Security Incidents

Building an Enterprise IT Security Management System Belsis A. Meletis Information Security Consultant MPhil / MSc / BSc CWNA/CWSP, C|EH, CCSA, Network+, ISO27001LA

Information Enterprises
Enterprises base their correct operation almost solely on Information. To maximise the efficient handling of information, they use complex IS/IT infrastructures.
These infrastructures can be localised or be intergalactic, allowing users to access them locally or remotely.
New technologies like mobile devices and PDAs enhance the complexity of these even further.

Information Security for enterprises
Security threats targeting these infrastructures can be internal or external.
Adversaries use a number of techniques to attack corporate information for fun and profit
Examples of such include computer viruses, Denial of Services attacks, buffer overflows and social engineering

Security Architectures
To provide adequate security for the modern enterprise, security architectures need to be deployed.
These include security technologies, tools and policies that interoperate to provide “total” security.
These must work transparently from the rest of the system and be able to follow the enterprise's culture and future changes.

Managing Security Architectures
T here are a number of security products that allow experts to provide central management over large security architectures.
Unfortunately the models behind these products fail to interoperate with the existent enterprise models.
Most of these products handle only specific parts of the enterprise security architecture. An example of this is the enterprise security history which is a vital part of any modern security infrastructure but most current products do not incorporate it in their models.

Our Proposal
We propose the use of a new enterprise model. The Enterprise IT Security Data Model.
The new model will be used as the base for the development of an ESM software package.
The new model differs from existing ones in that it includes the description of the totality of an enterprise security architecture, including the enterprise’s security history.
The proposed model includes clear links to the rest enterprise modelling frameworks, to allow interoperability with the rest enterprise business products. To succeeded in this the new development follows the Zachman framework.

Proposed Model
The main entities of the model are :
Departmental Structure
Employee Infrastructure
Information Infrastructure
IT infrastructure
physical security
IT Security
Risks
Security Policy
Security History

Recording Incident History
The incident history model has been decomposed and tested.
The incident history was selected due to the fact the current ESM products neglect this important part of security.
An earlier version of the incident model was presented at the IFIP/Secc 2002 in Cairo.

Deploying the ESM system.
The implementation follow s the logical and physical distribution that an enterprise follows.
CORBA has been extensively proposed for accessing distributed data models.
CORBA will bring to the system the required transparency, efficiency and security
The system incorporates an NLIDB server. The server will allow for the easy execution of smart queries

Deploying the ESM system
Using CORBA security specialist can access and manage the system, throughout a web based interface or using specific clients that are integrated into the management console.
The CORBA’s Security Service can provide adequate security for the purpose of this system.
CORBA’s architecture allows security expert to change specific security processes without affecting the rest of the system.
The inclusion of an NLIDB server allows experts to execute smart queries on the security architecture using plain English language.

Conclusions
This research aims in the development of a new ESM product.
The new product will differ substantially from the existent ones in that it manages the totality of the security architecture and by providing clear links with the rest of the enterprises models.
Until not the base for the development of this product has been developed. Some work has also been done in the way the product will be deployed.

Thank You

Security Incidents

by belsis

Accessibility

Categories

Upload Details

Usage Rights

3 Embeds 8

Statistics

Security Incidents Presentation Transcript

http://www.linkedin.com	4
http://www.slideshare.net	3
http://www.lmodules.com	1