojans, spyware, andeven spam, represent potential security threats to the enterprise. Weaknesses in sys-tems, applications, and services offer opportunities for worms and viruses to infil-trate an organization, causing outages or damage to critical systems and information.Technical controls can be applied to reduce the likelihood of impact from such mali-cious programs. The most prevalent of these controls are antivirus systems that canbe employed on the network perimeter, servers, and end-user systems to detect andpotentially eliminate viruses, worms, or other malicious programs. Other technicalsolutions include file integrity checks and intrusion prevention systems that can detectwhen a system service or file is modified, representing a risk to the environment. Cryptography: Although covered in greater detail in the cryptography domain inthe CBK, encryption has an important role in the access control domain. Encryptioncan be used to ensure the confidentiality of information or authenticate informa-tion to ensure integrity. These two characteristics are highly leveraged in the identi-fication and authentication processes associated with access control. Authenticationprotocols will employ encryption to protect the session from exposure to intruders,passwords are typically hashed (put through a one-way mathematical function thatcannot be reversed) to protect them from disclosure, and session information maybe encrypted to support the continued association of the user to the system and ser-vices used. Encryption can also be used to validate a session. For example, a servercan be configured such that if session information is not encrypted, the resultingcommunication is denied. The most predominant aspect of cryptography in accesscontrol is the employment of cryptographic mechanisms to ensure the integrity ofauthentication protocols and processes. Encryption can also be used as a compensating control to improve securitywhen the available access control functions are not granular enough to provideadequate security. For example, it may be necessary for several employees of a com-pany to share a particularly sensitive financial spreadsheet. Unfortunately, all ofthese people are located in different offices in different parts of the country, and theonly way for them to share this file is to use the company’s general shared drive thatwas set up for all employees to transfer information between offices. While access tothe drive is restricted to only internal company users, there is no way to specify thatonly particular users can access a specific file. In this case, the file can be encryptedand the key to decrypt the file can be disclosed only to the employees who need to© 2010 by Taylor and Francis Group, LLC
  • 78. Access Control ◾ 51see the spreadsheet. This will allow the file to be placed on the general shared drivewhile still restricting access to only those who need to see the file. As will be seen in more detail in Chapter 2, cryptography is commonly usedwithin applications to protect sensitive data. Information such as credit card num-bers may be encoded so that they are not visible (except perhaps the last few digits)to personnel who do not need to see the entire number. Examples of this may beseen in reports or printouts, in the storage of such information in a database, or inthe layout of a screen that is displayed to the user. Consider the use of encryption inthose situations where the available access controls are not sufficient to provide theappropriate granularity of protection for sensitive information.Physical Controls: Physical security covers a broad spectrum of controls to protectthe physical assets (primarily the people) in an organization. These controls rangefrom doors, locks, and windows to environment controls, construction standards,and guards. Typically, physical security is based on the notion of establishing secu-rity zones or concentric areas within a facility that require increased security as youget closer to the valuable assets inside the facility. Security zones are the physicalrepresentation of the defense-in-depth principle discussed earlier in this chapter.Typically, security zones are associated with rooms, offices, floors, or smaller ele-ments, such as a cabinet or storage locker. The design of the physical security con-trols within the facility must take into account the protection of the asset as well asthe individuals working in that area. For example, the fire control and suppressionsystems must account for the health safety of personnel in potential fire zones. Onemust consider fires, floods, explosions, civil unrest, or other man-made or naturaldisasters when planning the physical layout of a facility. Emergency strategies mustbe included in the physical controls to accommodate the safe exiting of personneland adherence to safety standards or regulations. Adequate exits and emergencyevacuation routes must be available in all areas and sensitive areas or informationmust be able to be secured quickly in case those areas must be evacuated. Humansafety is the priority in all decisions of physical security. The physical access controls in each zone should commensurate with the levelof security required for that zone. For example, an employee may work in the datacenter of a large financial institution—a very sensitive area. The employee may havea special badge to access the parking lot and the main entrance where guards areposted and recording access. To access the specific office area, he or she may need adifferent badge and PIN to disengage the door lock. Finally, to enter the data cen-ter, the card and PIN are combined with a biometric device that must be employedto gain access. As one gets closer and closer to the valuable asset—the data center—the protections get progressively stronger. The most prevalent and visible aspect of physical security is often the perimeterof a facility. A typical perimeter should be without gaps or areas that can be eas-ily broken into or entered undetected. The perimeter starts with the surroundinggrounds. Hills, ditches, retention walls, fences, concrete posts, and high curbs can© 2010 by Taylor and Francis Group, LLC
  • 79. 52 ◾ Official (ISC)2 Guide to the CISSP CBKall act as deterrents to attack. Depending on the sensitivity of the facility, guards,attack dogs, and other aggressive measures can be applied. The construction ofthe facility may include special walls, reinforced barriers, and even certain foliagestrategically placed near doors, windows, and utilities. All this can be augmentedby cameras, alarms, locks, and other essential controls. However, security is not the only consideration when designing a facility. Theoverall design of the facility must balance function of the building with the securityneeds of the organization. For example, a company’s headquarters building willneed good security to protect private areas, stored records, and personnel againstmalicious acts. But it must also serve as the company’s face to the public and pres-ent a welcoming atmosphere to visitors. Protections at such a facility might includeguards at the front desk (unarmed), locked doors, and badge readers to restrictentry. However, the company’s data center facility would most likely have muchmore stringent measures to keep intruders out, such as a tall razor-wire fence, armedguards, biometric entry controls, and mantrap doors. As with all architecture, formfollows function. If an organization leases space in a facility (as opposed to owning the facility)there may be limits on what modifications can be made to accommodate the com-pany’s security needs. Any special security requirements must be negotiated with thefacility’s owner before the lease agreement is signed. If the organization is sharing thefacility with other tenants, additional thought must be given to security and accesscontrol measures, since much of the facility (those portions not occupied by theorganization) will be accessible to non-organization personnel. Areas of special con-cern to the information security professional will include heating ventilation and airconditioning (HVAC) equipment, electrical power panels and wiring closets—all ofwhich may be readily accessible to contractors and other tenants of the facility. Finally, the oversight of physical controls must adhere to the same basic princi-ples of other forms of controls: separation of duties and least privilege. For example,it may be necessary to segment the job role of various guards to ensure that no singlepoint of failure or collusion potentially allows threat agents to enter unchecked. Physical Entry: Secure areas should be protected by appropriate entry controlsto ensure that only authorized personnel are allowed access. The provisioning ofcredentials must take into consideration the needs of the individual, his or herjob function, and the zone accessed. As discussed previously, the person requiringaccess must successfully pass an investigative process prior to being provided access.In defining physical entry controls, the following should be considered: ◾ Visitors should be appropriately cleared prior to entry and supervised while on the premises. Moreover, the date, time, and escort should be recorded and validated with a signature. Visitors should only be provided access to the areas that do not contain sensitive information or technologies and should be provided with instructions concerning security actions and emergency procedures.© 2010 by Taylor and Francis Group, LLC
  • 80. Access Control ◾ 53 ◾ Access to controlled areas, such as information processing centers and where sensitive data may reside, should be restricted to authorized persons only. Authentication controls, such as badges, swipe cards, smart cards, proxim- ity cards, PINs, and (potentially) biometric devices, should be employed to restrict access. ◾ Everyone within the controlled perimeter must wear some form of identi- fication and should be encouraged to challenge others not wearing visible identification. Be aware, however, that most cultures encourage politeness and deference in social interactions, particularly where strangers are involved. Challenging an unknown person does not come easily to many people and this may be a large culture change for most organizations. Awareness and education programs on this topic are advised. ◾ Different styles of identification should be employed to allow others to quickly ascertain the role of an individual. For example, employees may be given white badges and visitors given blue badges. This makes it easier to identify who is an employee and who is not to ensure that all nonemploy- ees are escorted in the building. In another example, a red ID badge may signify access to the fourth floor of an office building. If someone appeared on the fourth floor wearing a blue badge, others would be able to determine appropriate actions. Action may include verifying they are escorted, notifying security, or escorting them to the nearest exit. ◾ All access rights and privileges should be regularly reviewed and audited. This should include random checks on seemingly authorized users, control devices, approval processes, and training of employees responsible for physi- cal security.There may be occasional need for temporary facility access to sensitive areas for visi-tors, contractors, or maintenance personnel. Preparations and procedures shouldbe defined in advance for these situations, special identification should be requiredfor all temporary personnel, and they should be escorted by facility personnel at alltimes. This will make it easier for regular facility personnel to identify the tempo-rary visitors in unauthorized areas and ensure that they are not able to cause anydamage to the facility or obtain any confidential information.System Access Control StrategiesTo this point the chapter has focused on access control principles and the threats tothe control environment. The section that follows covers details regarding specificaccess controls and essential control strategies. Areas include ◾ Identification, authentication, and authorization ◾ Access control services© 2010 by Taylor and Francis Group, LLC
  • 81. 54 ◾ Official (ISC)2 Guide to the CISSP CBK ◾ Identity management ◾ Access control technologiesIdentification, Authentication, and Authorization: Identification is the assertionof a unique identity for a person or system and is the starting point of all accesscontrol. Without proper identification it is impossible to determine to whom orwhat to apply the appropriate controls. Identification is a critical first step in apply-ing access controls because all activities and controls are tied to the identity of aparticular user or entity. The downstream effects of proper identification include accountability (witha protected audit trail) and the ability to trace activities to individuals. They alsoinclude the provisioning of rights and privileges, system profiles, and availabilityof system information, applications, and services. The objective of identification isto bind a user to the appropriate controls based on that unique user instance. Forexample, once the unique user is identified and validated through authentication,his or her identity within the infrastructure will be used to allocate resources basedon predefined privileges. Authentication is the process of verifying the identity of the user. Upon request-ing access and presenting unique user identification, the user will provide some setof private data that only the user should have access to or knowledge of. The com-bination of the identity and information only known by, or only in the possessionof, the user acts to verify that the user identity is being used by the expected andassigned entity (e.g., a person). This, then, establishes trust between the user and thesystem for the allocation of privileges. Authorization is the final step in the process. Once a user has been identified andproperly authenticated, the resources that user is allowed to access must be definedand monitored. Authorization is the process of defining the specific resources a userneeds and determining the type of access to those resources the user may have. Forexample, Deanna, Jennifer, and Matthew may all be identified and authenticatedinto the same system, but Deanna is only authorized to access the payroll informa-tion, Jennifer is only authorized to access product source code, and Matthew is onlyauthorized to view the company’s internal Web sites. The relationship between these three important concepts is simple: ◾ Identification provides uniqueness ◾ Authentication provides validity ◾ Authorization provides controlIdentification Methods: The most common form of identification is a simple username, user ID, account number, or personal identification number (PIN). Theseare used as a point of assignment and association to a user entity within a system.However, identification may not be limited to human users and may include soft-ware and hardware services that may need to access objects, modules, databases,© 2010 by Taylor and Francis Group, LLC
  • 82. Access Control ◾ 55or other applications to provide a full suite of services. In an effort to ensure thatthe application is authorized to make the requests to potentially sensitive resources,the system can use digital identification, such as a certificate or one-time sessionidentifier to identify the application. There are several common forms of identifica-tion used by organizations, and the type used may vary depending on the processor the situation. Identification Badges: An identification badge is the most common form ofphysical identification and authorization in organizations. The badge representsthat the badge holder is officially recognized and has some status within the orga-nization. Most badges contain the name or logo of the organization, the name ofthe badge holder, and a picture of the holder printed on the face. In some cases,because of the cost of badge printing, organizations will print personalized badgesonly for employees. Visitors or temporary personnel will be given a generic badge,perhaps in a different color, to signify that they are permitted on the premises butdo not belong to the organization. The typical process behind an ID badge requires that the user wear the badgeat all times while on company premises. Employees and security personnel will beable to observe the badge, check the picture on the badge against the badge wearer,and then make a determination as to whether the person legitimately belongs onthe premises or not. If the name, picture, and badge holder do not all match, theemployee should summon security or escort the badge holder off the premises.Unfortunately, this process fails all too often. Most people, even security guards,fail to make a very close comparison of the badge against the holder. During themorning rush into a facility most employees simply wave the badge in the air toindicate they have one and are allowed to pass. While this is not a universal problem—government and military facilities generally pay close attention to badge holdersand their credentials—it is common enough to conclude that identification badgesare not a foolproof security mechanism. Another type of badge, the access badge, provides a much stronger securitymechanism. Access badges are used to enter secured areas of a facility and are usedin conjunction with a badge reader to read information stored on the badge. Acentral monitoring facility will read the badge information, match that informationagainst a list of authorized personnel for that area, and make a determination foror against access. A failing of access badges is that, because they are not physicallytied with a specific person, employees often share their badges with others whomay need temporary access to a secured area. While certainly not endorsed by theorganization, and most often directly counter to security policy, this practice iswidespread. To counter this problem, many organizations combine the identifica-tion badge with the access badge to provide a stronger tie between the badge holderand the individual ID card. User ID: The common user ID—the standard entry point to most informationsystems—provides the system with a way of uniquely identifying a particular useramongst all the users of that system. No two users on a single system can have© 2010 by Taylor and Francis Group, LLC
  • 83. 56 ◾ Official (ISC)2 Guide to the CISSP CBKthe same user ID, as that would cause confusion for the access control system andremove the ability to track any activity to an individual. It is important to note thatthe user ID should only be used as a system identifier, not an authenticator. The userID simply tells the system that this user wants to be identified by that ID, not thatthis user has the legitimate right to access the system under that ID or be givenaccess to any system resources. It is only when the user ID is combined with someother authentication mechanism, such as a password, security token, or a digitalcertificate, that a judgment can be made as to the legitimacy of the user and accesscan be permitted or denied. Account Number/PIN: Much like a user ID, an account number provides aunique identity for a particular user within a system or an enterprise. Most ordi-nary users will encounter account numbers as part of a financial services applica-tion or transaction. In such transactions, the personal identification number (PIN),provides the authentication information needed to determine whether the user hasthe legitimate right to use that account number and access the information underthat account. MAC Address: All computers that participate in a network must have somemethod of uniquely identifying themselves to that network so that information canbe sent to and from the network connection associated with the proper computer.The most common form of machine address in use today is the media access control(MAC) address. The MAC address is a 48-bit number (typically represented inhexadecimal format) that is supposed to be globally unique, meaning that everynetwork device in the world is supposed to have a unique MAC address. In theearly days of network computing, the MAC address was embedded into the hard-ware of the device during its manufacture and was not changeable by end users (orattackers). When that was the case, the MAC address was a good way to identify(and authenticate) particular devices with a high degree of certainty. Unfortunately,most modern network-enabled devices allow the MAC address to be set in soft-ware, meaning that anyone with administrative access to the device can alter theMAC address of that device to anything of his choosing. Thus, the MAC address isno longer considered a strong identifier or authenticator. IP Address: Computers using the TCP/IP network protocol are also assignedan internet protocol (IP) address. Whereas the MAC address provides a way ofidentifying the physical location of a system, the IP address gives the logical loca-tion of a device on the IP network. IP addresses are organized into logical groupscalled subnetworks or subnets. A device’s IP address must be unique among all thesystems on that device’s same subnet, but there are circumstances where deviceson different subnets can have identical IP addresses. As was the case with MACaddresses, a device’s IP address is assigned in software by the administrator of asystem. As such, IP address is not a very strong indicator of a system’s identity. Itis possible to use the IP address as one data point amongst many to narrow downa system’s unique network location or identity, but it should not be used alone forsuch purposes.© 2010 by Taylor and Francis Group, LLC
  • 84. Access Control ◾ 57 Radio Frequency Identification (RFID): In recent years, a great deal of researchhas been done to determine ways to uniquely identify objects and be able to readthat identification without physically interacting with the object itself. This can bevery useful in cases where it is advantageous to identify items quickly or withoutthe need for physical inspection. The most popular technology to come out of thisresearch is the radio frequency identification (RFID), tag. The RFID tag is a smalllabel that can be embedded in almost any object, including product shipping pal-lets, passports, consumer goods, and even human beings. The tag contains identify-ing information for the object, such as a UPC code or a person’s name. When thetag comes in the proximity of an RFID reader, the reader reads the informationfrom the tag and determines the identity of the object. RFID tags are extremelysmall, so they add no discernable size or weight to the object being tagged, andbecause they can be read from a distance of several feet the reader does not needclose physical contact with the tagged object. The use of RFID in some applications has raised some privacy concerns for somepeople. For instance, RFID tags are now included in all newly issued passports forseveral countries such as the U.S. and Australia. Unfortunately, because the tagscan be read from a distance, many fear that their private passport information canbe taken from the tag without their consent. In addition, many are advocating theinjection of RFID tags into humans to allow authorities to positively identify thosepeople if they are kidnapped or killed. Again, privacy advocates fear that RFID-injected people can have their personal tag information read without their consentby an intruder with a tag reader in a crowded public place, raising identity theftconcerns. In the final analysis, RFID technology has been a big breakthrough inthe manufacturing and consumer goods industries where it is helping to reduceinventory and product tracking costs. As for its beneficial use to store and managepersonal information for humans, the jury is still out. E-Mail Address: The use of a person’s e-mail address as an identification mecha-nism or user ID has become increasingly popular in recent years, particularly forInternet e-commerce and portal sites. Part of the reason for this is that an e-mailaddress is globally unique. If a user’s e-mail address is, nobody elsecan legitimately use that address to send or receive e-mail. Based on that assump-tion, many Web sites use the user’s e-mail address as the unique user ID and allowthe user to select a password for authentication. Web sites using this convention willadditionally use that e-mail address to send correspondence to the user for admin-istrative or informational purposes. One common mechanism in current use is tohave a new user to register on the site to enter his e-mail address as a user ID. Thesite will then send a confirmation e-mail to that address and wait for a reply fromthe user before completing the registration process. The theory behind this processis that if a user has access to the e-mail account specified by the entered addressthere is a high degree of certainty that the user is legitimate. However, this assumption may not be valid in many situations. The unique-ness of an e-mail address is enforced solely by convention. There are no technical© 2010 by Taylor and Francis Group, LLC
  • 85. 58 ◾ Official (ISC)2 Guide to the CISSP CBKrestrictions preventing the use of another person’s e-mail address as an identifierand, the aforementioned verification mechanism notwithstanding, there is no wayto formally verify the legitimacy of a particular e-mail address or that a particularindividual is the owner of that address. In addition, it is a simple matter to spoof(or falsify) the sender’s e-mail address in most common e-mail systems in use today,and spammers, fraudsters, and phishing perpetrators regularly use this method as away of masking the true origin of their attacks. It is convenient for a person to use ane-mail address as identification because it is easy to remember, but if an organiza-tion wishes to use this as an identification method it should not place absolute trustin its legitimacy and should certainly use other authentication methods to tie theuse of that address to a particular user. User Identification Guidelines: There are three essential security characteristicsregarding identities: uniqueness, nondescriptiveness, and secure issuance. First andforemost, user identification must be unique so that each entity on a system can beunambiguously identified. Although it is possible for a user to have many uniqueidentifiers, each must be distinctive within an access control environment. In theevent there are several disparate access control environments that do not interact,share information, or provide access to the same resources, duplication is possible.For example, a user’s ID at work may be “mary_t,” allowing her to be identifiedand authenticated within the corporate infrastructure. She may also have a per-sonal e-mail account with her Internet service provider (ISP) with the user ID of“mary_t.” This is possible because the corporate access control environment doesnot interact with the ISP’s access control environment. However, there are potentialdangers with using the same ID on multiple systems. Users are prone to duplicatingcertain attributes, such as passwords, to minimize their effort. If an attacker discov-ers Mary’s ISP ID and password, he or she may rightly conclude that she is usingthe same ID and password at work. Therefore, any duplication, although possible incertain circumstances, represents a fundamental risk to the enterprise. User identification should generally be nondescriptive and should try as muchas possible to disclose as little as possible about the user. The ID should also notexpose the associated role or job function of the user. Common practice is to issueuser IDs that are a variant of the user’s name, for example, “bsmith” or “bob.smith.”Once this scheme is identified by an attacker it becomes easy to begin enumeratingthrough possible variations on the theme to discover other valid user IDs in theorganization. In addition, a person’s job function should never be used as the basisfor a user ID. If a user ID were to be named “cfo,” an attacker would be able to focusenergy on that user alone based on the assumption that he is the CFO of the com-pany and would probably have privileged access to critical systems. However, thisis practiced quite often. It is very common to have user IDs of “admin,” “finance,”“shipment,” “Web master,” or other representations of highly descriptive IDs. Thenaming of these IDs is voluntary and self-imposed by the organization. There are some IDs, however, that cannot be easily changed. The most predomi-nant is the username “root.” It is the name given to the administrative account with© 2010 by Taylor and Francis Group, LLC
  • 86. Access Control ◾ 59unlimited access rights on a UNIX system. Everyone, including attackers, knowswhat the username “root” represents, and it is for this very reason that attainingroot’s password is so desirable. Unfortunately, in most UNIX systems, changingthe user or masking that role is impossible. In Microsoft operating systems it ispossible to change the username of the default “administrator” account (nearly theequivalent of “root” in UNIX) to some other nondescriptive name, and should beconsidered a best practice. Clearly, any highly privileged system account, such as “root” and “adminis-trator,” represents a target for attackers, and it can be difficult to mask its role.However, traditional users, who may have a broad set of privileges throughout theenterprise, can be more difficult for attackers to isolate as a target. Therefore, estab-lishing a user ID that is independent of the user’s name, job function, or role willact to mask the true privileges of the user. Ideally, user IDs should be randomlyassigned or include some randomized elements to prevent ID guessing and enu-meration by attackers. Finally, the process of issuing identifiers must be secure and well documented.The quality of the identifier is in part based on the quality of how it is issued.If an identity can be inappropriately issued, the entire security system can breakdown. The identifier is the first, and arguably the most important, step in acquiringaccess. An organization must establish a secure process for issuing IDs, includingthe proper documentation and approval for all ID requests. The process must alsoaccount for notification of the user’s management and any system owners for sys-tems the user may have access to. The organization must deliver the user ID to theend user in a secure manner. This can be as simple as delivery in a sealed envelope oras complicated as using digitally signed and encrypted communications channels.Finally, the entire process must be logged and documented properly to ensure thatthe process can be verified and audited.Authentication Methods: There are three fundamental types of authentication: ◾ Authentication by knowledge—something a person knows ◾ Authentication by possession—something a person has ◾ Authentication by characteristic—something a person isTechnical controls related to these types are called “factors.” Something you knowcan be a password or PIN, something you have can be a token fob or smart card,and something you are is usually some form of biometrics. Single-factor authentica-tion is the employment of one of these factors, two-factor authentication is using twoof the three factors, and three-factor authentication is the combination of all threefactors. The general term for the use of more than one factor during authenticationis multifactor authentication. Single-factor authentication is typically implemented with a user ID and passwordcombination. Note that in this case the password is the relevant “factor,” not the user© 2010 by Taylor and Francis Group, LLC
  • 87. 60 ◾ Official (ISC)2 Guide to the CISSP CBKID. The user ID is merely an identifier to allow the system to know who is trying toauthenticate. General security industry consensus is that single-factor authenticationusing only a password does not provide a high level of security because the typicalreusable (static) password is easily compromised and, therefore, provides very limitedsecurity. There are a plethora of technical solutions that provide the framework toauthenticate users based on passwords. Given the broad use of passwords, most tech-nical solutions will provide this service, and the universal acceptance and historicalfoundation for the use of passwords as an authenticator means it will remain a stapleof authentication mechanisms for a long time to come. Two-factor authentication usually introduces an additional level of technicalcontrols that the user must have in his possession in the form of a physical or pro-grammatic device. Typically, this is a token, fob, or smart device that substanti-ates the user’s identity by being incorporated into the authentication process. Theincorporation can include one-time (or “single use”) passwords, such as a time-sensitive number generators, or the existence of a digital certificate and privateencryption key. Three-factor authentication will include elements of all three factors and, assuch, will include something about the user, such as a biometric feature. Availablebiometrics include a number of options, such as fingerprints, retina scanning, handgeometry, facial features, or even body temperature. This will typically involve theuse of a device that interfaces with a person during the authentication process. In recent years a potential fourth authentication factor has made an appearanceon the landscape: geolocation or somewhere you are. Current network and mobiletechnology enables the identification of the apparent geographic source of a com-munication based on its IP address or (in some cases) GPS coordinates. This helpsdetect attackers using credentials from unexpected locations, such as outside of thecorporate network or in a foreign country. The term “apparent location” is usedbecause the use of IP address is not a foolproof method of geographic identifica-tion. IP addresses can be easily spoofed (or falsified) to mask the real source of acommunication. Alternatively, a non-malicious user can be working on a remotenetwork (say, for example, in Mumbai) using IP address space assigned to the com-pany’s headquarters in Milwaukee. Nevertheless, geolocation is being increasinglyseen as a contender for an additional factor to increase the assurance applied to anauthentication. Authentication by Knowledge: A representation of single-factor authentication,what a person knows, is typically used in conjunction with a user ID or otherunique identifier. As discussed previously, in common use this is predominantly apassword. A password is typically a short (5–15 characters) string of characters thatthe user must remember to authenticate against their unique identifier. Passwordscan be simple words or a combination of two or more easily remembered words,include numbers or special characters, and range in length and complexity. Themore diverse or complicated the password is, the more difficult it will be for anattacker to guess or crack. Given that password crackers will typically start with a© 2010 by Taylor and Francis Group, LLC
  • 88. Access Control ◾ 61common language or technical dictionary or a predefined collection of words, theuse of common words as passwords has grown significantly less secure. What wasonce feasible as a password is now considered a vulnerability. Standard words, perhaps with some capitalization, are not considered secure bytoday’s standards: BoB, Phoenix, airplane, doGWalk are examples of basic words.Unfortunately, passwords of this type represent the most common forms used.Good system administrators are now incorporating password complexity require-ments into the password creation process so that the system will not accept suchsimple passwords. However, applying this type of administrative control is notalways possible. Combination passwords mix dictionary words to create a password that is easyfor the user to remember: Air0ZiPPEr, Bean77Kelp, and OcEaNTaBlE12 areexamples of combination passwords. The inclusion of numbers can help add somecomplexity to the password. This example represents what a user will create to meetthe system requirements for passwords, but these are still somewhat easy for a pass-word cracker to discover. Complex passwords include many different types of characters to introduce asignificant level of complexity: Z(1@vi|2, Al!eN-H9z, and W@!k|nGD2w*ˆ areexamples of complex passwords. Unfortunately, these examples can be difficult forthe average user to remember, potentially forcing them to write the password downwhere it can be discovered. There are several practices to help users produce strong passwords that can beeasily remembered. These can be as simple as remembering a keyboard pattern orreplacing common letters with numbers and special characters, or characters thatrepresent words that start with the letter being entered. For example, “password”can be P@zS|W0r$. Although not recommended, this password does meet mostsystem requirements; it is over eight characters and uses lower- and uppercase let-ters, numbers, and special characters. A good alternative to passwords is a passphrase. They are longer to enter but typi-cally easier to remember and harder to attack. A passphrase will support all types ofcharacters and spaces, allowing the user to create an easier to remember passwordwithout sacrificing integrity. Once a phrase is identified, it is simple to incorporatespecial characters to replace letters, furthering the complexity. Examples include ◾ A list of names: “Bobby CarolAnn Stuart Martha Mark” is an example of a 33-character passphrase that is very easy for the user to remember, but can be difficult for a password cracker to discover. ◾ A song or phrase: “A long time ago in a galaxy far, far away …” ◾ The initial letters of an easily remembered phrase: “The screen door slams, Mary’s dress waves” becomes “Tsds,m’sdw.”The confidentiality of the password or passphrase is critical. Passwords must neverbe sent over a network or stored in cleartext. Unfortunately, old services such as file© 2010 by Taylor and Francis Group, LLC
  • 89. 62 ◾ Official (ISC)2 Guide to the CISSP CBKtransfer protocol (FTP) and telnet do not protect the password from exposure dur-ing authentication. It is important to ensure that applications and network-enabledservices apply various controls to ensure passwords are not exposed. If the protocolor service does not have encryption capabilities, there are alternative services andprotocols that add a layer of encryption to help protect the application. Additionally,the storage of passwords must be protected. Password crackers can be used to attacka password file offline and unbeknownst to the system owner. Therefore, the secu-rity of the system maintaining the user credentials is paramount. To protect passwords on a system from being exposed, they are typically hashed.A hash function takes an arbitrary amount of data as input and, through the useof a mathematical algorithm, will produce a unique, fi xed-length representationof the data as output. The most important aspect of the hash function is that it isconsidered a one-way function. This means that a hash result cannot be decipheredto produce the original data. Although there are several types of attacks that canbe performed to take advantage of weaknesses in various hash algorithms or howthey are employed, in nearly all cases the hash cannot be directly manipulated toproduce the original data. Of course, password cracking programs can hash dif-ferent passwords until a match with the original password hash in a file is found.This is not a weakness of the philosophical attributes of hashing data. It is simplyperforming an act that a normal system operation would perform, just thousandsor potentially millions of times. However, the time to discovery of a password bymeans of a password cracker is directly related to the complexity of the user’s pass-word and the employment of the hashing algorithm. During a brute force attack,longer and more complex passwords will take longer to discover than simple shortpasswords. Graphical Passwords: As the methods of infiltrating end-user systems to stealinformation have gotten more complex, many organizations are looking for waysto stay ahead of these attacks to provide more security for end users. A commonthreat for end users is the keystroke logger. As the name implies, keystroke loggersrecord every key typed on the victim’s computer, including any IDs or passwordsthe user may enter to log into various information systems. A keystroke logger maybe a small hardware device inserted between the keyboard and the computer or itmay be a piece of software secretly installed on the user’s system. In an effort to combat this threat, many sites are turning to graphical passwords.In a graphical password system, the system displays a picture, image, or other visualdevice rather than requiring the user to enter their password into the keyboard.The most common example of this is the use of a graphical keyboard displayed onthe screen during the login process. To enter a password the user will click on theappropriate “keys” on the keyboard image to simulate the entry of the password atthe keyboard. Many keystroke loggers will record only that the mouse was clickedbut not be able to capture specifically what information the click represents. Inother implementations, a user is presented with a series of random images, one ofwhich has been preselected by the user. If the user selects the correct image during© 2010 by Taylor and Francis Group, LLC
  • 90. Access Control ◾ 63the authentication process the authentication passes. A keystroke logger on a systemwill not know what image was clicked and, thus, cannot capture this information. Graphic passwords are a good step forward in the effort to keep users’ identifi-cation and authentication information secure. However, keystroke loggers continueto advance and the latest ones have the ability to identify the image or data thatwas selected by the user. They use screen location information and screen capturesto record specifically what the user has selected. Based on this, graphical passwordsare a good step forward in the fight to keep user information secure, but they mustconstantly keep evolving in order to keep up with the latest attack methods. Authentication by Possession: In addition to a unique identity, a user may be pro-vided a token or some form of physical device that can be used in lieu of, or in addi-tion to, a traditional password. The objective is to add another layer of confidencethat the user is who he or she claims to be by the assurance a physical device offers.The added security comes from the fact that the user must have possession of thedevice in order to complete the authentication. There are two basic authentication-by-possession methods: asynchronous and synchronous. An asynchronous token device is a challenge–response technology. A dialogueis established between the authentication service and the remote entity tryingto authenticate. Without possession of the asynchronous token device, a correctanswer to the challenge cannot be generated. As demonstrated in Figure 1.8, the user makes a request for access to a systemor service. The system sends a “challenge” back to the user, which is typically a 1) Client requests access 2) Server sends challenge 6) Response sent to server 7) Server sends access decision 3) User enters 5) User challenge enters ( PIN) response into token into client 4) Token calculates responseFigure 1.8 Asynchronous authentication.© 2010 by Taylor and Francis Group, LLC
  • 91. 64 ◾ Official (ISC)2 Guide to the CISSP CBKnumber that must be entered into the token. The user enters the number along witha PIN or some other code (“something you know”) to go along with the device’s“something you have” and the device calculates a response to the challenge. Theuser enters the response and sends it back to the system. The system, for its part,knows what response it is expecting because it sent the original challenge, it knowsthe user’s PIN, and it performs the same calculation the device performs. If theuser’s response matches the calculated response the authentication passes. Although very similar to asynchronous authentication, synchronous token authen-tication is based on an event, location, or time-based synchronization between therequestor and authenticator. The most common and widely adopted version is time-based, although smart cards and smart tokens can store special credentials thatpromote event and location authentication schemes (covered in more detail later).Figure 1.9 shows the synchronous authentication process. In a time-based model, a user will be issued a token or smart device that utilizesan embedded key to produce a unique number or string of characters in a giventimeframe, such as every 60 seconds. The key is based on a combination of the timeand a random number called a “seed.” When the user makes a request for authen-tication, he or she is challenged to enter his or her user ID and the information(typically a number) that is currently displayed on the token. The system may alsorequire the use of a password or PIN to enhance the authentication. The authenti-cating system will know which token is issued to that user and, based on the timingof the authentication request will know the data that should appear on the device.If the data entered by the user are the same as that expected by the system, theauthentication is valid and the user is allowed to pass. Time Client Server Sync Sync Time Current Code Calc (82635) User enters PIN in token Compare Token 8263 5 calculates 82635 82635 code Match???Figure 1.9 Synchronous authentication.© 2010 by Taylor and Francis Group, LLC
  • 92. Access Control ◾ 65 Static Authentication Devices: There are physical devices, in addition to tradi-tional number-generation tokens, that can contain credentials for authentication.The credentials, which exist only on the device, are used during the authenticationprocess and their use count as proof the user has possession of the device. Thereare two forms of such authentication devices; memory cards and smart cards. Themain difference between memory cards and smart cards is the availability of pro-cessing power. A memory card holds information, but cannot process information.A smart card holds information, but also has the necessary hardware and logic toactually process information. Memory Cards: A memory card holds a user’s authentication information, sothat this user needs only type in a user ID or PIN and presents the memory cardto the system. If the entered information and the stored information match andare approved by an authentication service, the user is successfully authenticated.A common example of a memory card is a swipe card used to provide entry to abuilding. The user enters a PIN and swipes the memory card through a card reader.If this is the correct combination, the reader flashes green and the individual canopen the door and enter the building. Memory cards can also be used with computers, but they require a reader toprocess the information. The reader adds cost to the process, especially when oneis needed for every computer. Additionally, the overhead of PIN and card genera-tion adds additional overhead and complexity to the whole authentication process.However, a memory card provides a more secure authentication method than usingonly a password because the attacker would need to obtain the card and know thecorrect PIN. Administrators and management need to weigh the costs and benefitsof a memory card implementation as well as the security needs of the organizationto determine if it is the right authentication mechanism for their environment. One of the most prevalent weaknesses of memory cards is that data stored onthe card are not protected. Unencrypted data on the card (or stored on the magneticstrip) can be extracted or copied. Unlike a smart card, where security controls andlogic are embedded in the integrated circuit, memory cards do not employ an inher-ent mechanism to protect the data from exposure. Therefore, very little trust can beassociated with confidentiality and integrity of information on the memory cards. Smart Cards: A smart card is a credit card-size plastic card that has an embeddedsemiconductor chip that accepts, stores, and sends information. It can hold moredata than memory cards. The term “smart card” is somewhat ambiguous and canbe used in a multitude of ways. The International Organization for Standardization(ISO) uses the term integrated circuit card (ICC) to encompass all those deviceswhere an integrated circuit (IC) is contained within an ISO 1 identification cardpiece of plastic. The card is 85.6 × 53.98 × 0.76 mm and is essentially the sameas a bank or credit card. The IC embedded is, in part, a memory chip that storesdata and provides a mechanism to write and retrieve data. Moreover, small appli-cations can be incorporated into the memory to provide various functions. Thesemiconductor chip can be either a memory chip with nonprogrammable logic or© 2010 by Taylor and Francis Group, LLC
  • 93. 66 ◾ Official (ISC)2 Guide to the CISSP CBKa microprocessor with internal memory. In an increasingly online environment,where critical information and transactions are exchanged over open networks,security is critical. New technologies allow smart cards, readers, and tools incor-porating public key infrastructure (PKI) technologies to provide everything fromauthentication to network and information security functions on a single card plat-form. Some of the more common uses for smart cards today include ◾ Secure log-on ◾ Secure e-mail/digital signatures ◾ Secure Web access/remote access ◾ Virtual private networks (VPNs) ◾ Hard disk encryptionInformation on a smart card can be divided into several sections: ◾ Information that is read only ◾ Information that is added only ◾ Information that is updated only ◾ Information with no access availableTypically, to use a smart card for accessing computer and network resources, a userinserts the smart card into a reader and enters the PIN associated with that card tounlock the card’s services. In such a scenario, the first factor of security is providingsomething you have—a smart card. The second factor in this case is providing some-thing you know—the PIN. With a smart card, there is an added level of integrity.The PIN provides access to the information on the card (not simply displayed, aswith a token), and the key on the device is used during the authentication process.When used in combination with digital certificates, the system can participate ina larger enterprise infrastructure to provide integrity of the authentication process.A major advantage to smart cards is that the log-on process is done by the readerinstead of at the host. Therefore, the identifier and password are not exposed toattackers while in transit to the host. This last point is very important because it highlights the concept of a trustedpath. A trusted path is a communications channel through which all informationpassing is assumed to be secure. The longer the trusted path, or the more links inthe communication chain along the trusted path, the more opportunity there isfor the security of that path to be compromised. Reducing the length of the path,or the number of links in the path, reduces the opportunity for security failuresalong the path. Therefore, by managing the authentication process within the smartcard reader instead of sending the information to a remote authentication server,the trusted path for authentication is reduced and the opportunity for an attackerto compromise user information between the reader and a remote authenticationservice is eliminated.© 2010 by Taylor and Francis Group, LLC
  • 94. Access Control ◾ 67 There are different types of security mechanisms used in smart cards. Accessto the information contained in a smart card can be controlled based on iden-tity (e.g., everybody, only the cardholder, or a specific third party) and how theinformation can be accessed (e.g., read only, add only, modifiable, or erasable). There are several memory types, some of which can be implemented into asmart card, for example: ◾ read-only memory (ROM): ROM, or, more specifically, the data contained within ROM, is predetermined by the manufacturer and is unchangeable. Although ROM was used early in the evolution of smart cards, the inability to change the information in the memory makes it far too restrictive for today’s requirements. ◾ programmable read-only memory (PROM): This type of memory can be modified, but requires the application of high voltages to enact fusible links in the IC. The high voltage requirements made it unusable for an ICC, but many have tried. ◾ erasable programmable read-only memory (EPROM): EPROM was widely used in early smart cards, but the architecture of the IC operates in a one- time programmable mode (OTP), restricting the services offered by the ICC. Moreover, it requires ultraviolet light for erasing the memory, making it dif- ficult for the typical organization to manage cards. ◾ electrically erasable programmable read-only memory (EEPROM): EEPROM is the current IC of choice because it provides user access and the ability to be rewritten, in some cases, up to a million times. This provides the capabilities smart cards need to be usable in today’s environment. Typically, the amount of memory will range from 8 to 256 KB. ◾ random-access memory (RAM): Unlike ROM-based memory, whose data remains in tact when power is removed, RAM-based memory loses its data when not powered. For some smart cards that have their own power source, RAM may be used to offer greater storage and speed. However, at some point the data will be lost—this can be an advantage or disadvantage, depending on your perspective. If a loss of electrical power might indicate a sign of attack or danger, losing the information on a smart card might be considered a pru- dent security measure.Memory alone does not make a card “smart.” In the implementation of an IC, amicrocontroller (or central processing unit) is integrated into the chip, effectivelymanaging the data in memory. Control logic is embedded into the memory con-troller providing various services, including security. Therefore, one of the mostinteresting aspects for smart cards, and their use in security-related applications,is the fact that controls associated with the data are intrinsic to the constructionof the IC.© 2010 by Taylor and Francis Group, LLC
  • 95. 68 ◾ Official (ISC)2 Guide to the CISSP CBK To demonstrate, when power is applied to the smart card, the processor canapply logic in an effort to perform services and control access to the EEPROM.The logic controlling access to the memory ensures that data, such as a privatekey, are not exposed outside the card. Smart cards can be configured to only permitcertain types of data (such as public key certificates and private keys) to be storedon the device but never accessed directly by external applications. For example, auser may request a certificate and a corresponding public and private key pair fromhis organization. Once the keys and certificate are provided to the user, the usermay store the certificate and private key on the smart card. In such situations, someorganizations will establish a certificate policy that only allows the private key to beexported once. Therefore, the private key is stored permanently on the smart card.However, smart cards will typically contain all the logic necessary to generate thekeys during a certificate request process. In this scenario, the user initiates a certifi-cate request and chooses the smart card as the cryptographic service provider. Oncethe client system negotiates programmatically with the certificate authority, theprivate key is generated and stored directly on the smart card in a secure fashion.When organizations select this strategy, the keys are not exportable outside the cardand are forever tied to the owner of the card. A very similar process is utilized to leverage the private key material for privatekey processes, such as digitally signing documents. Data are prepared by the systemand issued to the smart card for processing. This allows the system and user to lever-age the key material without exposing the sensitive information, permitting it toremain in a protective state on the smart card. To allow these functions and ensurethe protection of the data, programs are embedded in portions of the memory thatthe processor utilizes to offer advanced services. It is important to understand that a smart card is effectively a computer, withmany of the same operational challenges. The IC incorporates the processor andmemory, the logic embedded in the processor supports various services, applicationsbuilt into the processor and housed on the EEPROM are available for on-demanduse, protocol management interfaces with other systems, and data are managed onthe card. All these and more exist in a very small substrate hidden in the card andwill only become more complex as technology advances. In order to exchange data with systems and services, the card must interfacewith a reader. There are two basic types of smart cards, and the difference isbased on how they interact with other systems—contact cards, which use physi-cal contact to communicate with systems, or contactless cards, which interfaceusing proximity technology. Figure 1.10 illustrates the two types of available cardtechnologies. Contact cards are fairly self-explanatory. Based on ISO 7816-2, a contact ICCprovides for eight electrical contacts (only six are currently used) to interact withother systems or devices. The contacts on a smart card, as shown in Figure 1.11,provide access to different elements of the embedded IC. Figure 1.12 explains theuses for each contact.© 2010 by Taylor and Francis Group, LLC
  • 96. Access Control ◾ 69 Card body (Back) Card Body Chip Chip Module (Contacts) Antenna Card body (Front)Figure 1.10 There are two types of available card technologies: contact andcontactless cards. Vcc GND RST VPP CLK I/O RFU RFUFigure 1.11 Smart card contact plate. In contrast to contact cards, contactless cards do not require the user to placethe card into a reader. Instead, the user simply holds the card in close proximity tothe reader and the reader can detect the card and the information stored on it. Forthis reason, contactless cards are often called proximity cards. They are increasingin adoption because of durability, number of applications in use, speed, and conve-nience. They eliminate the need to physically interact with the reader, reducing theexposure and damage that contact cards have with the plate or magnetic strip onthe card. Finally, a contactless card offers a multitude of uses and opportunity forintegration, such as with cell phones or PDAs. Other possession-based authentication devices are beginning to appear on themarket as well. Many of these devices can attach to the universal serial bus (USB)© 2010 by Taylor and Francis Group, LLC
  • 97. 70 ◾ Official (ISC)2 Guide to the CISSP CBK Contact Designation Use Vcc Power connection through which operating power is supplied to the microprocessor chip in the card. RST Reset line through which the interface device (IFD) can signal to the smart card’s microprocessor chip to initiate its reset sequence of instructions. CLK Clock signal line through which a clock signal can be provided to the microprocessor chip. This line controls the operation speed and provides a common framework for data communication between the IFD and the ICC. RFU Reserved for future use. GND Ground line providing common electrical ground between the IFD and the ICC. Vpp Programming power connection used to program EEPROM of first-generation ICCs. I/O Input/output line that provides a half-duplex communication channel between the reader and the smart card. RFU Reserved for future useFigure 1.12 Smart card pinouts.port on most modern computers. These devices can contain many of the same dataelements as smart cards, such as user IDs, passwords, access credentials, encryptionkeys, and other private information. When the device is inserted into the USB sloton a computer, the system or application takes the information it needs directlyfrom the device. For additional two-factor security it may also require the user toenter some information from the keyboard. These devices also have benefits beyond initial authentication. For example,they can be periodically polled or queried by the system to ensure it is still pres-ent. If it is not, the system can assume that the user has moved to another placeand the system or application can lock itself until the user returns and rein-serts the device. In addition, because many of these devices have data storagecapabilities, systems or applications can also store credentials or confidentialuser information on them for later use. For this reason, care should be taken toprotect the devices against loss or unauthorized use. These devices often havebuilt-in encryption capabilities to protect the information from extraction byunauthorized persons.© 2010 by Taylor and Francis Group, LLC
  • 98. Access Control ◾ 71 Authentication by Characteristic (Biometrics): The ability to authenticate a userbased on physical attributes or other characteristics unique to that person is possibledue to biometric technology. Biometrics is the use of specific biological indicators ofthe human body or behavioral characteristics that can be used to calculate unique-ness. There are two types of biometrics: physiological and behavioral. A physiological biometric uses information about a unique physical attributeof the user, such as a fingerprint. The user interfaces with a biometric scanningdevice to provide the information. The device performs a measurement (potentiallyseveral times), makes a final determination as to the validity and ownership of thebiometrics, and compares the results with the information stored in the control sys-tem. There are several biometrics that are more commonly used, the most commonbeing human fingerprints. Fingerprints are unique to each person and have beenused for years by law enforcement agencies to identify people. One of the earli-est forms of easily accessible biometric systems was based on fingerprint analysis.Today, fingerprint biometric thumb readers can be easily purchased and quicklyutilized with standard PCs. Moreover, the technology has become so commonplacethat USB memory fobs have incorporated fingerprint readers into the data stick toauthenticate its use. Hand geometry techniques attempt to discern several attributes about the size,shape, and layout of a person’s hand to gather enough information to draw conclu-sions about the person’s identity. The system may measure tension in the tendons inthe hand, temperature, finger length, bone length, and hand width, among otheraspects. Palm or hand scans can be best described as a combination of the capabili-ties of both hand geometry and fingerprint analysis. The user’s hand is typicallyplaced flat on a special surface where, again, several points of information are col-lected and combined to make a determination on the user’s identity. Not all biometric information resides in the hands, however. The face and eyesoffer other aspects of individuality that can be harnessed by a biometric device todetermine and authenticate identity. There are two primary aspects of the humaneye that can be investigated: the retina and the iris. Each is unique to an individualand to each eye. The retina, located in the back of the eye, has blood vessels thatcan be scanned to identify distinctive patterns. The iris is the colored materialsurrounding the pupil that governs the amount of light permitted to enter theeye. Again, each one has granularity characteristics that can uniquely identify theindividual. Finally, the entire face can be used by a system to visually verify facialgeometry and heat signatures that correspond to a person’s skull structure and tis-sue density. Because each face is unique (even for identical twins) the layout andother facial characteristics make unique identification possible. Vascular Scans: Another method of incorporating unique physical characteris-tics to enhance the authentication process is the use of vascular scanning technol-ogy. In a vascular scan, the scanning device studies the veins in the user’s handsor face. The scanner will examine and analyze the patterns and thickness of theveins, which are believed to be unique for each person. The advantage of vascular© 2010 by Taylor and Francis Group, LLC
  • 99. 72 ◾ Official (ISC)2 Guide to the CISSP CBKscanning is that it is relatively nonintrusive to the end user, requiring only theplacement of the hand near a scanning device. The disadvantage is that physicalinjury or deformity to the hands can render the system unable to accurately scan oranalyze a particular hand. Vascular scanning technology is still relatively new, butit is gaining some acceptance in some high-security areas. Unlike physiological characteristics, which attempt to establish identity bymatching physical characteristics of a person, behavioral characteristics measurethe way a person acts and performs in various situations. The act of determiningunique characteristics about a person from patterns in their actions has emerged asone of the more viable approaches to biometrics. One common behavioral charac-teristic currently in use is the analysis of a person’s voice pattern. Voice patterns andvoice recognition are regularly used for identification and authentication. Voicepattern matching investigates how a user speaks. In recent history, advancements inspeech recognition technology have increased the technology’s viability. Typically,a user will enroll in a voice recognition system by speaking several different wordsor phrases, including the user’s name. The system will attempt to determine theunique sounds produced by that particular human during speech. During subse-quent authentication, the user repeats the phrases again and the system matches theresults with the expected pattern recorded and analyzed from the original user. With the addition of voice recognition, the system can identify what is said aswell as how it is spoken. Therefore, a passphrase can be used in combination witha person’s name to authenticate on multiple levels. Again, as with other forms ofmultifactor authentication, other elements may be used, such as a PIN, smart card,swipe card, or even another biometric system, such as fingerprint input. Another of the more promising new methods of behavioral authentication iskeystroke dynamics. Keystroke pattern analysis is based on the fact that each per-son has a unique and distinguishable typing pattern and these patterns can bemeasured and identified during the entry of other authentication information. Forexample, a user is prompted for a traditional username and password. He enters theinformation, but in addition to checking the validity of the entered password, thesystem also measures how the user typed the password. If the password is correct,but the typing pattern is wrong, he may be denied access. Signature dynamics has also emerged as an effective biometric solution. Much likevoice patterns, a biometric system can measure the visual layout of the signature aswell as the stroke speed, acceleration and deceleration, and pen pressure. Law enforce-ment and forensics experts have been leveraging the science of handwriting dynamicsfor many years. They inspect the physical nature of the signature to identify knowncharacteristics that indicate forgeries. For example, if the paper (or material) showssigns that intense pressure was applied, it could indicate a copy or extreme intensity,representative of someone uncomfortable during the signing (a rarity for normal sign-ing processes.) Moreover, pauses or slow movement in specific areas typically associ-ated with fast or light areas of the signature can be identified by an investigator: again,signs of a forgery. These same principles are utilized by a pressure-sensitive digitalinterface to detect a divergence from expected signing practices.© 2010 by Taylor and Francis Group, LLC
  • 100. Access Control ◾ 73 Biometric Accuracy: For all the advancements in biometric technology in recentyears, and its promise to offer advanced identification and authentication tech-niques, it is still far from perfect. Ironically, the biggest imperfection comes fromthe variability of the humans (and their surrounding environment) that biometricsseek to measure. Technical measures, like passwords, tokens, and smart devices,offer a high degree of accuracy and confidence in the transaction based on the lim-ited variability in their measurement. A password can be hashed and verified, andthe measurement process (the algorithm) is static. Tokens, especially synchronoustokens, are based on the strict measurement of time. When an error occurs in token-based authentication, it is typically because the time synchronization between thetoken and the server has shifted. This is a common and sometimes expected error,and the authentication failure tends toward denial of access. In the case with smartcards, there is no measurement dynamic and the card adheres to established techni-cal and physical standards. In stark contrast, the field of biometrics is essentially a technical and mathemati-cal estimation. The measurement and subsequent analysis of biometric informa-tion collected by a scanning device can be affected by hundreds of environmentalvariables. Temperature, humidity, pressure, and even the medical or mental condi-tion of the individual can cause significant physiological changes to the body thatthe measurement process must try to cope with. If a person is ill or a woman ispregnant, biometric results from those individuals may vary significantly from pre-established norms and iris scans, facial recognition, and hand geometry may fail.Therefore, the accuracy of the biometric mechanism—its ability to separate authenticusers from imposters—is essential to understanding the risk of its use for any givenapplication. There are three categories of biometric accuracy measurement (all representedas percentages): ◾ False Reject Rate (a Type I Error): When authorized users are falsely rejected as unidentified or unverified. ◾ False Accept Rate (a Type II Error): When unauthorized persons or imposters are falsely accepted as authentic. ◾ Crossover Error Rate (CER): The point at which the false rejection rates and the false acceptance rates are equal. The smaller the value of the CER, the more accurate the system.As demonstrated in Figure 1.13, the sensitivity level of the biometric system trans-lates into varying levels of false rejection and false acceptance. The lower the sen-sitivity, the more prone the system is to false acceptance. With low sensitivity, thesystem may offer a broad margin of error or disparity in the determination of themeasured metrics. The low sensitivity also may not enable the system to acquireenough meaningful data to discern the authorized user from the unauthorized user.On the other hand, if the system is overly sensitive, it may apply too much granu-larity to the process, resulting in a level of investigation that is highly susceptible© 2010 by Taylor and Francis Group, LLC
  • 101. 74 ◾ Official (ISC)2 Guide to the CISSP CBK False Accept Rate False Reject Rate Error Rate Crossover Error Rate SensitivityFigure 1.13 Crossover error rate is one of three categories of biometric environmental changes or minor biological changes in the person and increasethe false rejection rate. A good balance between the two is difficult to obtain. Notsensitive enough, and everyone will be authorized; too sensitive, and no one getsthrough. Neutrality is achieved by tuning the system sensitivity so that the ratesintersect at a midpoint. The lower the intersection point between the two rates, themore accurate the system is overall. It is very important to understand the relationships and measurements betweenthe two rates, because the trends in either direction are not mathematically consis-tent. Using the example chart in Figure 1.14, if the lowest attainable intersectionhas an error rate of 20%, regardless of sensitivity adjustments, the system is clearlyfailing consistently at an unacceptable level. In this case, 1 in 5 people are gettingthrough the system improperly. Also, the key to proper tuning of the system isto attain the lowest possible intersection rate at the greatest possible sensitivity.However, there are other factors that must be taken into consideration as well. False Accept Rate False Reject Rate Less Optimal Optimal Error Crossover Crossover Rate Error Rate Error Rate Sensitivity Acceptable DeltaFigure 1.14 Comparison of crossover error rates.© 2010 by Taylor and Francis Group, LLC
  • 102. Access Control ◾ 75 It would appear that the crossover rate on the lower left side of the figure wouldbe optimal, since it has the lowest error rate of the two crossover points shown.However, this low CER is achieved by tuning the system to a relatively low sensitiv-ity. At this setting, it is likely that the system may not be sensitive enough to detectchanges in body condition or environmental factors. However, the figure showsthat by adjusting the sensitivity upward by nearly a third, the CER is raised onlyslightly. Therefore, the truly optimal CER location is in the bottom right of thegraph. The amount to adjust the sensitivity and the maximum acceptable level ofchange in the CER is something the organization will need to determine based onits overall risk tolerance. The correct conclusion here is that the ability to tune the system and makedeterminations on what is optimal for a specific solution is directly relative to thelevel of risk and the importance of the controls. In short, the crossover error ratemust always be appropriate to the application and to the desired acceptable risklevel of the organization. Biometric Considerations: In addition to the access control elements of a biomet-ric system, there are several other considerations that are important to the integrityof the control environment. These are ◾ Resistance to counterfeiting ◾ Data storage requirements ◾ User acceptance ◾ Reliability and accuracy ◾ Target user and approachFirst and foremost, biometric systems must be resistant to counterfeiting. Unlike inthe movies, where the villain can use a severed finger to gain unauthorized access toa super-secure room, most biometric systems employ simple metrics, such as heat,blood pressure, or pulse rate to add further confidence in the process and resist suchforgery attempts. However, a very popular activity is the mimicking of a humanthumb to fool a fingerprint reader. The perpetrator can place a thin layer of gummybear jelly modified with the image of a valid fingerprint on his finger to gain unau-thorized access. The thin coating, with the fingerprint of the authorized user incor-porated, allows heat, pressure, and other simple metrics to be fooled because thereis a real finger behind the coating. If the imposter knows the user’s PIN and has hisor her physical credentials, success is possible, if somewhat unlikely. Nonetheless, a highly determined and sophisticated attacker could identify bio-metric weaknesses and take advantage of them by counterfeiting what is measured.Although arguably very complicated, it is feasible and, therefore, must be consid-ered. Beyond the tuning of the system to the upper, optimal range and addingother identification and authentication requirements, an organization implement-ing a biometric system is at the mercy of the biometric product vendor to incorpo-rate added investigative controls.© 2010 by Taylor and Francis Group, LLC
  • 103. 76 ◾ Official (ISC)2 Guide to the CISSP CBK A biometric system must be trained for a given user during enrollment (alsocalled association). For example, a user may have to talk into a microphone, lookinto a scanner, or provide a fingerprint several times before the system can obtainenough data to make future decisions. During this process, the system is gatheringhighly sensitive and private information about the physical attributes of the user.Information gathered by biometric systems will be either an electronic representa-tion (e.g., an image or picture) of the face, hand, eye, finger, or some other physicalcharacteristic of a person, or a mathematical representation of the data gathered.The security of data storage here is paramount. Not unlike securing the hashedpasswords on a system so that it does not fall into the hands of an attacker witha password cracker, the biometric information about a user’s physical attributescan be used against the system or even the user. An attacker gaining access to thebiometric data in the storage system would potentially have the ability to use thoseimages to somehow gain access to the system or the facility. At the very least, theprivacy and personal security of the users enrolled in the biometric system will bethreatened. When designing and implementing a biometric system the securityprofessional must pay careful attention to the security of the system’s informationdatabase to protect the system, the organization, and the user’s privacy. User acceptance can also be a significant barrier to meaningful adoption ofbiometrics. People have understandable concerns about lasers scanning the insidesof their eyes and the potential exposure of very private information, such as healthstatus. For example, a biometric system may be able to detect a drug addiction,disease, or pregnancy, perhaps even before the user is aware of these conditions. Theability to detect this private information is a concern to potential users. In somescenarios, the process is a requirement of a job position or role within an organiza-tion, so that any user concerns are irrelevant (that is, if the user desires to remainemployed by that organization.) In other cases, attempts to incorporate biometricsystems to simplify customer interaction, such as with automated teller machines,where the participation is optional, have met with limited success and poor useradoption, in part because of the aforementioned concerns. Finally, user acceptancemay be hindered by the intrusiveness of the system. Some people may not find itintrusive to place their thumb on a reader, while others may be uncomfortablewith perceptions of the sanitary condition of such a device. Placing your hand on adevice or looking into a system requires close personal interaction that may exceedan individual’s threshold of personal space. In addition to accuracy, the reliability of the system is important. For example,passport control points in airports, theme park admissions, or other areas that canutilize biometrics for the public often have these systems operating in locations thatexpose the system to the elements. For example, Sea World in Florida uses handgeometry biometrics for annual members. Members receive a picture identificationcard that is swiped at the entry point, and they insert their hand into the reader.The system will be used by thousands of people in a given year, and these devicesare outside, exposed to the hot, humid air. The reliability of the system to perform,and perform at an acceptable level of accuracy, must be considered.© 2010 by Taylor and Francis Group, LLC
  • 104. Access Control ◾ 77 The speed of the solution is another important factor to consider. The standardenrollment process should take no more than two minutes per person and a systemshould be able to reliably obtain enough information in that time period for futureauthentication requirements. In the event the system takes longer, it may affect useracceptance, raise questions of capability, and reduce user confidence in the system.Moreover, the average authentication rate—speed and throughput—is six to tenseconds. A reliable system should be able to attain these levels of performance or itsuse should be reconsidered. When considering the role of biometrics, its close interactions with people, andthe privacy and sensitivity of the information collected, the inability to revoke thephysical attribute of the credential becomes a major concern. A token, fob, or smartcard can be confiscated or the device assigned to a user can be changed. In con-trast, a person cannot get new fingerprints or retinas if the authentication system iscompromised. This limitation requires significant trust in the biometric system. Ifa user’s biometric information were to be captured in transit or counterfeited via afalsified reader, there are few options to the organization to detect that the attackhas occurred and revoke the physical credential. The binding of the authenticationprocess to the physical characteristics of the user can complicate the revocation ordecommissioning processes. Finally, biometric technology in practice excels in authentication-based applica-tions, such as building access. This is because the data points gathered during thebiometric process are easily compared against the same data points collected duringthe enrollment process. The results are deterministic and leave relatively little roomfor chance or interpretation. In contrast, biometrics do not yet work extraordinarilywell in applications where identification is the primary purpose, such as scanningthe faces in a crowd for suspected terrorists. This is because the variability in thescan data (such as changing light sources, hair and makeup changes, and positionrelative to the camera) leave too much room for interpretation and make positivematching much more difficult. Authentication Method Summary: This section has covered a large amount ofinformation about identification and authentication techniques, technology, andprocesses. However, how do these solutions compare? As demonstrated in Figure1.15, the capabilities and level of confidence increases as more factors and tech-niques are included in the identification and authentication process. The strength of individual authentication methods will vary, but generally, bio-metrics tends to provide higher security than any of the others. “Strength” can bedefined as the assurance that the authentication produced by the method is valid.The best way to interpret Figure 1.15 is to simply understand that as you move fromleft to right, you increase the strength provided by the authentication method.Something you are provides more security than something you know because it ismuch harder to impersonate or duplicate something you are. In the end, however, authentication is but a single part of the overall accesscontrol (and security) picture. There are many trade-offs involved with identifyingand implementing a particular authentication method and chances are that a large© 2010 by Taylor and Francis Group, LLC
  • 105. 78 ◾ Official (ISC)2 Guide to the CISSP CBK Fingerprint: Voiceprint: Iris/Retinal scan Private Key in Cryptographic Access Smart Card Functions in Smart Secret Key in Normal Web Browser Card or Token Smart Card Private Key in Biometric Access Strength of Authenticator Smart Card or Control PKI Private Key in s/w; Token PKI Private Key in Two-Factor Signature Fingerprint: Voiceprint: Shared Smart Card Authentication Acceleration Iris/Retina Scan and Pressure Software Token; Challenge Response Secret Key in s/w Token Token Shared One-time Hardware Dongle: Secret Passcode One Time Password RSA Security USB Token Password S/key Strength of Authentication Method Something Something you Something you Something Something you are you know have on your have in your you do machine possessionFigure 1.15 Comparison of authentication methods. The capabilities and level ofconfidence increases as more factors and techniques are included in the identifi-cation and authentication process.enterprise will select several to fit various needs within the organization. Some ofthe more prevalent considerations include ◾ The value of the protected asset. An asset with higher value will require a more complex (and expensive) authentication method. Assets with lesser value can suffice with more basic methods. ◾ The level of threat to the asset. There may be many threats, both real and perceived, against the asset in question. The security manager must make an assessment to determine the actual threats of concern. ◾ Potential countermeasures. Once the level of threat is determined, possible countermeasures to address that threat must be considered. Each counter- measure will reduce the threat in some way, and the best method (or combi- nation of methods) must be determined. ◾ The cost of countermeasures. Adjusting the authentication method may be one countermeasure to reduce the risk to the asset, but there may be others to consider. Each will have its own associated cost that must be weighed as part of an overall risk management solution. ◾ Feasibility and inconvenience to users. As has been shown, each method entails a certain level of participation (and annoyance) to its users. The secu- rity manager must weigh inconvenience, potential work flow disruption, and resulting user resistance when determining the best authentication method for an organization.© 2010 by Taylor and Francis Group, LLC
  • 106. Access Control ◾ 79Authentication is an important step in an organization’s overall access control strat-egy. As such, the method used must be chosen carefully and thoughtfully to ensureit is the best fit for the organization.Accountability: Accountability is the ability for the organization to hold peopleresponsible for their actions. As mentioned previously, access controls (and theirassociated audit trails) can provide crucial material related to incident investiga-tions, providing evidence to prove or disprove a user’s involvement in a givenevent. A comprehensive access control strategy will include the monitoring and securelogging of identification, authentication, and authorization processes. It should alsoinclude a log of actions taken by, or on behalf of, the user (both successful andunsuccessful) with all the appropriate and pertinent information associated withthe transaction. Moreover, a properly configured system will also log attemptedactions by an authenticated user who does not have the necessary privileges forthe requested task. Therefore, when properly employed, an access control systemcan provide substantiation of user activities, linking a user to a transaction or anattempt to access, modify, or delete information. Logs store essential information about system activity and can also trace thesteps that an attacker took to compromise a system. Therefore, the security of logsis important to ensure the integrity of the information; this is especially true if theinformation is going to be used for forensics investigations or legal proceedings.Logs have to be protected against unauthorized access and changes. If an attackeris able to manipulate or erase log data, successfully investigating an incident wouldbe impossible. Likewise, if an attacker is able to access and read the system or appli-cation logs he or she will be able to determine what, if any, of his or her activitiesare known by the target and adjust his or her methods accordingly. Therefore, thesecurity of the storage and archive systems used to store log data is critical to theintegrity of the information collected. A big issue to face when setting up logging and auditing in an environment isthe volume of data that need to be managed. Depending on the extent of the log-ging, the system could easily fill up gigabytes or terabytes daily. The expected datavolume needs to be anticipated in order to ensure that adequate space is available.In addition, the audit logs on a busy system may well exceed the administrativetime and skills necessary to review and investigate events that seem suspicious.Therefore, it may be necessary to use some type of event filtering or “clipping level”to properly determine the amount of log detail captured. After a certain threshold of log data is reached, the amount of information inthe logging management system will be too great to review or analyze manually.There are automated tools available that can be used to process and analyze loginformation. Many of these also perform correlation of the logs from multiple sys-tems to help determine relationships between systems to better determine exactlywhat was performed during an attack.© 2010 by Taylor and Francis Group, LLC
  • 107. 80 ◾ Official (ISC)2 Guide to the CISSP CBK Following are some best practices to consider when establishing a log collectionand management process: ◾ Control the volume of data. Log as much as is necessary and feasible, but be mindful of available storage and processing capacity, including analytical staffing requirements. ◾ Do not allow rollover of logs. Rollover is the act of erasing the earliest entries in a log when the log is full to make room for newer entries. Rollover is favored by administrators because it prevents the logs from filling up and consuming all available storage. Unfortunately, erasing log entries may result in losing valu- able data. Ensure that logs are copied to permanent storage then cleared on a regular basis to ensure that there is always enough disk space for log storage. ◾ Evaluate and implement auditing tools to reduce the complex task of log analysis. ◾ Establish log review and investigative procedures in advance. ◾ Train personnel in pertinent log review. ◾ Protect the audit logs from unauthorized access and changes. Ensure the stor- age and archive process and facilities are secure.Audit Trail Monitoring: An audit trail is the data collected from various systems’event logging activity. The purpose of an audit trail is to have enough informationto faithfully reconstruct events that happened on the system and to be able to pres-ent that reconstructed record as legal evidence. It is a record of system activities thatcan be investigated to determine if network devices, systems, applications, services,or any computer system that produces a log is operating within expected param-eters. Virtually any system can be configured to produce a log of system activities.Of course, not all possible events that can be logged are applicable to security.However, there are many system attributes that can be very helpful for collectinginformation and gaining awareness of the system and overall infrastructure status. The function of audit trails is to alert staff of suspicious activity for furtherinvestigation. For example, an administrator may see evidence of a user unexpect-edly logging into a mission-critical system outside of normal working hours. Uponfurther investigation, by checking the logs from other devices, the administratormay determine that the access came from a VPN connection over the Internet. Thiscollection of information can be used to validate whether the access was legitimateor expected. Moreover, the investigation can look at other logs produced from thesystem in question to determine if other questionable actions were performed bythat same user. The audit trail can also provide details on the extent of intruder activity. Duringa typical attack, the attacker will often traverse several systems, such as routers, fire-walls, and applications, potentially leaving behind a record of activity. This informa-tion can be used to reconstruct the path of the attack, what tools may have been used,the actions of the attacker, and the effects of the attack. If the information is properly© 2010 by Taylor and Francis Group, LLC
  • 108. Access Control ◾ 81collected and secured, and a chain of custody of log data can be accurately managed,the information can be used for legal proceedings to help prove guilt or innocence. Audit Event Types: There are many event types that can be audited given thediversity and broad spectrum of technology employed in a typical organization.However, with respect to information security and access controls, there are fivekey types that are the foundation of security auditing: ◾ Network events: The network can play a critical role during attacks. As use- ful as the network is to an organization in performing business processes, it is equally valuable to threat agents: it is the common field of operations providing opportunity to all users. Devices responsible for supporting com- munications can also provide ample information about events or activities on the network. Network layer information can be helpful in determining and isolating threat activity, such as a worm or a denial-of-service (DoS) attack. It can also be helpful in detecting whether users are using software or services not permitted by policy, such as instant messaging programs or peer-to-peer applications. Network logs can show the source and destination address of network traffic, what application the traffic was using, whether or not pack- ets were allowed or blocked by the network devices, and how much traffic a system received in a give time period. ◾ System events: System events are an important part of the audit trail as they provide a clear understanding of the system activity. These can include report- ing when files are deleted, changed, or added, when software is installed, or when privileges are changed. System logs can also help determine if a worm or virus is present through evidence of unexpected activity on the system. In addition, any changes to the configuration of a system should be reported. If the organization has a strong change management process those change events should correspond to changes approved through that process. If they do not, that may be an indication of unauthorized activity on the system. ◾ Application events: Application events encompass a broad range of possibilities for monitoring activity. Many of these are dependent on the specific services offered by an application. For example, it may be possible to determine if a Web server is being attacked through evidence of URL manipulation in the Web server logs. Given the diversity of applications and possible attributes of each that can be audited and logged, the objective is to audit activities that help isolate key functions to at least gain an initial perspective of applica- tion activity. The person reviewing application logs will need to have a deep understanding of each application and the potential problems that may show up in the logs. If an organization builds its own applications it might be pos- sible to have the development team build specific security-oriented log entries into the application. ◾ User actions: User event logs are an extremely important resource needed to understand the user activity and behavior in a system. User activity lies at the© 2010 by Taylor and Francis Group, LLC
  • 109. 82 ◾ Official (ISC)2 Guide to the CISSP CBK heart of almost all system events, so understanding what a user on a system has done is essential to reconstructing events during an incident investiga- tion. Information such as log-on and log-off times, use of privileged access, applications executed, and data files accessed are some of the essential basics of user monitoring. ◾ Keystroke activity: Logging the keystrokes a user enters on a system can be extraordinarily helpful in investigating suspicious activity, as it provides a clear record of all information typed into the computer, including IDs and passwords, system commands, and application data. However, keystroke logging can also be controversial in some environments and employees may become upset at what they perceive to be an invasion of their privacy (even if company policy allows it).A lot of information about user activities can also be found from command historyfiles found on some operating systems. Although not technically keystroke logging,these files will give a running account of the commands a user entered into the sys-tem. On UNIX systems, these files are found in the user’s $HOME directory andwill have names like “.history,” “.sh_history,” or “.bash_history.”Vulnerability Assessment: When seeking to determine the security position ofan organization, the security professional will eventually turn to a vulnerabilityassessment to help identify specific areas of weakness that need to be addressed.A vulnerability assessment is the use of various tools and analysis methodologiesto determine where a particular system or process may be susceptible to attackor misuse. Most vulnerability assessments concentrate on technical vulnerabilitiesin systems or applications, but the assessment process is equally as effective whenexamining nontechnical business processes. To begin the vulnerability process the security analyst must have a good under-standing of the system or application to be assessed. While it is possible to simply runan automated tool against the target system to produce a list of potential problems,understanding first what the system does and its relationship to the overall businessprocess will assist the analyst in determining the overall risk of any discovered vul-nerabilities. In addition, the security analyst must have a good understanding of theknown and potential threats to the system as specifically identified by the business orby the analyst’s general knowledge of the security landscape. A vulnerability in theabsence of a validated threat will rate lower on the criticality scale when compared toa vulnerability that has a known threat poised to strike against it. Threat and vulnerability information can come from many sources. The firstplace to begin is by discussing the system with the appropriate business ownersand other interested stakeholders. They are the closest to both the system and thebusiness landscape the system operates in, and will have a good understanding ofsecurity issues they have had previously or similar problems that competitors orothers in the industry may have faced. In addition, including appropriate business© 2010 by Taylor and Francis Group, LLC
  • 110. Access Control ◾ 83stakeholders in the vulnerability assessment process will build a better sense ofpartnership between the business group and the security team. Once the businessaspect of the system has been addressed, the analyst can turn to various sources ofsecurity industry information, including known vulnerability databases (like theCVE database, published vendor vulnerability information,and security mailing lists. If the analyst is using one or more automated tools, thosetools will include many known vulnerabilities as part of their internal scanningdatabase. The next step is to examine the existing controls in place to protect the systemor process. This includes any directive, preventative, deterrent, and detective con-trols that are in place in the organization. These controls may be specific to thesystem or business function or may be part of the organization’s general controlenvironment, such as security policies and standards, firewalls, antivirus systems,intrusion detection/prevention systems, and available authentication and accesscontrols. The analyst will then match these existing controls against the knownthreats previously identified to determine if the existing control systems counteractthe identified threats. Whatever gaps remain after this analysis will need to beaddressed. In most situations, the security analyst will turn to the use of a variety of auto-mated tools to assist in the vulnerability assessment process. These tools containextensive databases of specific known vulnerabilities as well as the ability to analyzesystem and network configuration information to predict where a particular systemmight be vulnerable to different types of attacks. There are many different types oftools currently available to address a wide variety of vulnerability assessment needs.Some tools will examine a system from the viewpoint of the network, seeking todetermine if a system can be compromised by a remote attacker exploiting availableservices on a particular host system. These tools will test for open ports listeningfor connections, known vulnerabilities in common services, and known operatingsystem exploits. These tools will also often attempt to determine if a system has thelatest security patches in place. Other tools will examine individual applicationsto determine if they are susceptible to application exploits like buffer overflow,improper input handling, database manipulation attacks, or common Web-basedvulnerabilities. Because the vulnerability landscape is constantly evolving as newexploits are discovered and others are patched, the security manager must establisha process to ensure that any scanning tools used for vulnerability analysis are keptup to date so as to always have the latest information against which to test. Once the vulnerability scanning is complete the security analyst must examinethe results for accuracy. It is rare that the results from a scanning tool are com-pletely accurate. False positives are common because the tool may have incorrectlyidentified a target system or incorrectly analyzed the result data from the probesit performed. In addition, the analyst must match the scan results against whatis already known about the business function of the system being analyzed. Forexample, many testing tools will report the use of the anonymous FTP service as© 2010 by Taylor and Francis Group, LLC
  • 111. 84 ◾ Official (ISC)2 Guide to the CISSP CBKa vulnerability, as this can be seen as a potential security problem. However, if thesystem in question is being officially operated as an anonymous FTP server for theorganization, that result, although correct, would not be considered a vulnerabilityto the organization. The security analyst must combine the information gatheredduring the discussions with the business areas with the information obtained fromthe scanning tools to make a final analysis of the actual vulnerabilities that mustbe addressed by the organization. It is also common to rate those vulnerabilities onsome type of criticality scale (high/medium/low or 1–5 ratings are common) to givethe organization a sense of the level of concern and immediacy to place on eachparticular finding. Many organizations will also establish time limits for remedia-tion actions—shorter time limits for more critical vulnerabilities and longer onesfor less critical problems. Once the final analysis is complete the analyst should discuss the findings withthe business area to determine the appropriate course of remediation action to take.The actions should be based on the criticality of each reported vulnerability, thecost to remediate, the potential compensating controls that can be enacted, andthe impact the remediation will have on the system and the business function thatthe system serves. In some circumstances the business group may elect to accept therisk of continued operation with the known vulnerability due to the cost of cor-rective measures or other business considerations. No matter what the resolutionis, the security analyst should ensure that all concerned understand—and agreeto—the remediation plan. Assuming that an application or system group will alwaysaddress all items in the report in a timely manner is a mistake. The system groupwill have a multitude of projects and deadlines they need to address, of which thevulnerability report is but one. The security analyst should continuously follow upwith the system group to ensure they are addressing the vulnerabilities as agreed. Vulnerability analysis is an important part of the security management process,and one that many organizations do not address consistently or effectively. It is akey component in the risk management process and, if performed effectively, candramatically reduce the organization’s overall risk and susceptibility to current, andfuture, security problems.Penetration Testing: The next level in vulnerability assessments seeks to exploitexisting vulnerabilities to determine the true nature and impact of a given vulnera-bility. Penetration testing goes by many names, such as ethical hacking, tiger teaming,and vulnerability testing. It is the use of exploitive techniques to determine the levelof risk associated with a vulnerability or collection of vulnerabilities in an applica-tion or system. The primary goal of penetration testing is to simulate an attack ona system or network to evaluate the risk profile of an environment. This includesunderstanding the level of skill required, the time needed to exploit a given vulner-ability, and the level of impact, such as depth of access and attainable privileges. Penetration testing can be employed against any system or service. However,because of the time, expense, and resources required to properly execute a penetration© 2010 by Taylor and Francis Group, LLC
  • 112. Access Control ◾ 85test, most companies seek penetration testing to focus on Internet systems and ser-vices, remote-access solutions, and critical applications. The key to successful and valuable penetration testing is clearly defined objec-tives, scope, stated goals, agreed-upon limitations, and acceptable activities. Forexample, it may be acceptable to attack an FTP server, but not to the point wherethe system is rendered useless or data are damaged. Having a clear framework andmanagement oversight during a test is essential to ensure that the test does not haveadverse effects on the target company and the most value is gained from the test. Penetration Test Strategies: Strategies for penetration testing, based on specificobjectives to be achieved, are a combination of the source of the test, how thecompany’s assets are targeted, and the information (or lack thereof) provided to thetester. One of the first steps in establishing the rules of engagement for a penetra-tion test is determining the amount of information to provide the tester about thetarget. No matter the scope or scale of a test, how information flows initially willset in motion other attributes of planning, ultimately defining factors by which thevalue of the test will be measured. Usually some form of information is provided bythe target, and only in the most extreme cases is absolutely no information offered.Some cannot be avoided, such as the name of the company, while others can be eas-ily kept from the testers without totally impeding the mechanics of the test. External testing refers to attacks on the organization’s network perimeter usingprocedures performed from outside the organization’s systems, for example, fromthe Internet. To conduct the test, the testing team begins by targeting the com-pany’s externally visible servers or devices, such as the domain name server (DNS),e-mail server, Web server, or firewall. Internal testing is performed from within the organization’s technology envi-ronment. The focus is to understand what could happen if the network perimeterwas successfully penetrated, or what an organization insider could do to penetratespecific information resources within the organization’s network. In a blind testing strategy, the testing team is provided with only limited infor-mation concerning the organization’s information systems configuration. The pen-etration testing team must use publicly available information (such as the companyWeb site, domain name registry, and Internet discussion boards) to gather informa-tion about the target and conduct its penetration tests. Blind testing can provideinformation about the organization that may have been otherwise unknown, butit can also be more time-consuming and expensive than other types of penetrationtesting (such as targeted testing) because of the effort required by the penetrationtesting team to research the target. However, in blind testing the “attackers” (thetest team) have little or no knowledge about the target company but the “defend-ers” (the company’s IT and security teams) know the attack is coming and areprepared to defend against it. Double-blind testing presents a more real-life attack scenario because the orga-nization’s IT and security teams are not notified or informed before the test andare “blind” to the planned testing activities. In addition to testing the strength© 2010 by Taylor and Francis Group, LLC
  • 113. 86 ◾ Official (ISC)2 Guide to the CISSP CBKof a network or application, double-blind testing can test the organization’s secu-rity monitoring and incident identification, escalation, and response procedures.In double-blind testing engagements, very few people within the organization aremade aware of the testing, perhaps only the project sponsor, and double-blind test-ing requires careful monitoring by the project sponsor to ensure that the testingprocedures and the organization’s incident response procedures can be terminatedwhen the objectives of the test have been achieved or the test threatens to affectproduction systems or networks. In a targeted testing environment (often referred to as the “ lights on” approach)both the organization’s IT team and the penetration testing team are made awareof the testing activities and are provided with information concerning the targetand the network design. A targeted testing approach may be more efficient andcost-effective when the objective of the test is focused more on the technical setting,or on the design of the network, than on the organization’s incident response andother operational procedures. A targeted test typically takes less time and effort tocomplete than blind testing, but may not provide as complete a picture of an orga-nization’s security vulnerabilities and response capabilities. There are three basic categories of penetration test separated by how much infor-mation is provided to the tester or test team: zero knowledge, partial knowledge,and full knowledge. In zero knowledge testing the tester is provided no informationabout the target’s network or environment. The tester is simply left to his abilitiesto discover information about the company and use it to gain some form of access.This is also called black box or closed testing, depending on who is scoping thetest. Zero knowledge testing is particularly appropriate when executing a test fromoutside the organization, as this is the position most attackers will be in when theystart to attack an organization. In a partial knowledge test scenario, the tester is provided with some knowledgeabout the environment. The information provided is high-level public (or near-pubic) information that would be trivial for a real attacker to find without mucheffort, including phone numbers and IP addresses to be tested, domain informa-tion, and application names. It is assumed that a competent attacker would beable to obtain this level of information rather quickly, so this information is givento the tester to speed up the testing process a bit. The interesting aspect of gettingsome information and not all is the assumption of scope. Organizations can uselimited information to define boundaries of the test, as opposed to simply providingall the initial data to support the test. For example, exposing the organization’s IPaddress range is an attempt to speed up the gathering of easily obtained informa-tion, while exposing the fact that the network has intrusion detection systems canshape the way the tester goes about performing the test. Full knowledge testing provides every possible piece of information about theenvironment to the tester. This type of test is typically employed when there isgreater focus on what can be done, as opposed to what can be discovered. Theassumption is that an attacker can easily discover what is in the environment and© 2010 by Taylor and Francis Group, LLC
  • 114. Access Control ◾ 87the test needs to focus on how much damage can be done with that informa-tion. This is particularly appropriate when testing for internal penetrations. In thatsituation, the tester is taking the role of an informed insider (e.g., an employee orcontractor) with existing inside knowledge of the environment, architecture, andinformation paths. The insider has all the knowledge he or she needs to find thetarget. The question the tester needs to answer is whether the target’s defenses willwithstand such an attack. The organization must determine the area of the organization or the serviceto be tested. This is important when defining the scope of the test, because it willdetermine the boundaries and limits of acceptable testing practices. More than onetarget may be defined for a test, but each must be well defined and clearly under-stood by all involved. Application Security Testing: The objective of application security testing is toevaluate the controls within an application and its information process flow. Topicsto be evaluated may include the application’s use of encryption to protect the con-fidentiality and integrity of information, the authentication of users, the integrityof the Internet user’s session with the host application, and the management ofthe current processing state between parts of the application. Application testingwill test the flow of information through the application and its susceptibility tointerception or alteration. It will also test how the application handles input dataand determine if user input can harm or crash the application. Finally, applicationtesting will test for a wide range of common (as well as some uncommon) attackscenarios to gauge the level of resistance an application has to attacks of varyinglevels of sophistication. Denial-of-Service (DoS) Testing: The goal of DoS testing is to evaluate the sys-tem’s susceptibility to attacks that will render it inoperable or unable to provideneeded services to the organization or external users. Decisions regarding the extentof DoS testing to be incorporated into a penetration testing exercise will dependon the relative importance of ongoing, continued availability of the informationsystems and related processing activities. When deciding to perform DoS testing,it is critical to ensure that these tests are not performed on live production sys-tems unless that is a specific objective of the test and all system and informationowners know about, and approve, this course of action. The potential for systemdisruption beyond a simple crash is very high with DoS testing, potentially leadingto extended down time, angry customers, or lost revenue. In addition, make surethat everyone knows that a DoS test is being performed so that nobody (includingsystem owners, users, and help desk staff ) is caught unaware. Because DoS testingpresents such a risk to systems, many testers will perform the attack steps leadingup to the DoS but stop short of actually crashing the system. This saves a great dealof response and recovery time while still exposing a potentially risky situation onthe system. War Dialing: War dialing is a technique for systematically calling a range oftelephone numbers in an attempt to identify modems, remote-access devices, and© 2010 by Taylor and Francis Group, LLC
  • 115. 88 ◾ Official (ISC)2 Guide to the CISSP CBKmaintenance connections for computers that may exist within an organization’s net-work. Well-meaning users can inadvertently expose the organization to significantvulnerability by connecting a modem to the organization’s information systems ornetwork devices. Once a modem or other access device has been identified, analysisand exploitation techniques are performed to assess whether this connection can beused to penetrate the organization’s information systems network. In the Internetage, it may be difficult to understand that modems are still a primary source ofnetwork connectivity for many purposes, but they are still out there and there areplenty of them, very often connected to administrative ports on equipment for useby system administrators for emergency access, maintenance, or recovery purposes.Organizations would be wise not to underestimate their reach into the infrastruc-ture or their potential for creating vulnerabilities in the environment. Wireless Network Testing: The introduction of wireless networks, whetherthrough formal, approved network architecture or the inadvertent actions of well-meaning users, creates additional security exposures. Sometimes referred to as wardriving, attackers have become proficient in identifying wireless network accesspoints within an organization simply by driving by, or walking around, officebuildings with their wireless network equipment. The goal of wireless network test-ing is to identify security gaps or flaws in the design, implementation, or operationof the organization’s wireless network. War driving also provides an advantage toattackers, who may be able to access and penetrate a network through the wirelessconnection even though they are not on the property of the organization they arebreaking in to. Some security experts have likened the existence of a wireless on acorporate network to the equivalent of having a live network jack in the parking lotof the company. Social Engineering: Often used in conjunction with blind and double-blind test-ing, social engineering refers to techniques using social interaction, typically withthe organization’s employees, suppliers, and contractors, to gather enough informa-tion to be able to penetrate the organization’s physical premises or systems. Suchtechniques could include posing as a representative of the IT department’s help deskand asking users to divulge their user account and password information, posingas an employee and gaining physical access to restricted areas that may house sensi-tive information, or intercepting mail, courier packages, or even searching throughtrash for sensitive information on printed materials (also known as dumpster div-ing). Social engineering activities can test a less technical, but equally important,security component: the ability of the organization’s people to contribute to (orprevent) unauthorized access to information and information systems. PBX and IP Telephony Testing: Beyond war dialing, phone systems (traditional“POTS” service, corporate ISDN, and new IP-based telephone services) have tra-ditionally been a highly vulnerable, yet often overlooked, method of gaining accessto corporate resources. Attackers can gain access to voice mail systems to gatherinformation and monitor activity. Moreover, phone systems can be manipulatedto permit an attacker to make long-distance calls free and undetected, potentially© 2010 by Taylor and Francis Group, LLC
  • 116. Access Control ◾ 89furthering an attack on other organizations. It is also not uncommon for securityservices to leave secret information (e.g., passwords and account information) onvoice mail systems, relying on the authentication mechanisms of the voice mailservice to provide protection. If an attacker compromises the voice mail service allthat information can be lost. IP telephony, or voice-over-IP (VoIP), is the use of traditional Internet protocol(IP) data networks to handle voice traffic. It can also include the integration ofphone systems with network applications, databases, and other services, such ase-mail or workflow collaboration systems. While IP telephony systems share manyof the same security vulnerabilities as traditional phone services, their integra-tion with the IP protocol gives them an additional susceptibility to network-levelattacks. Tests can be performed against these technologies to gain a better under-standing of the risks the organization may face when combining voice and data ona single network, or whether a DoS attack on the data network would also renderthe VoIP system inoperable. The potential threat profile represented by combiningthe threats associated with IP networks and those of telephone systems is one anyorganization should take seriously.Penetration Test Methodology: A methodology is an established collection of pro-cesses that are performed in a predetermined order to ensure the job, function, or, inthis case, security test is accurately executed. There are many ways of performing apenetration test, perhaps as many as there are testers. However, there is a basic andlogical methodology that has become best practice for performing such tests: 1. Reconnaissance/discovery: Identify and document information about the target. 2. Enumeration: Gain more information with intrusive methods. 3. Vulnerability analysis: Map the environment profile to known vulnerabilities. 4. Execution: Attempt to gain user and privileged access. 5. Document findings: Document the results of the testStep 1—Reconnaissance: As is the case with most military and espionage campaigns,penetration tests typically begin with a reconnaissance phase. Reconnaissance is thesearch for any available information on the target to assist in planning or executingthe test. The search can include quick ping sweeps to see what IP addresses on a net-work will respond, scouring news groups on the Internet in search of disgruntledemployees divulging useful information, or rummaging through the trash to findinside information on the business or the technical environment (also known asdumpster diving.) The ultimate goal of the reconnaissance phase is to gather as muchinformation on the target as possible. This may include physical and virtual lay-outs, building and network topography, organizational strengths and weaknesses,operational patterns, technology in use, and practically anything else the tester maythink will be useful in the coming attack. Reconnaissance can also include theft,© 2010 by Taylor and Francis Group, LLC
  • 117. 90 ◾ Official (ISC)2 Guide to the CISSP CBKlying to people, monitoring networks, impersonations, or even leveraging falsifiedfriendships to collect data about a target. The search for information is only limitedby the extremes to which a company and the tester are willing to go. The rule ofthumb in the reconnaissance phase is that no piece of information is too small tobe useful.Step 2—Enumeration: Also known as network or vulnerability discovery, enumera-tion is the process of obtaining information directly from the target systems, appli-cations, and networks. An interesting point to understand is that the enumerationphase represents a point within the penetration testing project where the linebetween a passive attack and an active attack begins to blur. At this point the testeris not just gathering information any more; he or she is sending network probesor otherwise communicating with systems and network devices in order to gathermore information. Some of these devices may be fragile or susceptible to even theslightest nudge from the tester. When setting up the test parameters, the enumera-tion phase should be thoroughly reviewed with the operations, support, and secu-rity teams to ensure there are no surprise alerts generated as a result of the test. To build an accurate picture of a company’s environment, there are several toolsand techniques available to compile a list of information obtained from the systems.Most notably, port scanning is the most common and easily executed basic testto start with. A port scan is the manipulation of the basic communication setupbetween two networked systems to determine what services are being offered onthe target system. Collecting information about available systems and services isthe first step in formulating an attack plan. From here, the tester can build on theinformation found during the reconnaissance phase and define a path to attemptto compromise the system.Step 3—Vulnerability Analysis: The information gathered by the reconnaissance andenumeration phases will yield a great deal of valuable information about the targetenvironment. The next step is to analyze that data to determine potential vulner-abilities that may be exploited to successfully attack the target. This calls for a logi-cal and pragmatic approach to analyzing data. During the enumeration phase, thetester performs an interpretation of the information collected (or provided), look-ing for relationships between systems, networks, and applications that may leadto exposures that can be exploited. The vuln