SlideShare a Scribd company logo
1 of 60
TransformingLives. InventingtheFuture. www.iit.edu
I ELLINOIS T UINS TI T
OF TECHNOLOGY
ITM 578 1
Security Policy
Ray Trygstad
ITM 478/578
Spring 2004
Master of Information Technology & Management Program
CenterforProfessional Development
Slides based on Whitman, M. and Mattord, H., Principles of InformationSecurity; Thomson Course Technology 2003
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 2
ILLINOIS INSTITUTE OF TECHNOLOGY
Learning Objectives
Upon completion of this lesson the
student should be able to:
– Understand management’s responsibilities and
role in the development, maintenance, and
enforcement of information security policy,
standards, practices, procedures, and guidelines
– Understand the differences between the
organization’s general information security policy
and the requirements and objectives of the various
issue-specific and system-specific policies
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 3
ILLINOIS INSTITUTE OF TECHNOLOGY
Learning Objectives
Upon completion of this lesson the
student should be able to:
– Recall what an information security blueprint is
and what its major components are
– Describe how an organization institutionalizes its
policies, standards, and practices using education,
training, and awareness programs
– Discuss what viable information security
architecture is, what it includes, and how it is
used
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 4
ILLINOIS INSTITUTE OF TECHNOLOGY
Information Security Policy, Standards, and Practices
 Management from all communities of
interest must consider policies as the basis
for all information security efforts
 Policies direct how issues should be
addressed and technologies used
 Security policies are the least expensive
control to execute, but the most difficult to
implement
 Shaping policy is difficult because policies
must:
– Never conflict with laws
– Stand up in court, if challenged
– Be properly administered
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 5
ILLINOIS INSTITUTE OF TECHNOLOGY
Definitions
 A policy is
A plan or course of action, as of a government,
political party, or business, intended to influence
and determine decisions, actions, and other
matters
 Policies are organizational laws
 Standards are more detailed statements of what
must be done to comply with policy
 Practices, procedures, and guidelines effectively
explain how to comply with policy
 For a policy to be effective it must be
– Properly disseminated
– Read, understood and agreed to by all to whom it applies
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 6
ILLINOIS INSTITUTE OF TECHNOLOGY
Types of Policy
Management defines three types of
security policy:
– General or security program policy
– Issue-specific security policies
– Systems-specific security policies
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 7
ILLINOIS INSTITUTE OF TECHNOLOGY
Policies Standards & Practices
Policies are sanctioned byPolicies are sanctioned by
senior managementsenior management
Standards are built on soundStandards are built on sound
policy and carry the weightpolicy and carry the weight
of policyof policy
PoliciesPolicies
StandardsStandards
Practices, guidelines, andPractices, guidelines, and
procedures include detailedprocedures include detailed
steps required to meet thesteps required to meet the
requirements of standardsrequirements of standards PracticesPractices GuidelinesGuidelines ProceduresProcedures
DRIDRI
VEVE
DRIDRI
VEVE
FIGURE 6-1 Policies, Standards and Practices
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 8
ILLINOIS INSTITUTE OF TECHNOLOGY
Security Program Policy
 Security program policy (SPP) also known as
– A general security policy
– IT security policy
– Information security policy
 Sets strategic direction, scope, and tone for
all security efforts within the organization
 An executive-level document
– Usually drafted by or with the CIO of the
organization
– Usually 2 to 10 pages long
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 9
ILLINOIS INSTITUTE OF TECHNOLOGY
Issue-Specific Security Policy (ISSP)
 As various technologies and processes are
implemented, certain guidelines are needed
to use them properly
 The ISSP:
– addresses specific areas of technology
– requires frequent updates
– contains an issue statement on the organization’s
position on an issue
 Three approaches:
– Create a number of independent ISSP documents
– Create a single comprehensive ISSP document
– Create a modular ISSP document
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 10
ILLINOIS INSTITUTE OF TECHNOLOGY
Example ISSP Structure
1. Statement of Policy
2. Authorized Access and Usage of
Equipment
3. Prohibited Usage of Equipment
4. Systems Management
5. Violations of Policy
6. Policy Review and Modification
7. Limitations of Liability
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 11
ILLINOIS INSTITUTE OF TECHNOLOGY
Telecommunications Use Policy
Considerations for an Effective Telecommunications Use PolicyConsiderations for an Effective Telecommunications Use Policy
1.1. Statement of policyStatement of policy
a. Scope and applicabilitya. Scope and applicability
b. Definition of technology addressesb. Definition of technology addresses
c. Responsibilitiesc. Responsibilities
2.2. Authorized access and usage of equipmentAuthorized access and usage of equipment
a. User accessa. User access
b. Fair and responsible useb. Fair and responsible use
c. Protection of privacyc. Protection of privacy
3.3. Prohibited usage of equipmentProhibited usage of equipment
a. Disruptive use or misusea. Disruptive use or misuse
b. Criminal useb. Criminal use
c. Offensive or harassing materialsc. Offensive or harassing materials
d. Copyrighted, licensed, or otherd. Copyrighted, licensed, or other
intellectual propertyintellectual property
e. Other restrictionse. Other restrictions
4.4. Systems managementSystems management
a. Management of stored materialsa. Management of stored materials
b. Employer monitoringb. Employer monitoring
c. Virus protectionc. Virus protection
d. Physical securityd. Physical security
e. Encryptione. Encryption
5.5. Violations of policyViolations of policy
a. Procedures for reporting violationsa. Procedures for reporting violations
b. Penalties for violationsb. Penalties for violations
6.6. Policy review and modificationPolicy review and modification
a. Scheduled review of policy anda. Scheduled review of policy and
procedures for modificationprocedures for modification
7.7. Limitations of liabilityLimitations of liability
a. Statements of liability or disclaimersa. Statements of liability or disclaimers
@2003 ACM, Inc., Included here by permission.@2003 ACM, Inc., Included here by permission.
FIGURE 6-2 Example of an Issue Specific Policy Statement‑
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 12
ILLINOIS INSTITUTE OF TECHNOLOGY
Systems-Specific Policy (SysSP)
 While issue-specific policies are formalized as
written documents, distributed to users and
agreed to in writing, SysSPs are normally
codified as standards and procedures used
when configuring or maintaining systems
 Systems-specific policies fall into two groups:
– Access control lists (ACLs) consist of the access
control lists, matrices, and capability tables
governing the rights and privileges of a particular
user to a particular system
– Configuration rules comprise the specific
configuration codes entered into security systems
to guide the execution of the system
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 13
ILLINOIS INSTITUTE OF TECHNOLOGY
ACL Policies
 Both Microsoft Windows servers and Novell
Netware translate ACLs into sets of
configurations that administrators use to
control access to their respective systems
 ACLs allow configuration to restrict access
from anyone and anywhere
 ACLs regulate:
– Who can use the system
– What authorized users can access
– When authorized users can access the system
– Where authorized users can access the system
from
– How authorized users can access the system
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 14
ILLINOIS INSTITUTE OF TECHNOLOGY
Novell Configuration Screens
FIGURE 6-3 Novell Configuration Screens
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 15
ILLINOIS INSTITUTE OF TECHNOLOGY
Windows 2000 Configuration Screens
FIGURE 6-3 Windows 2000 Configuration Screens
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 16
ILLINOIS INSTITUTE OF TECHNOLOGY
Rule Policies
Rule policies are more specific to the
operation of a system than ACLs
Many security systems require
specific configuration scripts telling
the systems what actions to perform
on each set of information they
process
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 17
ILLINOIS INSTITUTE OF TECHNOLOGY
FIGURE 6-5 Checkpoint VPN-1/Firewall-1 Policy Editor
VPN-1/Firewall-1 Policy Editor courtesy of Check Point Software Technologies Ltd.
Firewall Policy Editor
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 18
ILLINOIS INSTITUTE OF TECHNOLOGY
Policy Management
 Policies are living documents that must be
managed and nurtured, and are constantly
changing and growing
– Documents must be properly managed
 Special considerations should be made for
organizations undergoing mergers, takeovers,
and partnerships
 In order to remain viable, policies must have:
– an individual responsible for reviews
– a schedule of reviews
– a method for making recommendations for
reviews
– a specific effective and revision date
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 19
ILLINOIS INSTITUTE OF TECHNOLOGY
Information Classification
 Classification of information is an important
aspect of policy
 Same protection scheme created to prevent
production data from accidental release to
the wrong party should be applied to policies
in order to keep them freely available, but
only within the organization
 In today’s open office environments, it may
be beneficial to implement a clean desk
policy
 A clean desk policy stipulates that at the end
of the business day, all classified information
must be properly stored and secured
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 20
ILLINOIS INSTITUTE OF TECHNOLOGY
Clean Desk Policy?
FIGURE 6-7 Michael Whitman’s Desk
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 21
ILLINOIS INSTITUTE OF TECHNOLOGY
Systems Design
 At this point in the Security SDLC, the
analysis phase is complete and the design
phase begins – many work products have
been created
 Designing a plan for security begins by
creating or validating a security blueprint
 Use the blueprint to plan the tasks to be
accomplished and the order in which to
proceed
 Setting priorities can follow the
recommendations of published sources, or
from published standards provided by
government agencies or private consultants
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 22
ILLINOIS INSTITUTE OF TECHNOLOGY
Investigate
Design
planning for continuity
Chapter 7
Maintain
Analyze
Implement
Design
blueprint for security
Chapter 6
SecSDLC Methodology
SecSDLC MethodologyFIGURE 6-8
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 23
ILLINOIS INSTITUTE OF TECHNOLOGY
Information Security Blueprints
 One approach: adapt/adopt a published
model or framework for information security
 Framework
– Basic skeletal structure within which additional
detailed planning of the blueprint can be placed
as it is developed and refined
 Experience teaches us that what works well
for one organization may not precisely fit
another
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 24
ILLINOIS INSTITUTE OF TECHNOLOGY
ISO 17799/BS 7799
 Information Technology – Code of Practice for
Information Security Management
– One of the most widely referenced and often
discussed security models
– Originally published as British Standard BS 7799
 Adopted in 2000 as international standard
ISO/IEC 17799 by the International
Organization for Standardization (ISO) and
the International Electrotechnical
Commission (IEC) as a framework for
information security
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 25
ILLINOIS INSTITUTE OF TECHNOLOGY
Major Process Steps
See the textbook
page 210
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 26
ILLINOIS INSTITUTE OF TECHNOLOGY
ISO 17799 / BS 7799
 Several countries have not adopted 17799
claiming there are fundamental problems:
– “The global information security community has
not defined any justification for a code of practice
as identified in the ISO/IEC 17799”
– 17799 lacks “the necessary measurement precision
of a technical standard”
– There is no reason to believe that 17799 is more
useful than any other approach currently available
– 17799 is not as complete as other frameworks
available
– 17799 is perceived to have been hurriedly prepared
given the tremendous impact its adoption could
have on industry information security controls
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 27
ILLINOIS INSTITUTE OF TECHNOLOGY
ISO/IEC 17799
 Organizational Security Policy is needed to
provide management direction and support
 Objectives/content:
– Operational Security Policy
– Organizational Security Infrastructure
– Asset Classification and Control
– Personnel Security
– Physical and Environmental Security
– Communications and Operations Management
– System Access Control
– System Development and Maintenance
– Business Continuity Planning
– Compliance
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 28
ILLINOIS INSTITUTE OF TECHNOLOGY
NIST Security Models
 Another approach available is described in
the many documents available from the
Computer Security Resource Center of the
National Institute for Standards and
Technology (csrc.nist.gov) – including:
– NIST SP 800-12 - The Computer Security
Handbook
– NIST SP 800-14 - Generally Accepted Principles
and Practices for Securing IT Systems
– NIST SP 800-18 - Guide for Developing Security
Plans for Information Technology Systems
 These are among the references cited by the
government of the U.S. when deciding not to
select the ISO/IEC 17799 standards
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 29
ILLINOIS INSTITUTE OF TECHNOLOGY
NIST SP 800-14
 Security Supports the Mission of the Organization
 Security is an Integral Element of Sound
Management
 Security Should Be Cost-Effective
 Systems Owners Have Security Responsibilities
Outside Their Own Organizations
 Security Responsibilities and Accountability Should
Be Made Explicit
 Security Requires a Comprehensive and Integrated
Approach
 Security Should Be Periodically Reassessed
 Security is Constrained by Societal Factors
 33 Principles enumerated
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 30
ILLINOIS INSTITUTE OF TECHNOLOGY
NIST SP 800-14 Principles for Securing IT Systems
1. Establish a sound security policy as the
“foundation” for design.
2. Treat security as an integral part of the
overall system design.
3. Clearly delineate the physical and logical
security boundaries governed by associated
security policies.
4. Reduce risk to an acceptable level.
5. Assume that external systems are insecure.
6. Identify potential trade-offs between
reducing risk and increased costs and
decrease in other aspects of operational
effectiveness.
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 31
ILLINOIS INSTITUTE OF TECHNOLOGY
NIST SP 800-14 Principles for Securing IT Systems
7. Implement layered security (Ensure no single point
of vulnerability).
8. Implement tailored system security measures to
meet organizational security goals.
9. Strive for simplicity.
10.Design and operate an IT system to limit
vulnerability and to be resilient in response.
11.Minimize the system elements to be trusted.
12.Implement security through a combination of
measures distributed physically and logically.
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 32
ILLINOIS INSTITUTE OF TECHNOLOGY
NIST SP 800-14 Principles for Securing IT Systems
13. Provide assurance that the system is, and
continues to be, resilient in the face of expected
threats.
14. Limit or contain vulnerabilities.
15. Formulate security measures to address multiple
overlapping information domains.
16. Isolate public access systems from mission critical
resources (e.g., data, processes, etc.).
17. Use boundary mechanisms to separate computing
systems and network infrastructures.
18. Where possible, base security on open standards
for portability and interoperability.
19. Use common language in developing security
requirements.
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 33
ILLINOIS INSTITUTE OF TECHNOLOGY
NIST SP 800-14 Principles for Securing IT Systems
20. Design and implement audit mechanisms to detect
unauthorized use and to support incident
investigations.
21. Design security to allow for regular adoption of new
technology, including a secure and logical
technology upgrade process.
22. Authenticate users and processes to ensure
appropriate access control decisions both within
and across domains.
23. Use unique identities to ensure accountability.
24. Implement least privilege.
25. Do not implement unnecessary security
mechanisms.
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 34
ILLINOIS INSTITUTE OF TECHNOLOGY
NIST SP 800-14 Principles for Securing IT Systems
26. Protect information while being processed, in
transit, and in storage.
27. Strive for operational ease of use.
28. Develop and exercise contingency or disaster
recovery procedures to ensure appropriate
availability.
29. Consider custom products to achieve adequate
security.
30. Ensure proper security in the shutdown or
disposal of a system.
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 35
ILLINOIS INSTITUTE OF TECHNOLOGY
NIST SP 800-14 Principles for Securing IT Systems
31. Protect against all likely classes of
“attacks.”
32. Identify and prevent common errors and
vulnerabilities.
33. Ensure that developers are trained in
how to develop secure software.
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 36
ILLINOIS INSTITUTE OF TECHNOLOGY
ISO/IEC Standard Versus NIST
Major difference:
– ISO/IEC 17799 must be purchased before
use
– NIST standards were paid for by the
American taxpayer and are provided
free of charge
U.S. Federal Government does not
support ISO/IEC 17799 or view it as
adequate for its purpose
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 37
ILLINOIS INSTITUTE OF TECHNOLOGY
IETF Security Architecture
 The Security Area Working Group acts as
an advisory board for the protocols and
areas developed and promoted through the
Internet Society
– No specific architecture is promoted through
IETF
 RFC 2196: Site Security Handbook provides
an overview of five basic areas of security
 Topics include:
– security policies
– security technical architecture
– security services
– security incident handling
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 38
ILLINOIS INSTITUTE OF TECHNOLOGY
VISA Model
 VISA International promotes strong security
measures and has security guidelines
 Developed two important documents that
improve and regulate its information systems
– “Security Assessment Process”
– “Agreed Upon Procedures”
 Using the two documents, a security team
can develop a sound strategy for the design of
good security architecture
 The only down side to this approach is the
very specific focus on systems that can or do
integrate with VISA’s systems
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 39
ILLINOIS INSTITUTE OF TECHNOLOGY
Baselining and Best Practices
 Baselining and best practices are solid
methods for collecting security practices, but
they can have the drawback of providing less
detail than would a complete methodology
 It is possible to gain information by
baselining and using best practices and thus
work backwards to an effective design
 The Federal Agency Security Practices Site (
csrc.nist.gov/fasp/) is designed to provide
best practices for public agencies
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 40
ILLINOIS INSTITUTE OF TECHNOLOGY
Professional Membership
 Probably worth an information security
professional’s time and money to join
professional societies with information on
best practices for its members
 Many organizations have seminars and
classes on best practices for implementing
security
 Finding information on security design is the
easy part, sorting through the collected mass
of information, documents, and publications
can take a substantial investment in time
and human resources
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 41
ILLINOIS INSTITUTE OF TECHNOLOGY
NIST SP 800-26
Management Controls
– Risk Management
– Review of Security Controls
– Life Cycle Maintenance
– Authorization of Processing (Certification and Accreditation)
– System Security Plan
Operational Controls
– Personnel Security
– Physical Security
– Production, Input/Output Controls
– Contingency Planning
– Hardware and Systems Software
– Data Integrity
– Documentation
– Security Awareness, Training, and Education
– Incident Response Capability
Technical Controls
– Identification and Authentication
– Logical Access Controls
– Audit Trails
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 42
ILLINOIS INSTITUTE OF TECHNOLOGY
Spheres of Security
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 43
ILLINOIS INSTITUTE OF TECHNOLOGY
Sphere of Use
 Generally speaking, the concept of the sphere is to
represent the 360 degrees of security necessary to
protect information at all times
 The first component is the “sphere of use”
 Information, at the core of the sphere, is available
for access by members of the organization and other
computer-based systems:
– To gain access to the computer systems, one must either
directly access the computer systems or go through a
network connection
– To gain access to the network, one must either directly
access the network or go through an Internet connection
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 44
ILLINOIS INSTITUTE OF TECHNOLOGY
Sphere of Protection
 The “sphere of protection” overlays each of
the levels of the “sphere of use” with a layer
of security, protecting that layer from direct
or indirect use through the next layer
 The people must become a layer of security, a
human firewall that protects the information
from unauthorized access and use
 Information security is therefore designed
and implemented in three layers
– policies
– people (education, training, and awareness
programs)
– technology
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 45
ILLINOIS INSTITUTE OF TECHNOLOGY
Controls
 Management controls cover security
processes that functionality of security in the
organization
 Operational controls are designed by the
strategic planners and performed by security
administration of the organization
 Operational controls deal with the
operational also address personnel security,
physical security, and the protection of
production inputs and outputs
 Technical controls address those tactical and
technical issues related to designing and
implementing security in the organization
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 46
ILLINOIS INSTITUTE OF TECHNOLOGY
The Framework
 Management Controls
– Program Management
– System Security Plan
– Life Cycle Maintenance
– Risk Management
– Review of Security
Controls
– Legal Compliance
 Operational Controls
– Contingency Planning
– Security ETA
– Personnel Security
– Physical Security
– Production Inputs and
Outputs
– Hardware & Software
Systems Maintenance
– Data Integrity
 Technical Controls
– Logical Access Controls
– Identification,
Authentication,
Authorization, and
Accountability
– Audit Trails
– Asset Classification and
Control
– Cryptography
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 47
ILLINOIS INSTITUTE OF TECHNOLOGY
SETA
 As soon as the policies exist, policies to
implement security education, training, and
awareness (SETA) should follow
 SETA is a control measure designed to
reduce accidental security breaches
 Supplement the general education and
training programs in place to educate staff
on information security
 Security education and training builds on
the general knowledge the employees must
possess to do their jobs, familiarizing them
with the way to do their jobs securely
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 48
ILLINOIS INSTITUTE OF TECHNOLOGY
SETA Elements
The SETA program consists of three
elements
– security education
– security training
– security awareness
The organization may not be capable or
willing to undertake all three of these
elements but may outsource them
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 49
ILLINOIS INSTITUTE OF TECHNOLOGY
Purpose of SETA
The purpose of SETA is to enhance
security by:
– Improving awareness of the need to
protect system resources
– Developing skills and knowledge so
computer users can perform their jobs
more securely
– Building in-depth knowledge, as needed,
to design, implement, or operate
security programs for organizations and
systems
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 50
ILLINOIS INSTITUTE OF TECHNOLOGY
Comparative Framework of SETA
Education Training Awareness
AttributeAttribute WhyWhy HowHow WhatWhat
LevelLevel InsightInsight KnowledgeKnowledge InformationInformation
ObjectiveObjective UnderstandingUnderstanding SkillSkill
Teaching methodTeaching method Theoretical instructionTheoretical instruction
•• Discussion seminarDiscussion seminar
•• Background readingBackground reading
Practical instructionPractical instruction
•• LectureLecture
•• Case study workshopCase study workshop
•• Hands on practice‑Hands on practice‑
MediaMedia
•• VideosVideos
•• NewslettersNewsletters
•• PostersPosters
•• True or falseTrue or false
Test measureTest measure EssayEssay
(interpret learning)(interpret learning)
Problem solvingProblem solving
(apply learning)(apply learning)
Multiple choiceMultiple choice
(identify learning)(identify learning)
Impact timeframeImpact timeframe Long term‑Long term‑ IntermediateIntermediate Short term‑Short term‑
TABLE 6-1 Comparative Framework of SETA: NIST SP800 12‑
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 51
ILLINOIS INSTITUTE OF TECHNOLOGY
Security Education
 Everyone in an organization needs to be
trained and aware of information security,
but not every member of the organization
needs a formal degree or certificate in
information security
 When formal education for appropriate
individuals in security is needed an employee
can identify curriculum available from local
institutions of higher learning or continuing
education
 A number of universities have formal
coursework in information security
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 52
ILLINOIS INSTITUTE OF TECHNOLOGY
Security Training
Security training involves providing
members of the organization with
detailed information and hands-on
instruction designed to prepare them
to perform their duties securely
Management of information security
can develop customized in-house
training or outsource the training
program
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 53
ILLINOIS INSTITUTE OF TECHNOLOGY
Security Awareness
 One of the least frequently implemented, but
the most beneficial programs is the security
awareness program
 Designed to keep information security at the
forefront of the users’ minds
 Need not be complicated or expensive
 If the program is not actively implemented,
employees begin to ‘tune out’, and the risk of
employee accidents and failures increases
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 54
ILLINOIS INSTITUTE OF TECHNOLOGY
InfoSec Awareness at KSU
InfoSec Awareness at KSU
FIGURE 6-17
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 55
ILLINOIS INSTITUTE OF TECHNOLOGY
Comments
 Defense in Depth
– One of the foundations of security architectures is
the requirement to implement security in layers
– Defense in depth requires that the organization
establish sufficient security controls and
safeguards, so that an intruder faces multiple
layers of controls
 Security Perimeter
– The point at which an organization’s security
protection ends, and the outside world begins
– Referred to as the security perimeter
– Unfortunately the perimeter does not apply to
internal attacks from employee threats, or on-site
physical threats
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 56
ILLINOIS INSTITUTE OF TECHNOLOGY
Defense in Depth
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 57
ILLINOIS INSTITUTE OF TECHNOLOGY
Security Perimeters & Domains
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 58
ILLINOIS INSTITUTE OF TECHNOLOGY
Key Technology Components
 Other key technology components
– A firewall is a device that selectively
discriminates against information flowing into
or out of the organization
– The DMZ (demilitarized zone) is a no-man’s
land, between the inside and outside networks,
where some organizations place Web servers
– In an effort to detect unauthorized activity
within the inner network, or on individual
machines, an organization may wish to
implement Intrusion Detection Systems or IDS
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 59
ILLINOIS INSTITUTE OF TECHNOLOGY
Firewalls, Proxies & DMZ
Transfo rm ing Live s. Inve nting the Future .
www.iit.edu
ITM 578 60
ILLINOIS INSTITUTE OF TECHNOLOGY
The End…
Questions?

More Related Content

What's hot

Information security
Information securityInformation security
Information securityLJ PROJECTS
 
Cybersecurity trends - What to expect in 2023
Cybersecurity trends - What to expect in 2023Cybersecurity trends - What to expect in 2023
Cybersecurity trends - What to expect in 2023PECB
 
Intrusion detection and prevention system
Intrusion detection and prevention systemIntrusion detection and prevention system
Intrusion detection and prevention systemNikhil Raj
 
Introduction to Information Security
Introduction to Information SecurityIntroduction to Information Security
Introduction to Information SecurityDr. Loganathan R
 
Vulnerability Management
Vulnerability ManagementVulnerability Management
Vulnerability Managementasherad
 
Build an Information Security Strategy
Build an Information Security StrategyBuild an Information Security Strategy
Build an Information Security StrategyAndrew Byers
 
Employee Security Awareness Training
Employee Security Awareness TrainingEmployee Security Awareness Training
Employee Security Awareness TrainingDenis kisina
 
Security management concepts and principles
Security management concepts and principlesSecurity management concepts and principles
Security management concepts and principlesDivya Tiwari
 
Endpoint Protection
Endpoint ProtectionEndpoint Protection
Endpoint ProtectionSophos
 
chapter 1. Introduction to Information Security
chapter 1. Introduction to Information Security chapter 1. Introduction to Information Security
chapter 1. Introduction to Information Security elmuhammadmuhammad
 
Cybersecurity roadmap : Global healthcare security architecture
Cybersecurity roadmap : Global healthcare security architectureCybersecurity roadmap : Global healthcare security architecture
Cybersecurity roadmap : Global healthcare security architecturePriyanka Aash
 
IT Security DOs and DON'Ts
IT Security DOs and DON'Ts IT Security DOs and DON'Ts
IT Security DOs and DON'Ts Sophos
 
PPT-Security-for-Management.pptx
PPT-Security-for-Management.pptxPPT-Security-for-Management.pptx
PPT-Security-for-Management.pptxRSAArcher
 
Legal, Ethical and professional issues in Information Security
Legal, Ethical and professional issues in Information SecurityLegal, Ethical and professional issues in Information Security
Legal, Ethical and professional issues in Information SecurityGamentortc
 
12 security policies
12 security policies12 security policies
12 security policiesSaqib Raza
 
Improve Cybersecurity posture by using ISO/IEC 27032
Improve Cybersecurity posture by using ISO/IEC 27032Improve Cybersecurity posture by using ISO/IEC 27032
Improve Cybersecurity posture by using ISO/IEC 27032PECB
 

What's hot (20)

Information security
Information securityInformation security
Information security
 
Cybersecurity trends - What to expect in 2023
Cybersecurity trends - What to expect in 2023Cybersecurity trends - What to expect in 2023
Cybersecurity trends - What to expect in 2023
 
Intrusion detection and prevention system
Intrusion detection and prevention systemIntrusion detection and prevention system
Intrusion detection and prevention system
 
Introduction to Information Security
Introduction to Information SecurityIntroduction to Information Security
Introduction to Information Security
 
Vulnerability Management
Vulnerability ManagementVulnerability Management
Vulnerability Management
 
Build an Information Security Strategy
Build an Information Security StrategyBuild an Information Security Strategy
Build an Information Security Strategy
 
Employee Security Awareness Training
Employee Security Awareness TrainingEmployee Security Awareness Training
Employee Security Awareness Training
 
Information Security
Information SecurityInformation Security
Information Security
 
Information security
Information securityInformation security
Information security
 
Security management concepts and principles
Security management concepts and principlesSecurity management concepts and principles
Security management concepts and principles
 
Security policies
Security policiesSecurity policies
Security policies
 
Endpoint Protection
Endpoint ProtectionEndpoint Protection
Endpoint Protection
 
chapter 1. Introduction to Information Security
chapter 1. Introduction to Information Security chapter 1. Introduction to Information Security
chapter 1. Introduction to Information Security
 
Cybersecurity Roadmap Development for Executives
Cybersecurity Roadmap Development for ExecutivesCybersecurity Roadmap Development for Executives
Cybersecurity Roadmap Development for Executives
 
Cybersecurity roadmap : Global healthcare security architecture
Cybersecurity roadmap : Global healthcare security architectureCybersecurity roadmap : Global healthcare security architecture
Cybersecurity roadmap : Global healthcare security architecture
 
IT Security DOs and DON'Ts
IT Security DOs and DON'Ts IT Security DOs and DON'Ts
IT Security DOs and DON'Ts
 
PPT-Security-for-Management.pptx
PPT-Security-for-Management.pptxPPT-Security-for-Management.pptx
PPT-Security-for-Management.pptx
 
Legal, Ethical and professional issues in Information Security
Legal, Ethical and professional issues in Information SecurityLegal, Ethical and professional issues in Information Security
Legal, Ethical and professional issues in Information Security
 
12 security policies
12 security policies12 security policies
12 security policies
 
Improve Cybersecurity posture by using ISO/IEC 27032
Improve Cybersecurity posture by using ISO/IEC 27032Improve Cybersecurity posture by using ISO/IEC 27032
Improve Cybersecurity posture by using ISO/IEC 27032
 

Viewers also liked

Cyber crime and issues
Cyber crime and issuesCyber crime and issues
Cyber crime and issuesRoshan Mastana
 
Security Policies and Standards
Security Policies and StandardsSecurity Policies and Standards
Security Policies and Standardsprimeteacher32
 
Importance Of A Security Policy
Importance Of A Security PolicyImportance Of A Security Policy
Importance Of A Security Policycharlesgarrett
 
Computer Ethics and Legal Issues
Computer Ethics and Legal IssuesComputer Ethics and Legal Issues
Computer Ethics and Legal IssuesKak Yong
 

Viewers also liked (6)

Cyber crime and issues
Cyber crime and issuesCyber crime and issues
Cyber crime and issues
 
Security Policies and Standards
Security Policies and StandardsSecurity Policies and Standards
Security Policies and Standards
 
Importance Of A Security Policy
Importance Of A Security PolicyImportance Of A Security Policy
Importance Of A Security Policy
 
6 Physical Security
6 Physical Security6 Physical Security
6 Physical Security
 
Computer Ethics and Legal Issues
Computer Ethics and Legal IssuesComputer Ethics and Legal Issues
Computer Ethics and Legal Issues
 
Risk Analysis
Risk AnalysisRisk Analysis
Risk Analysis
 

Similar to Security policy

Information security as an ongoing effort
Information security as an ongoing effortInformation security as an ongoing effort
Information security as an ongoing effortDhani Ahmad
 
Start With A Great Information Security Plan!
Start With A Great Information Security Plan!Start With A Great Information Security Plan!
Start With A Great Information Security Plan!Tammy Clark
 
Ise viii-information and network security [10 is835]-solution
Ise viii-information and network  security [10 is835]-solutionIse viii-information and network  security [10 is835]-solution
Ise viii-information and network security [10 is835]-solutionVivek Maurya
 
Risk management i
Risk management iRisk management i
Risk management iDhani Ahmad
 
E’s Data Security Company Strategic Security Plan – 2015.docx
E’s Data Security Company Strategic Security Plan – 2015.docxE’s Data Security Company Strategic Security Plan – 2015.docx
E’s Data Security Company Strategic Security Plan – 2015.docxmydrynan
 
D1 security and risk management v1.62
D1 security and risk management  v1.62D1 security and risk management  v1.62
D1 security and risk management v1.62AlliedConSapCourses
 
Solve the exercise in security management.pdf
Solve the exercise in security management.pdfSolve the exercise in security management.pdf
Solve the exercise in security management.pdfsdfghj21
 
Security policy and standards
Security policy and standardsSecurity policy and standards
Security policy and standardsWilson Musyoka
 
Operationaland Organizational SecurityChapter 3Princ.docx
Operationaland Organizational SecurityChapter 3Princ.docxOperationaland Organizational SecurityChapter 3Princ.docx
Operationaland Organizational SecurityChapter 3Princ.docxamit657720
 
Operationaland Organizational SecurityChapter 3Princ.docx
Operationaland Organizational SecurityChapter 3Princ.docxOperationaland Organizational SecurityChapter 3Princ.docx
Operationaland Organizational SecurityChapter 3Princ.docxmccormicknadine86
 
Ce hv6 module 49 creating security policies
Ce hv6 module 49 creating security policiesCe hv6 module 49 creating security policies
Ce hv6 module 49 creating security policiesVi Tính Hoàng Nam
 
Automatski - The Internet of Things - Security Standards
Automatski - The Internet of Things - Security StandardsAutomatski - The Internet of Things - Security Standards
Automatski - The Internet of Things - Security Standardsautomatskicorporation
 
A to Z of Information Security Management
A to Z of Information Security ManagementA to Z of Information Security Management
A to Z of Information Security ManagementMark Conway
 

Similar to Security policy (20)

Information security as an ongoing effort
Information security as an ongoing effortInformation security as an ongoing effort
Information security as an ongoing effort
 
Start With A Great Information Security Plan!
Start With A Great Information Security Plan!Start With A Great Information Security Plan!
Start With A Great Information Security Plan!
 
Ch.5 rq (1)
Ch.5 rq (1)Ch.5 rq (1)
Ch.5 rq (1)
 
Ise viii-information and network security [10 is835]-solution
Ise viii-information and network  security [10 is835]-solutionIse viii-information and network  security [10 is835]-solution
Ise viii-information and network security [10 is835]-solution
 
Risk management i
Risk management iRisk management i
Risk management i
 
E’s Data Security Company Strategic Security Plan – 2015.docx
E’s Data Security Company Strategic Security Plan – 2015.docxE’s Data Security Company Strategic Security Plan – 2015.docx
E’s Data Security Company Strategic Security Plan – 2015.docx
 
D1 security and risk management v1.62
D1 security and risk management  v1.62D1 security and risk management  v1.62
D1 security and risk management v1.62
 
Topic11
Topic11Topic11
Topic11
 
5757912.ppt
5757912.ppt5757912.ppt
5757912.ppt
 
Solve the exercise in security management.pdf
Solve the exercise in security management.pdfSolve the exercise in security management.pdf
Solve the exercise in security management.pdf
 
Chapter 5
Chapter 5Chapter 5
Chapter 5
 
File000169
File000169File000169
File000169
 
Khas bank isms 3 s
Khas bank isms 3 sKhas bank isms 3 s
Khas bank isms 3 s
 
Pindad iso27000 2016 smki
Pindad   iso27000 2016 smkiPindad   iso27000 2016 smki
Pindad iso27000 2016 smki
 
Security policy and standards
Security policy and standardsSecurity policy and standards
Security policy and standards
 
Operationaland Organizational SecurityChapter 3Princ.docx
Operationaland Organizational SecurityChapter 3Princ.docxOperationaland Organizational SecurityChapter 3Princ.docx
Operationaland Organizational SecurityChapter 3Princ.docx
 
Operationaland Organizational SecurityChapter 3Princ.docx
Operationaland Organizational SecurityChapter 3Princ.docxOperationaland Organizational SecurityChapter 3Princ.docx
Operationaland Organizational SecurityChapter 3Princ.docx
 
Ce hv6 module 49 creating security policies
Ce hv6 module 49 creating security policiesCe hv6 module 49 creating security policies
Ce hv6 module 49 creating security policies
 
Automatski - The Internet of Things - Security Standards
Automatski - The Internet of Things - Security StandardsAutomatski - The Internet of Things - Security Standards
Automatski - The Internet of Things - Security Standards
 
A to Z of Information Security Management
A to Z of Information Security ManagementA to Z of Information Security Management
A to Z of Information Security Management
 

More from Dhani Ahmad

Strategic planning
Strategic planningStrategic planning
Strategic planningDhani Ahmad
 
Strategic information system planning
Strategic information system planningStrategic information system planning
Strategic information system planningDhani Ahmad
 
Opportunities, threats, industry competition, and competitor analysis
Opportunities, threats, industry competition, and competitor analysisOpportunities, threats, industry competition, and competitor analysis
Opportunities, threats, industry competition, and competitor analysisDhani Ahmad
 
Information system
Information systemInformation system
Information systemDhani Ahmad
 
Information resource management
Information resource managementInformation resource management
Information resource managementDhani Ahmad
 
Types of islamic institutions and records
Types of islamic institutions and recordsTypes of islamic institutions and records
Types of islamic institutions and recordsDhani Ahmad
 
Islamic information seeking behavior
Islamic information seeking behaviorIslamic information seeking behavior
Islamic information seeking behaviorDhani Ahmad
 
Islamic information management
Islamic information managementIslamic information management
Islamic information managementDhani Ahmad
 
Islamic information management sources in islam
Islamic information management sources in islamIslamic information management sources in islam
Islamic information management sources in islamDhani Ahmad
 
Security technologies
Security technologiesSecurity technologies
Security technologiesDhani Ahmad
 
Security and personnel
Security and personnelSecurity and personnel
Security and personnelDhani Ahmad
 
Risk management ii
Risk management iiRisk management ii
Risk management iiDhani Ahmad
 
Privacy & security in heath care it
Privacy & security in heath care itPrivacy & security in heath care it
Privacy & security in heath care itDhani Ahmad
 
Physical security
Physical securityPhysical security
Physical securityDhani Ahmad
 
Legal, ethical & professional issues
Legal, ethical & professional issuesLegal, ethical & professional issues
Legal, ethical & professional issuesDhani Ahmad
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information securityDhani Ahmad
 
Implementing security
Implementing securityImplementing security
Implementing securityDhani Ahmad
 
Disaster recovery & business continuity
Disaster recovery & business continuityDisaster recovery & business continuity
Disaster recovery & business continuityDhani Ahmad
 
Chapter2 the need to security
Chapter2 the need to securityChapter2 the need to security
Chapter2 the need to securityDhani Ahmad
 

More from Dhani Ahmad (20)

Strategic planning
Strategic planningStrategic planning
Strategic planning
 
Strategic information system planning
Strategic information system planningStrategic information system planning
Strategic information system planning
 
Opportunities, threats, industry competition, and competitor analysis
Opportunities, threats, industry competition, and competitor analysisOpportunities, threats, industry competition, and competitor analysis
Opportunities, threats, industry competition, and competitor analysis
 
Information system
Information systemInformation system
Information system
 
Information resource management
Information resource managementInformation resource management
Information resource management
 
Types of islamic institutions and records
Types of islamic institutions and recordsTypes of islamic institutions and records
Types of islamic institutions and records
 
Islamic information seeking behavior
Islamic information seeking behaviorIslamic information seeking behavior
Islamic information seeking behavior
 
Islamic information management
Islamic information managementIslamic information management
Islamic information management
 
Islamic information management sources in islam
Islamic information management sources in islamIslamic information management sources in islam
Islamic information management sources in islam
 
Security technologies
Security technologiesSecurity technologies
Security technologies
 
Security and personnel
Security and personnelSecurity and personnel
Security and personnel
 
Secure
SecureSecure
Secure
 
Risk management ii
Risk management iiRisk management ii
Risk management ii
 
Privacy & security in heath care it
Privacy & security in heath care itPrivacy & security in heath care it
Privacy & security in heath care it
 
Physical security
Physical securityPhysical security
Physical security
 
Legal, ethical & professional issues
Legal, ethical & professional issuesLegal, ethical & professional issues
Legal, ethical & professional issues
 
Introduction to information security
Introduction to information securityIntroduction to information security
Introduction to information security
 
Implementing security
Implementing securityImplementing security
Implementing security
 
Disaster recovery & business continuity
Disaster recovery & business continuityDisaster recovery & business continuity
Disaster recovery & business continuity
 
Chapter2 the need to security
Chapter2 the need to securityChapter2 the need to security
Chapter2 the need to security
 

Recently uploaded

一比一原版(Bath毕业证书)英国桑德兰大学毕业证如何办理
一比一原版(Bath毕业证书)英国桑德兰大学毕业证如何办理一比一原版(Bath毕业证书)英国桑德兰大学毕业证如何办理
一比一原版(Bath毕业证书)英国桑德兰大学毕业证如何办理B
 
iThome_CYBERSEC2024_Drive_Into_the_DarkWeb
iThome_CYBERSEC2024_Drive_Into_the_DarkWebiThome_CYBERSEC2024_Drive_Into_the_DarkWeb
iThome_CYBERSEC2024_Drive_Into_the_DarkWebJie Liau
 
Free on Wednesdays T Shirts Free on Wednesdays Sweatshirts
Free on Wednesdays T Shirts Free on Wednesdays SweatshirtsFree on Wednesdays T Shirts Free on Wednesdays Sweatshirts
Free on Wednesdays T Shirts Free on Wednesdays Sweatshirtsrahman018755
 
一比一原版(TRU毕业证书)温哥华社区学院毕业证如何办理
一比一原版(TRU毕业证书)温哥华社区学院毕业证如何办理一比一原版(TRU毕业证书)温哥华社区学院毕业证如何办理
一比一原版(TRU毕业证书)温哥华社区学院毕业证如何办理Fir
 
🍑👄Dehradun Esℂorts Serviℂe☎️9315791090🍑👄 ℂall Girl serviℂe in ☎️Dehradun ℂall...
🍑👄Dehradun Esℂorts Serviℂe☎️9315791090🍑👄 ℂall Girl serviℂe in ☎️Dehradun ℂall...🍑👄Dehradun Esℂorts Serviℂe☎️9315791090🍑👄 ℂall Girl serviℂe in ☎️Dehradun ℂall...
🍑👄Dehradun Esℂorts Serviℂe☎️9315791090🍑👄 ℂall Girl serviℂe in ☎️Dehradun ℂall...Mumbai Escorts
 
一比一原版英国格林多大学毕业证如何办理
一比一原版英国格林多大学毕业证如何办理一比一原版英国格林多大学毕业证如何办理
一比一原版英国格林多大学毕业证如何办理AS
 
一比一定制加州大学欧文分校毕业证学位证书
一比一定制加州大学欧文分校毕业证学位证书一比一定制加州大学欧文分校毕业证学位证书
一比一定制加州大学欧文分校毕业证学位证书A
 
Production 2024 sunderland culture final - Copy.pptx
Production 2024 sunderland culture final - Copy.pptxProduction 2024 sunderland culture final - Copy.pptx
Production 2024 sunderland culture final - Copy.pptxChloeMeadows1
 
一比一原版(UWE毕业证书)西英格兰大学毕业证原件一模一样
一比一原版(UWE毕业证书)西英格兰大学毕业证原件一模一样一比一原版(UWE毕业证书)西英格兰大学毕业证原件一模一样
一比一原版(UWE毕业证书)西英格兰大学毕业证原件一模一样Fi
 
一比一定制波士顿学院毕业证学位证书
一比一定制波士顿学院毕业证学位证书一比一定制波士顿学院毕业证学位证书
一比一定制波士顿学院毕业证学位证书A
 
一比一原版(Exon毕业证书)英国埃克塞特大学毕业证如何办理
一比一原版(Exon毕业证书)英国埃克塞特大学毕业证如何办理一比一原版(Exon毕业证书)英国埃克塞特大学毕业证如何办理
一比一原版(Exon毕业证书)英国埃克塞特大学毕业证如何办理gfhdsfr
 
The Rise of Subscription-Based Digital Services.pdf
The Rise of Subscription-Based Digital Services.pdfThe Rise of Subscription-Based Digital Services.pdf
The Rise of Subscription-Based Digital Services.pdfe-Market Hub
 
一比一原版(Soton毕业证书)南安普顿大学毕业证原件一模一样
一比一原版(Soton毕业证书)南安普顿大学毕业证原件一模一样一比一原版(Soton毕业证书)南安普顿大学毕业证原件一模一样
一比一原版(Soton毕业证书)南安普顿大学毕业证原件一模一样Fi
 
100^%)( POLOKWANE))(*((+27838792658))*))௹ )Abortion Pills for Sale in Sibasa,...
100^%)( POLOKWANE))(*((+27838792658))*))௹ )Abortion Pills for Sale in Sibasa,...100^%)( POLOKWANE))(*((+27838792658))*))௹ )Abortion Pills for Sale in Sibasa,...
100^%)( POLOKWANE))(*((+27838792658))*))௹ )Abortion Pills for Sale in Sibasa,...musaddumba454
 
原版定制(爱大毕业证书)英国爱丁堡大学毕业证原件一模一样
原版定制(爱大毕业证书)英国爱丁堡大学毕业证原件一模一样原版定制(爱大毕业证书)英国爱丁堡大学毕业证原件一模一样
原版定制(爱大毕业证书)英国爱丁堡大学毕业证原件一模一样gfhdsfr
 
I’ll See Y’All Motherfuckers In Game 7 Shirt
I’ll See Y’All Motherfuckers In Game 7 ShirtI’ll See Y’All Motherfuckers In Game 7 Shirt
I’ll See Y’All Motherfuckers In Game 7 Shirtrahman018755
 
Free scottie t shirts Free scottie t shirts
Free scottie t shirts Free scottie t shirtsFree scottie t shirts Free scottie t shirts
Free scottie t shirts Free scottie t shirtsrahman018755
 
原版定制美国加州大学河滨分校毕业证原件一模一样
原版定制美国加州大学河滨分校毕业证原件一模一样原版定制美国加州大学河滨分校毕业证原件一模一样
原版定制美国加州大学河滨分校毕业证原件一模一样A
 
Thank You Luv I’ll Never Walk Alone Again T shirts
Thank You Luv I’ll Never Walk Alone Again T shirtsThank You Luv I’ll Never Walk Alone Again T shirts
Thank You Luv I’ll Never Walk Alone Again T shirtsrahman018755
 

Recently uploaded (20)

一比一原版(Bath毕业证书)英国桑德兰大学毕业证如何办理
一比一原版(Bath毕业证书)英国桑德兰大学毕业证如何办理一比一原版(Bath毕业证书)英国桑德兰大学毕业证如何办理
一比一原版(Bath毕业证书)英国桑德兰大学毕业证如何办理
 
iThome_CYBERSEC2024_Drive_Into_the_DarkWeb
iThome_CYBERSEC2024_Drive_Into_the_DarkWebiThome_CYBERSEC2024_Drive_Into_the_DarkWeb
iThome_CYBERSEC2024_Drive_Into_the_DarkWeb
 
Free on Wednesdays T Shirts Free on Wednesdays Sweatshirts
Free on Wednesdays T Shirts Free on Wednesdays SweatshirtsFree on Wednesdays T Shirts Free on Wednesdays Sweatshirts
Free on Wednesdays T Shirts Free on Wednesdays Sweatshirts
 
一比一原版(TRU毕业证书)温哥华社区学院毕业证如何办理
一比一原版(TRU毕业证书)温哥华社区学院毕业证如何办理一比一原版(TRU毕业证书)温哥华社区学院毕业证如何办理
一比一原版(TRU毕业证书)温哥华社区学院毕业证如何办理
 
GOOGLE Io 2024 At takes center stage.pdf
GOOGLE Io 2024 At takes center stage.pdfGOOGLE Io 2024 At takes center stage.pdf
GOOGLE Io 2024 At takes center stage.pdf
 
🍑👄Dehradun Esℂorts Serviℂe☎️9315791090🍑👄 ℂall Girl serviℂe in ☎️Dehradun ℂall...
🍑👄Dehradun Esℂorts Serviℂe☎️9315791090🍑👄 ℂall Girl serviℂe in ☎️Dehradun ℂall...🍑👄Dehradun Esℂorts Serviℂe☎️9315791090🍑👄 ℂall Girl serviℂe in ☎️Dehradun ℂall...
🍑👄Dehradun Esℂorts Serviℂe☎️9315791090🍑👄 ℂall Girl serviℂe in ☎️Dehradun ℂall...
 
一比一原版英国格林多大学毕业证如何办理
一比一原版英国格林多大学毕业证如何办理一比一原版英国格林多大学毕业证如何办理
一比一原版英国格林多大学毕业证如何办理
 
一比一定制加州大学欧文分校毕业证学位证书
一比一定制加州大学欧文分校毕业证学位证书一比一定制加州大学欧文分校毕业证学位证书
一比一定制加州大学欧文分校毕业证学位证书
 
Production 2024 sunderland culture final - Copy.pptx
Production 2024 sunderland culture final - Copy.pptxProduction 2024 sunderland culture final - Copy.pptx
Production 2024 sunderland culture final - Copy.pptx
 
一比一原版(UWE毕业证书)西英格兰大学毕业证原件一模一样
一比一原版(UWE毕业证书)西英格兰大学毕业证原件一模一样一比一原版(UWE毕业证书)西英格兰大学毕业证原件一模一样
一比一原版(UWE毕业证书)西英格兰大学毕业证原件一模一样
 
一比一定制波士顿学院毕业证学位证书
一比一定制波士顿学院毕业证学位证书一比一定制波士顿学院毕业证学位证书
一比一定制波士顿学院毕业证学位证书
 
一比一原版(Exon毕业证书)英国埃克塞特大学毕业证如何办理
一比一原版(Exon毕业证书)英国埃克塞特大学毕业证如何办理一比一原版(Exon毕业证书)英国埃克塞特大学毕业证如何办理
一比一原版(Exon毕业证书)英国埃克塞特大学毕业证如何办理
 
The Rise of Subscription-Based Digital Services.pdf
The Rise of Subscription-Based Digital Services.pdfThe Rise of Subscription-Based Digital Services.pdf
The Rise of Subscription-Based Digital Services.pdf
 
一比一原版(Soton毕业证书)南安普顿大学毕业证原件一模一样
一比一原版(Soton毕业证书)南安普顿大学毕业证原件一模一样一比一原版(Soton毕业证书)南安普顿大学毕业证原件一模一样
一比一原版(Soton毕业证书)南安普顿大学毕业证原件一模一样
 
100^%)( POLOKWANE))(*((+27838792658))*))௹ )Abortion Pills for Sale in Sibasa,...
100^%)( POLOKWANE))(*((+27838792658))*))௹ )Abortion Pills for Sale in Sibasa,...100^%)( POLOKWANE))(*((+27838792658))*))௹ )Abortion Pills for Sale in Sibasa,...
100^%)( POLOKWANE))(*((+27838792658))*))௹ )Abortion Pills for Sale in Sibasa,...
 
原版定制(爱大毕业证书)英国爱丁堡大学毕业证原件一模一样
原版定制(爱大毕业证书)英国爱丁堡大学毕业证原件一模一样原版定制(爱大毕业证书)英国爱丁堡大学毕业证原件一模一样
原版定制(爱大毕业证书)英国爱丁堡大学毕业证原件一模一样
 
I’ll See Y’All Motherfuckers In Game 7 Shirt
I’ll See Y’All Motherfuckers In Game 7 ShirtI’ll See Y’All Motherfuckers In Game 7 Shirt
I’ll See Y’All Motherfuckers In Game 7 Shirt
 
Free scottie t shirts Free scottie t shirts
Free scottie t shirts Free scottie t shirtsFree scottie t shirts Free scottie t shirts
Free scottie t shirts Free scottie t shirts
 
原版定制美国加州大学河滨分校毕业证原件一模一样
原版定制美国加州大学河滨分校毕业证原件一模一样原版定制美国加州大学河滨分校毕业证原件一模一样
原版定制美国加州大学河滨分校毕业证原件一模一样
 
Thank You Luv I’ll Never Walk Alone Again T shirts
Thank You Luv I’ll Never Walk Alone Again T shirtsThank You Luv I’ll Never Walk Alone Again T shirts
Thank You Luv I’ll Never Walk Alone Again T shirts
 

Security policy

  • 1. TransformingLives. InventingtheFuture. www.iit.edu I ELLINOIS T UINS TI T OF TECHNOLOGY ITM 578 1 Security Policy Ray Trygstad ITM 478/578 Spring 2004 Master of Information Technology & Management Program CenterforProfessional Development Slides based on Whitman, M. and Mattord, H., Principles of InformationSecurity; Thomson Course Technology 2003
  • 2. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 2 ILLINOIS INSTITUTE OF TECHNOLOGY Learning Objectives Upon completion of this lesson the student should be able to: – Understand management’s responsibilities and role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines – Understand the differences between the organization’s general information security policy and the requirements and objectives of the various issue-specific and system-specific policies
  • 3. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 3 ILLINOIS INSTITUTE OF TECHNOLOGY Learning Objectives Upon completion of this lesson the student should be able to: – Recall what an information security blueprint is and what its major components are – Describe how an organization institutionalizes its policies, standards, and practices using education, training, and awareness programs – Discuss what viable information security architecture is, what it includes, and how it is used
  • 4. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 4 ILLINOIS INSTITUTE OF TECHNOLOGY Information Security Policy, Standards, and Practices  Management from all communities of interest must consider policies as the basis for all information security efforts  Policies direct how issues should be addressed and technologies used  Security policies are the least expensive control to execute, but the most difficult to implement  Shaping policy is difficult because policies must: – Never conflict with laws – Stand up in court, if challenged – Be properly administered
  • 5. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 5 ILLINOIS INSTITUTE OF TECHNOLOGY Definitions  A policy is A plan or course of action, as of a government, political party, or business, intended to influence and determine decisions, actions, and other matters  Policies are organizational laws  Standards are more detailed statements of what must be done to comply with policy  Practices, procedures, and guidelines effectively explain how to comply with policy  For a policy to be effective it must be – Properly disseminated – Read, understood and agreed to by all to whom it applies
  • 6. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 6 ILLINOIS INSTITUTE OF TECHNOLOGY Types of Policy Management defines three types of security policy: – General or security program policy – Issue-specific security policies – Systems-specific security policies
  • 7. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 7 ILLINOIS INSTITUTE OF TECHNOLOGY Policies Standards & Practices Policies are sanctioned byPolicies are sanctioned by senior managementsenior management Standards are built on soundStandards are built on sound policy and carry the weightpolicy and carry the weight of policyof policy PoliciesPolicies StandardsStandards Practices, guidelines, andPractices, guidelines, and procedures include detailedprocedures include detailed steps required to meet thesteps required to meet the requirements of standardsrequirements of standards PracticesPractices GuidelinesGuidelines ProceduresProcedures DRIDRI VEVE DRIDRI VEVE FIGURE 6-1 Policies, Standards and Practices
  • 8. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 8 ILLINOIS INSTITUTE OF TECHNOLOGY Security Program Policy  Security program policy (SPP) also known as – A general security policy – IT security policy – Information security policy  Sets strategic direction, scope, and tone for all security efforts within the organization  An executive-level document – Usually drafted by or with the CIO of the organization – Usually 2 to 10 pages long
  • 9. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 9 ILLINOIS INSTITUTE OF TECHNOLOGY Issue-Specific Security Policy (ISSP)  As various technologies and processes are implemented, certain guidelines are needed to use them properly  The ISSP: – addresses specific areas of technology – requires frequent updates – contains an issue statement on the organization’s position on an issue  Three approaches: – Create a number of independent ISSP documents – Create a single comprehensive ISSP document – Create a modular ISSP document
  • 10. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 10 ILLINOIS INSTITUTE OF TECHNOLOGY Example ISSP Structure 1. Statement of Policy 2. Authorized Access and Usage of Equipment 3. Prohibited Usage of Equipment 4. Systems Management 5. Violations of Policy 6. Policy Review and Modification 7. Limitations of Liability
  • 11. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 11 ILLINOIS INSTITUTE OF TECHNOLOGY Telecommunications Use Policy Considerations for an Effective Telecommunications Use PolicyConsiderations for an Effective Telecommunications Use Policy 1.1. Statement of policyStatement of policy a. Scope and applicabilitya. Scope and applicability b. Definition of technology addressesb. Definition of technology addresses c. Responsibilitiesc. Responsibilities 2.2. Authorized access and usage of equipmentAuthorized access and usage of equipment a. User accessa. User access b. Fair and responsible useb. Fair and responsible use c. Protection of privacyc. Protection of privacy 3.3. Prohibited usage of equipmentProhibited usage of equipment a. Disruptive use or misusea. Disruptive use or misuse b. Criminal useb. Criminal use c. Offensive or harassing materialsc. Offensive or harassing materials d. Copyrighted, licensed, or otherd. Copyrighted, licensed, or other intellectual propertyintellectual property e. Other restrictionse. Other restrictions 4.4. Systems managementSystems management a. Management of stored materialsa. Management of stored materials b. Employer monitoringb. Employer monitoring c. Virus protectionc. Virus protection d. Physical securityd. Physical security e. Encryptione. Encryption 5.5. Violations of policyViolations of policy a. Procedures for reporting violationsa. Procedures for reporting violations b. Penalties for violationsb. Penalties for violations 6.6. Policy review and modificationPolicy review and modification a. Scheduled review of policy anda. Scheduled review of policy and procedures for modificationprocedures for modification 7.7. Limitations of liabilityLimitations of liability a. Statements of liability or disclaimersa. Statements of liability or disclaimers @2003 ACM, Inc., Included here by permission.@2003 ACM, Inc., Included here by permission. FIGURE 6-2 Example of an Issue Specific Policy Statement‑
  • 12. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 12 ILLINOIS INSTITUTE OF TECHNOLOGY Systems-Specific Policy (SysSP)  While issue-specific policies are formalized as written documents, distributed to users and agreed to in writing, SysSPs are normally codified as standards and procedures used when configuring or maintaining systems  Systems-specific policies fall into two groups: – Access control lists (ACLs) consist of the access control lists, matrices, and capability tables governing the rights and privileges of a particular user to a particular system – Configuration rules comprise the specific configuration codes entered into security systems to guide the execution of the system
  • 13. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 13 ILLINOIS INSTITUTE OF TECHNOLOGY ACL Policies  Both Microsoft Windows servers and Novell Netware translate ACLs into sets of configurations that administrators use to control access to their respective systems  ACLs allow configuration to restrict access from anyone and anywhere  ACLs regulate: – Who can use the system – What authorized users can access – When authorized users can access the system – Where authorized users can access the system from – How authorized users can access the system
  • 14. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 14 ILLINOIS INSTITUTE OF TECHNOLOGY Novell Configuration Screens FIGURE 6-3 Novell Configuration Screens
  • 15. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 15 ILLINOIS INSTITUTE OF TECHNOLOGY Windows 2000 Configuration Screens FIGURE 6-3 Windows 2000 Configuration Screens
  • 16. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 16 ILLINOIS INSTITUTE OF TECHNOLOGY Rule Policies Rule policies are more specific to the operation of a system than ACLs Many security systems require specific configuration scripts telling the systems what actions to perform on each set of information they process
  • 17. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 17 ILLINOIS INSTITUTE OF TECHNOLOGY FIGURE 6-5 Checkpoint VPN-1/Firewall-1 Policy Editor VPN-1/Firewall-1 Policy Editor courtesy of Check Point Software Technologies Ltd. Firewall Policy Editor
  • 18. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 18 ILLINOIS INSTITUTE OF TECHNOLOGY Policy Management  Policies are living documents that must be managed and nurtured, and are constantly changing and growing – Documents must be properly managed  Special considerations should be made for organizations undergoing mergers, takeovers, and partnerships  In order to remain viable, policies must have: – an individual responsible for reviews – a schedule of reviews – a method for making recommendations for reviews – a specific effective and revision date
  • 19. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 19 ILLINOIS INSTITUTE OF TECHNOLOGY Information Classification  Classification of information is an important aspect of policy  Same protection scheme created to prevent production data from accidental release to the wrong party should be applied to policies in order to keep them freely available, but only within the organization  In today’s open office environments, it may be beneficial to implement a clean desk policy  A clean desk policy stipulates that at the end of the business day, all classified information must be properly stored and secured
  • 20. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 20 ILLINOIS INSTITUTE OF TECHNOLOGY Clean Desk Policy? FIGURE 6-7 Michael Whitman’s Desk
  • 21. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 21 ILLINOIS INSTITUTE OF TECHNOLOGY Systems Design  At this point in the Security SDLC, the analysis phase is complete and the design phase begins – many work products have been created  Designing a plan for security begins by creating or validating a security blueprint  Use the blueprint to plan the tasks to be accomplished and the order in which to proceed  Setting priorities can follow the recommendations of published sources, or from published standards provided by government agencies or private consultants
  • 22. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 22 ILLINOIS INSTITUTE OF TECHNOLOGY Investigate Design planning for continuity Chapter 7 Maintain Analyze Implement Design blueprint for security Chapter 6 SecSDLC Methodology SecSDLC MethodologyFIGURE 6-8
  • 23. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 23 ILLINOIS INSTITUTE OF TECHNOLOGY Information Security Blueprints  One approach: adapt/adopt a published model or framework for information security  Framework – Basic skeletal structure within which additional detailed planning of the blueprint can be placed as it is developed and refined  Experience teaches us that what works well for one organization may not precisely fit another
  • 24. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 24 ILLINOIS INSTITUTE OF TECHNOLOGY ISO 17799/BS 7799  Information Technology – Code of Practice for Information Security Management – One of the most widely referenced and often discussed security models – Originally published as British Standard BS 7799  Adopted in 2000 as international standard ISO/IEC 17799 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) as a framework for information security
  • 25. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 25 ILLINOIS INSTITUTE OF TECHNOLOGY Major Process Steps See the textbook page 210
  • 26. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 26 ILLINOIS INSTITUTE OF TECHNOLOGY ISO 17799 / BS 7799  Several countries have not adopted 17799 claiming there are fundamental problems: – “The global information security community has not defined any justification for a code of practice as identified in the ISO/IEC 17799” – 17799 lacks “the necessary measurement precision of a technical standard” – There is no reason to believe that 17799 is more useful than any other approach currently available – 17799 is not as complete as other frameworks available – 17799 is perceived to have been hurriedly prepared given the tremendous impact its adoption could have on industry information security controls
  • 27. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 27 ILLINOIS INSTITUTE OF TECHNOLOGY ISO/IEC 17799  Organizational Security Policy is needed to provide management direction and support  Objectives/content: – Operational Security Policy – Organizational Security Infrastructure – Asset Classification and Control – Personnel Security – Physical and Environmental Security – Communications and Operations Management – System Access Control – System Development and Maintenance – Business Continuity Planning – Compliance
  • 28. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 28 ILLINOIS INSTITUTE OF TECHNOLOGY NIST Security Models  Another approach available is described in the many documents available from the Computer Security Resource Center of the National Institute for Standards and Technology (csrc.nist.gov) – including: – NIST SP 800-12 - The Computer Security Handbook – NIST SP 800-14 - Generally Accepted Principles and Practices for Securing IT Systems – NIST SP 800-18 - Guide for Developing Security Plans for Information Technology Systems  These are among the references cited by the government of the U.S. when deciding not to select the ISO/IEC 17799 standards
  • 29. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 29 ILLINOIS INSTITUTE OF TECHNOLOGY NIST SP 800-14  Security Supports the Mission of the Organization  Security is an Integral Element of Sound Management  Security Should Be Cost-Effective  Systems Owners Have Security Responsibilities Outside Their Own Organizations  Security Responsibilities and Accountability Should Be Made Explicit  Security Requires a Comprehensive and Integrated Approach  Security Should Be Periodically Reassessed  Security is Constrained by Societal Factors  33 Principles enumerated
  • 30. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 30 ILLINOIS INSTITUTE OF TECHNOLOGY NIST SP 800-14 Principles for Securing IT Systems 1. Establish a sound security policy as the “foundation” for design. 2. Treat security as an integral part of the overall system design. 3. Clearly delineate the physical and logical security boundaries governed by associated security policies. 4. Reduce risk to an acceptable level. 5. Assume that external systems are insecure. 6. Identify potential trade-offs between reducing risk and increased costs and decrease in other aspects of operational effectiveness.
  • 31. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 31 ILLINOIS INSTITUTE OF TECHNOLOGY NIST SP 800-14 Principles for Securing IT Systems 7. Implement layered security (Ensure no single point of vulnerability). 8. Implement tailored system security measures to meet organizational security goals. 9. Strive for simplicity. 10.Design and operate an IT system to limit vulnerability and to be resilient in response. 11.Minimize the system elements to be trusted. 12.Implement security through a combination of measures distributed physically and logically.
  • 32. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 32 ILLINOIS INSTITUTE OF TECHNOLOGY NIST SP 800-14 Principles for Securing IT Systems 13. Provide assurance that the system is, and continues to be, resilient in the face of expected threats. 14. Limit or contain vulnerabilities. 15. Formulate security measures to address multiple overlapping information domains. 16. Isolate public access systems from mission critical resources (e.g., data, processes, etc.). 17. Use boundary mechanisms to separate computing systems and network infrastructures. 18. Where possible, base security on open standards for portability and interoperability. 19. Use common language in developing security requirements.
  • 33. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 33 ILLINOIS INSTITUTE OF TECHNOLOGY NIST SP 800-14 Principles for Securing IT Systems 20. Design and implement audit mechanisms to detect unauthorized use and to support incident investigations. 21. Design security to allow for regular adoption of new technology, including a secure and logical technology upgrade process. 22. Authenticate users and processes to ensure appropriate access control decisions both within and across domains. 23. Use unique identities to ensure accountability. 24. Implement least privilege. 25. Do not implement unnecessary security mechanisms.
  • 34. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 34 ILLINOIS INSTITUTE OF TECHNOLOGY NIST SP 800-14 Principles for Securing IT Systems 26. Protect information while being processed, in transit, and in storage. 27. Strive for operational ease of use. 28. Develop and exercise contingency or disaster recovery procedures to ensure appropriate availability. 29. Consider custom products to achieve adequate security. 30. Ensure proper security in the shutdown or disposal of a system.
  • 35. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 35 ILLINOIS INSTITUTE OF TECHNOLOGY NIST SP 800-14 Principles for Securing IT Systems 31. Protect against all likely classes of “attacks.” 32. Identify and prevent common errors and vulnerabilities. 33. Ensure that developers are trained in how to develop secure software.
  • 36. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 36 ILLINOIS INSTITUTE OF TECHNOLOGY ISO/IEC Standard Versus NIST Major difference: – ISO/IEC 17799 must be purchased before use – NIST standards were paid for by the American taxpayer and are provided free of charge U.S. Federal Government does not support ISO/IEC 17799 or view it as adequate for its purpose
  • 37. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 37 ILLINOIS INSTITUTE OF TECHNOLOGY IETF Security Architecture  The Security Area Working Group acts as an advisory board for the protocols and areas developed and promoted through the Internet Society – No specific architecture is promoted through IETF  RFC 2196: Site Security Handbook provides an overview of five basic areas of security  Topics include: – security policies – security technical architecture – security services – security incident handling
  • 38. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 38 ILLINOIS INSTITUTE OF TECHNOLOGY VISA Model  VISA International promotes strong security measures and has security guidelines  Developed two important documents that improve and regulate its information systems – “Security Assessment Process” – “Agreed Upon Procedures”  Using the two documents, a security team can develop a sound strategy for the design of good security architecture  The only down side to this approach is the very specific focus on systems that can or do integrate with VISA’s systems
  • 39. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 39 ILLINOIS INSTITUTE OF TECHNOLOGY Baselining and Best Practices  Baselining and best practices are solid methods for collecting security practices, but they can have the drawback of providing less detail than would a complete methodology  It is possible to gain information by baselining and using best practices and thus work backwards to an effective design  The Federal Agency Security Practices Site ( csrc.nist.gov/fasp/) is designed to provide best practices for public agencies
  • 40. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 40 ILLINOIS INSTITUTE OF TECHNOLOGY Professional Membership  Probably worth an information security professional’s time and money to join professional societies with information on best practices for its members  Many organizations have seminars and classes on best practices for implementing security  Finding information on security design is the easy part, sorting through the collected mass of information, documents, and publications can take a substantial investment in time and human resources
  • 41. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 41 ILLINOIS INSTITUTE OF TECHNOLOGY NIST SP 800-26 Management Controls – Risk Management – Review of Security Controls – Life Cycle Maintenance – Authorization of Processing (Certification and Accreditation) – System Security Plan Operational Controls – Personnel Security – Physical Security – Production, Input/Output Controls – Contingency Planning – Hardware and Systems Software – Data Integrity – Documentation – Security Awareness, Training, and Education – Incident Response Capability Technical Controls – Identification and Authentication – Logical Access Controls – Audit Trails
  • 42. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 42 ILLINOIS INSTITUTE OF TECHNOLOGY Spheres of Security
  • 43. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 43 ILLINOIS INSTITUTE OF TECHNOLOGY Sphere of Use  Generally speaking, the concept of the sphere is to represent the 360 degrees of security necessary to protect information at all times  The first component is the “sphere of use”  Information, at the core of the sphere, is available for access by members of the organization and other computer-based systems: – To gain access to the computer systems, one must either directly access the computer systems or go through a network connection – To gain access to the network, one must either directly access the network or go through an Internet connection
  • 44. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 44 ILLINOIS INSTITUTE OF TECHNOLOGY Sphere of Protection  The “sphere of protection” overlays each of the levels of the “sphere of use” with a layer of security, protecting that layer from direct or indirect use through the next layer  The people must become a layer of security, a human firewall that protects the information from unauthorized access and use  Information security is therefore designed and implemented in three layers – policies – people (education, training, and awareness programs) – technology
  • 45. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 45 ILLINOIS INSTITUTE OF TECHNOLOGY Controls  Management controls cover security processes that functionality of security in the organization  Operational controls are designed by the strategic planners and performed by security administration of the organization  Operational controls deal with the operational also address personnel security, physical security, and the protection of production inputs and outputs  Technical controls address those tactical and technical issues related to designing and implementing security in the organization
  • 46. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 46 ILLINOIS INSTITUTE OF TECHNOLOGY The Framework  Management Controls – Program Management – System Security Plan – Life Cycle Maintenance – Risk Management – Review of Security Controls – Legal Compliance  Operational Controls – Contingency Planning – Security ETA – Personnel Security – Physical Security – Production Inputs and Outputs – Hardware & Software Systems Maintenance – Data Integrity  Technical Controls – Logical Access Controls – Identification, Authentication, Authorization, and Accountability – Audit Trails – Asset Classification and Control – Cryptography
  • 47. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 47 ILLINOIS INSTITUTE OF TECHNOLOGY SETA  As soon as the policies exist, policies to implement security education, training, and awareness (SETA) should follow  SETA is a control measure designed to reduce accidental security breaches  Supplement the general education and training programs in place to educate staff on information security  Security education and training builds on the general knowledge the employees must possess to do their jobs, familiarizing them with the way to do their jobs securely
  • 48. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 48 ILLINOIS INSTITUTE OF TECHNOLOGY SETA Elements The SETA program consists of three elements – security education – security training – security awareness The organization may not be capable or willing to undertake all three of these elements but may outsource them
  • 49. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 49 ILLINOIS INSTITUTE OF TECHNOLOGY Purpose of SETA The purpose of SETA is to enhance security by: – Improving awareness of the need to protect system resources – Developing skills and knowledge so computer users can perform their jobs more securely – Building in-depth knowledge, as needed, to design, implement, or operate security programs for organizations and systems
  • 50. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 50 ILLINOIS INSTITUTE OF TECHNOLOGY Comparative Framework of SETA Education Training Awareness AttributeAttribute WhyWhy HowHow WhatWhat LevelLevel InsightInsight KnowledgeKnowledge InformationInformation ObjectiveObjective UnderstandingUnderstanding SkillSkill Teaching methodTeaching method Theoretical instructionTheoretical instruction •• Discussion seminarDiscussion seminar •• Background readingBackground reading Practical instructionPractical instruction •• LectureLecture •• Case study workshopCase study workshop •• Hands on practice‑Hands on practice‑ MediaMedia •• VideosVideos •• NewslettersNewsletters •• PostersPosters •• True or falseTrue or false Test measureTest measure EssayEssay (interpret learning)(interpret learning) Problem solvingProblem solving (apply learning)(apply learning) Multiple choiceMultiple choice (identify learning)(identify learning) Impact timeframeImpact timeframe Long term‑Long term‑ IntermediateIntermediate Short term‑Short term‑ TABLE 6-1 Comparative Framework of SETA: NIST SP800 12‑
  • 51. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 51 ILLINOIS INSTITUTE OF TECHNOLOGY Security Education  Everyone in an organization needs to be trained and aware of information security, but not every member of the organization needs a formal degree or certificate in information security  When formal education for appropriate individuals in security is needed an employee can identify curriculum available from local institutions of higher learning or continuing education  A number of universities have formal coursework in information security
  • 52. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 52 ILLINOIS INSTITUTE OF TECHNOLOGY Security Training Security training involves providing members of the organization with detailed information and hands-on instruction designed to prepare them to perform their duties securely Management of information security can develop customized in-house training or outsource the training program
  • 53. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 53 ILLINOIS INSTITUTE OF TECHNOLOGY Security Awareness  One of the least frequently implemented, but the most beneficial programs is the security awareness program  Designed to keep information security at the forefront of the users’ minds  Need not be complicated or expensive  If the program is not actively implemented, employees begin to ‘tune out’, and the risk of employee accidents and failures increases
  • 54. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 54 ILLINOIS INSTITUTE OF TECHNOLOGY InfoSec Awareness at KSU InfoSec Awareness at KSU FIGURE 6-17
  • 55. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 55 ILLINOIS INSTITUTE OF TECHNOLOGY Comments  Defense in Depth – One of the foundations of security architectures is the requirement to implement security in layers – Defense in depth requires that the organization establish sufficient security controls and safeguards, so that an intruder faces multiple layers of controls  Security Perimeter – The point at which an organization’s security protection ends, and the outside world begins – Referred to as the security perimeter – Unfortunately the perimeter does not apply to internal attacks from employee threats, or on-site physical threats
  • 56. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 56 ILLINOIS INSTITUTE OF TECHNOLOGY Defense in Depth
  • 57. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 57 ILLINOIS INSTITUTE OF TECHNOLOGY Security Perimeters & Domains
  • 58. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 58 ILLINOIS INSTITUTE OF TECHNOLOGY Key Technology Components  Other key technology components – A firewall is a device that selectively discriminates against information flowing into or out of the organization – The DMZ (demilitarized zone) is a no-man’s land, between the inside and outside networks, where some organizations place Web servers – In an effort to detect unauthorized activity within the inner network, or on individual machines, an organization may wish to implement Intrusion Detection Systems or IDS
  • 59. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 59 ILLINOIS INSTITUTE OF TECHNOLOGY Firewalls, Proxies & DMZ
  • 60. Transfo rm ing Live s. Inve nting the Future . www.iit.edu ITM 578 60 ILLINOIS INSTITUTE OF TECHNOLOGY The End… Questions?

Editor's Notes

  1. Learning Objectives: Upon completion of this material you should be able to: Understand management’s responsibilities and role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines. Understand the differences between the organization’s general information security policy and the needs and objectives of the various issue-specific and system-specific policies the organization will create. Know what an information security blueprint is and what its major components are. Understand how an organization institutionalizes its policies, standards, and practices using education, training and awareness programs. Become familiar with what viable information security architecture is, what it includes, and how it is used.
  2. Learning Objectives: Upon completion of this material you should be able to: Understand management’s responsibilities and role in the development, maintenance, and enforcement of information security policy, standards, practices, procedures, and guidelines. Understand the differences between the organization’s general information security policy and the needs and objectives of the various issue-specific and system-specific policies the organization will create. Know what an information security blueprint is and what its major components are. Understand how an organization institutionalizes its policies, standards, and practices using education, training and awareness programs. Become familiar with what viable information security architecture is, what it includes, and how it is used.
  3. Introduction The creation of an information security program begins with an information security blueprint, and before we can discuss the creation and development of a blueprint, it is important to look at management’s responsibility in shaping policy. It is prudent for information security professionals to know the information security polices and how these policies contribute to the overall objectives of the organization. Information Security Policy, Standards and Practices Management from all communities of interest must consider policies as the basis for all information security planning, design, and deployment. In general, policies direct how issues should be addressed and technologies used, not cover the specifics on the proper operation of equipment or software. Quality security programs begin and end with policy. As information security is primarily a management rather than technical problem, policy guides personnel to function in a manner that will add to the security of its information assets. Security policies are the least expensive control to execute, but the most difficult to implement. Shaping policy is difficult because it must: 1)Never conflict with laws. 2)Stand up in court, if challenged. 3)Be properly administered, including thorough dissemination, and documentation from personnel showing they have read the policies.
  4. A policy is A plan or course of action, as of a government, political party, or business, intended to influence and determine decisions, actions, and other matters Policies are organizational laws Policies must contain information on what is right, and what is not; what the penalties are for violating policy, and what the appeal process is Standards, on the other hand, are more detailed statements of what must be done to comply with policy Practices, procedures and guidelines effectively explain how to comply with policy For a policy to be effective it must be properly disseminated, read, understood and agreed to by all members of the organization.
  5. Types of Policy Management defines three types of security policy: 1)General or security program policy 2)Issue-specific security policies 3)Systems-specific security policies
  6. Security Program Policy A security program policy (SPP) is also known as a general security policy, IT security policy, or information security policy. This policy sets the strategic direction, scope, and tone for all security efforts within the organization. The SPP is an executive-level document, usually drafted by or with, the CIO of the organization and is usually 2 to 10 pages long. When the SPP has been developed, the CISO begins forming the security team and initiates the SecSDLC process.
  7. Issue-Specific Security Policy (ISSP) As the organization executes various technologies and processes to support routine operations, certain guidelines are needed to instruct employees to use these technologies and processes properly. In general, the ISSP 1) addresses specific areas of technology 2) requires frequent updates, and 3) contains an issue statement on the organization’s position on an issue. There are a number of approaches toward creating and managing ISSPs within an organization. Three of the most common are: Create a number of independent ISSP documents, each tailored to a specific issue Create a single comprehensive ISSP document attempting to cover all issues Create a modular ISSP document that unifies policy creation and administration, while maintaining each specific issue’s requirements
  8. ISSP Structure Statement of Policy The policy should begin with a clear statement of purpose. The introductory section should outline the scope and applicability of the policy. What does this policy address? Who is responsible and accountable for policy implementation? What technologies and issues does the policy document address? Authorized Access and Usage of Equipment This section of the policy statement addresses who can use the technology governed by the policy, and what it can be used for. This section defines “fair and responsible use” of equipment and other organizational assets and should also address key legal issues, such as protection of personal information and privacy. Prohibited Usage of Equipment While the policy section described above detailed what the issue or technology can be used for, this section outlines what it cannot be used for. Unless a particular use is clearly prohibited, the organization cannot penalize its employees. Systems Management There may be some overlap between an ISSP and a systems-specific policy, but this section of the policy statement focuses on the users relationship to systems management. It is important to identify all responsibilities delegated to both users or the systems administrators, to avoid confusion. Violations of Policy Once guidelines on equipment use have been outlined and responsibilities have been assigned, the individuals to whom the policy applies must understand the penalties and repercussions of violating the policy. Violations of policy should carry appropriate penalties. This section should also provide instructions on how individuals in the organization can report observed or suspected violations, either openly or anonymously. Policy Review and Modification Since any document is only as good as its frequency of review, each policy should contain procedures and a timetable for periodic review. Limitations of Liability The final section is a general statement of liability or set of disclaimers. The policy should state that if employees violate a company policy or any law using company technologies, the company will not protect them and the company is not liable for their actions.
  9. Systems-Specific Policy (SysSP) While issue-specific policies are formalized as written documents, distributed to users, and agreed to in writing, SysSPs are frequently codified as standards and procedures used when configuring or maintaining systems. Systems-specific policies fall into two groups: 1)Access control lists (ACLs) consists of the access control lists, matrices, and capability tables governing the rights and privileges of a particular user to a particular system. 2)Configuration Rules comprise the specific configuration codes entered into security systems to guide the execution of the system
  10. ACL Policies Both Microsoft Windows NT/2000 and Novell Netware 5.x/6.x families of systems translate ACLs into sets of configurations that administrators use to control access to their respective systems. ACLs allow configuration to restrict access from anyone and anywhere. ACLs regulate: Who can use the system. What authorized users can access. When authorized users can access the system. Where authorized users can access the system from. How authorized users can access the system.
  11. Rule Policies Rule policies are more specific to the operation of a system than ACLs, and may or may not deal with users directly. Many security systems require specific configuration scripts telling the systems what actions to perform on each set of information they process.
  12. Policy Management Policies are living documents that must be managed and nurtured, and are constantly changing and growing. These documents must be properly disseminated and managed. Special considerations should be made for organizations undergoing mergers, takeovers and partnerships. In order to remain viable, these policies must have: an individual responsible for reviews, a schedule of reviews, a method for making recommendations for reviews, and an indication of policy and revision date.
  13. Information Classification The classification of information is an important aspect of policy. The same protection scheme created to prevent production data from accidental release to the wrong party should be applied to policies in order to keep them freely available, but only within the organization. In today’s open office environments, it may be beneficial to implement a clean desk policy. A clean desk policy stipulates that at the end of the business day, all classified information must be properly stored and secured.
  14. Systems Design At this point in the Security SDLC, the analysis phase is complete and the design phase begins. At the end of the analysis phase, the security team has: created an assessment of the threats to the information and systems and has prioritized those threats developed a prioritized inventory of the organization’s information assets Developed an evaluation of the current asset-threat-vulnerability environment completed risk assessments with either a quantitative or qualitative analysis of the protection of each asset, or has prepared a benchmark comparison of security standards from similarly structured organizations. completed a set of feasibility studies identifying whether or not controls should proceed as planned. Designing a working plan for securing the organization’s information assets begins by creating or validating the security blueprint for the implementation of needed security controls to protect the information assets. The next step is to use the blueprint to plan the tasks to be accomplished and the order in which to proceed. Setting priorities can follow the recommendations of published sources, or from published standards provided by government agencies, or private consultants.
  15. Information Security Blueprints One approach to selecting a methodology is to adapt or adopt a published model or framework for information security. A framework is the basic skeletal structure within which additional detailed planning of the blueprint can be placed as it is developed of refined. Experience teaches us that what works well for one organization may not precisely fit another.
  16. ISO 17799/BS 7799 One of the most widely referenced and often discussed security models is the Information Technology – Code of Practice for Information Security Management, which was originally published as the British Standard BS 7799. This Code of Practice was adopted as an international standard by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) as ISO/IEC 17799 in 2000 as a framework for information security.
  17. ISO 17799/BS 7799 Several countries including the United States, Germany, and Japan have not adopted 17799. They claim that there are several fundamental problems: 1)The global information security community has not defined any justification for a code of practice as identified in the ISO/IEC 17799. 2)17799 lacks “the necessary measurement precision of a technical standard” . 3)There is no reason to believe that 17799 is more useful than any other approach currently available. 4)17799 is not as complete as other frameworks available. 5)17799 is perceived to have been hurriedly prepared given the tremendous impact its adoption could have on industry information security controls.
  18. ISO/IEC 17799 1.Organizational Security Policy is needed to provide management direction and support for information security. 2.Organizational Security Infrastructure objectives: Manage information security within the company Maintain the security of organizational information processing facilities and information assets accessed by third parties Maintain the security of information when the responsibility for information processing has been outsourced to another organization 3.Asset Classification and Control is needed to maintain appropriate protection of corporate assets and to ensure that information assets receive an appropriate level of protection. 4.Personnel Security objectives: Reduce risks of human error, theft, fraud or misuse of facilities Ensure that users are aware of information security threats and concerns, and are equipped to support the corporate security policy in the course of their normal work Minimize the damage from security incidents and malfunctions and learn from such incidents 5.Physical and Environmental Security objectives: Prevent unauthorized access, damage and interference to business premises and information Prevent loss, damage or compromise of assets and interruption to business activities Prevent compromise or theft of information and information processing facilities 6. Communications and Operations Management objectives: Ensure the correct and secure operation of information processing facilities Minimize the risk of systems failures Protect the integrity of software and information Maintain the integrity and availability of information processing and communication Ensure the safeguarding of information in networks and the protection of the supporting infrastructure Prevent damage to assets and interruptions to business activities Prevent loss, modification or misuse of information exchanged between organizations 7.System Access Control objectives in this area include: Control access to information Prevent unauthorized access to information systems Ensure the protection of networked services Prevent unauthorized computer access Detect unauthorized activities Ensure information security when using mobile computing and telecommunication networks 8.System Development and Maintenance objectives: Ensure security is built into operational systems Prevent loss, modification or misuse of user data in application systems Protect the confidentiality, authenticity and integrity of information Ensure IT projects and support activities are conducted in a secure manner Maintain the security of application system software and data 9.Business Continuity Planning to counteract interruptions to business activities and to critical business processes from the effects of major failures or disasters. 10. Compliance objectives: Avoid breaches of any criminal or civil law, statutory, regulatory or contractual obligations and of any security requirements Ensure compliance of systems with organizational security policies and standards Maximize the effectiveness of and minimize interference to/from the system audit process
  19. NIST Security Models Another approach available is described in the many documents available from the Computer Security Resource Center of the National Institute for Standards and Technology (csrc.nist.gov). These are among the references cited by the government of the U.S. when deciding not to select the ISO/IEC 17799 standards. NIST SP 800-12 - The Computer Security Handbook is an excellent reference and guide for the security manager or administrator in the routine management of information security. NIST SP 800-14 - Generally Accepted Principles and Practices for Securing IT Systems provides best practices and security principles that can direct the development of a security blueprint. NIST SP 800-18 - The Guide for Developing Security Plans for IT Systems is considered the foundation for a comprehensive security blueprint and framework. It provides detailed methods for assessing, designing, and implementing controls and plans for various sized applications.
  20. NIST SP 800-14 Generally Accepted Principles and Practices Security Supports the Mission of the Organization Security is an Integral Element of Sound Mgmt Security Should Be Cost-Effective Systems Owners Have Security Responsibilities Outside Their Own Organizations Security Responsibilities and Accountability Should Be Made Explicit Security Requires a Comprehensive and Integrated Approach Security Should Be Periodically Reassessed Security is Constrained by Societal Factors 1. Establish a sound security policy as the “foundation” for design. 2. Treat security as an integral part of the overall system design. 3. Clearly delineate the physical and logical security boundaries governed by associated security policies. 4. Reduce risk to an acceptable level. 5. Assume that external systems are insecure. 6. Identify potential trade-offs between reducing risk and increased costs and decrease in other aspects of operational effectiveness. 7. Implement layered security (Ensure no single point of vulnerability). 8. Implement tailored system security measures to meet organizational security goals. 9. Strive for simplicity. 10. Design and operate an IT system to limit vulnerability and to be resilient in response. 11. Minimize the system elements to be trusted. 12. Implement security through a combination of measures distributed physically and logically. 13. Provide assurance that the system is, and continues to be, resilient in the face of expected threats. 14. Limit or contain vulnerabilities. 15. Formulate security measures to address multiple overlapping information domains. 16. Isolate public access systems from mission critical resources (e.g., data, processes, etc.). 17. Use boundary mechanisms to separate computing systems and network infrastructures. 18. Where possible, base security on open standards for portability and interoperability. 19. Use common language in developing security requirements. 20. Design and implement audit mechanisms to detect unauthorized use and to support incident investigations. 21. Design security to allow for regular adoption of new technology, including a secure and logical technology upgrade process. 22. Authenticate users and processes to ensure appropriate access control decisions both within and across domains. 23. Use unique identities to ensure accountability. 24. Implement least privilege. 25. Do not implement unnecessary security mechanisms. 26. Protect information while being processed, in transit, and in storage. 27. Strive for operational ease of use. 28. Develop and exercise contingency or disaster recovery procedures to ensure appropriate availability. 29. Consider custom products to achieve adequate security. 30. Ensure proper security in the shutdown or disposal of a system. 31. Protect against all likely classes of “attacks.” 32. Identify and prevent common errors and vulnerabilities. 33. Ensure that developers are trained in how to develop secure software.
  21. IETF Security Architecture While no specific architecture is promoted through the Internet Engineering Task Force, the Security Area Working Group acts as an advisory board for the protocols and areas developed and promoted through the Internet Society. RFC 2196: Site Security Handbook provides an overview of five basic areas of security with detailed discussions on development and implementation. There are chapters on such important topics as security policies, security technical architecture, security services, and security incident handling.
  22. Visa International® Security Model Visa International, the credit card processing vendor, promotes strong security measures in its business associates, and has established guidelines for the security of its information systems. Visa has developed two important documents that improve and regulate its information systems: “Security Assessment Process” and “Agreed Upon Procedures.” Using the two documents, a security team can develop a sound strategy for the design of good security architecture. The only down side to this approach is the very specific focus on systems that can or do integrate with VISA’s systems with the explicit purpose of carrying the aforementioned cardholder information.
  23. Baselining and Best Business Practices Baselining and best practices are solid methods for collecting security practices, but can have the drawback of providing less detail for the design and implementation of all the practices needed by an organization, than would a complete methodology. However, it is possible to gain information by baselining and using best practices, to piece together the desired outcome of the security process, and thus work backwards to an effective design. The Federal Agency Security Practices Site (fasp.csrc.nist.gov) is designed to provide best practices for public agencies, but can be adapted easily to private institutions. The documents found in this site include specific examples of key policies and planning documents, implementation strategies for key technologies, and outlines of hiring documents for key security personnel.
  24. Professional Membership It may be worth the information security professional’s time and money to join professional societies with information on best practices for its members. Many organizations have seminars and classes on best practices for implementing security. Finding information on security design is the easy part. Sorting through the collected mass of information, documents, and publications can take a substantial investment in time and human resources.
  25. NIST SP 800-26 Security Self-Assessment Guide for IT Systems Management Controls 1. Risk Management 2. Review of Security Controls 3. Life Cycle Maintenance 4. Authorization of Processing (Certification and Accreditation) 5. System Security Plan Operational Controls 6. Personnel Security 7. Physical Security 8. Production, Input/Output Controls 9. Contingency Planning 10. Hardware and Systems Software 11. Data Integrity 12. Documentation 13. Security Awareness, Training, and Education 14. Incident Response Capability Technical Controls 15. Identification and Authentication 16. Logical Access Controls 17. Audit Trails
  26. Figure 6-16, showing the sphere of security, is the foundation of the security framework. Generally speaking, the sphere of security represents the fact that information is under attack from a variety of sources. The sphere of use, at the left of the figure, illustrates the ways in which people can directly access information: for example, people read hard copies of documents; they also access information through systems, such as the electronic storage of information. Information, as the most important asset to security, is illustrated at the core of the sphere. Information is always at risk from attacks through the people and computer systems that have direct access to the information. Networks and the Internet represent indirect threats, as exemplified by the fact that a person attempting to access information from the Internet must first go through the local networks and then access systems that contain the information. The sphere of protection, at the right of the figure, illustrates that between each layer of the sphere of use there must exist a layer of protection to prevent access to the inner layer from the outer layer. Each shaded band is a layer of protection and control. For example, the layer labeled “policy education and training” is located between people and the information. Controls are also implemented between systems and the information, between networks and the computer systems, and between the Internet and internal networks. This reinforces the concept of defense in depth. As illustrated in the sphere of protection portion of Figure 6-16, a variety of controls can be used to protect the information. The list in the figure is not intended to be comprehensive but illustrates individual safeguards that protect the various systems that are located closer to the center of the sphere. However, as people can directly access each ring as well as the information at the core of the model, people require unique approaches to security. In fact, the resource of people must become a layer of security, a human firewall that protects the information from unauthorized access and use. The members of the organization must become a safeguard, which is effectively trained, implemented, and maintained, or else they, too, become a threat to the information.
  27. Sphere of Use Generally speaking, the concept of the sphere is to represent the 360 degrees of security necessary to protect information at all times. The first component is the “sphere of use.” Information, at the core of the sphere, is available for direct access by members of the organization and other computer-based systems. To gain access to the computer systems, one must either directly access the computer systems or go through a network connection. To gain access to the network, one must either directly access the network or go through an Internet connection.
  28. Sphere of Protection The “sphere of protection” overlays each of the levels of the “sphere of use” with a layer of security, protecting that layer from direct use or indirect use through the next layer. The resource of people must become a layer of security, a human firewall that protects the information from unauthorized access and use. Information security is therefore designed and implemented in three layers: Policies, people (education, training and awareness programs) and technology.
  29. Controls Management Controls cover security processes that are designed by the strategic planners and performed by security administration of the organization. Management controls address the design and implementation of the security planning process and security program management. Operational Controls deal with the operational functionality of security in the organization. They cover management functions and lower level planning, such as disaster recovery and incident response planning. Operational controls also address personnel security, physical security and the protection of production inputs and outputs. Technical Controls address those tactical and technical issues related to designing and implementing security in the organization. Technical controls cover logical access controls, like identification, authentication, authorization, and accountability.
  30. The Principles of Information Security Framework Management Controls Program Management System Security Plan Life Cycle Maintenance Risk Management Review of Security Controls Legal Compliance Operational Controls Contingency Planning Security ETA Personnel Security Physical Security Production Inputs and Outputs Hardware & Software Systems Maintenance Data Integrity Technical Controls Logical Access Controls Identification, Authentication, Authorization and Accountability Audit Trails Asset Classification and Control Cryptography
  31. Security Education, Training, And Awareness Program As soon as the policies have been drafted outlining the general security policy, policies to implement security education, training and awareness (SETA) programs in the organization should follow. The SETA program is a control measure designed to reduce the incidences of accidental security breaches by employees. SETA programs are designed to supplement the general education and training programs in place to educate staff on information security. Security education and training is designed to build on the general knowledge the employees must possess to do their jobs, familiarizing them with the way to do their jobs, securely.
  32. SETA Elements The SETA program consists of three elements: security education, security training, and security awareness. The organization may not be capable or willing to undertake all three of these elements, but may outsource them. The purpose of SETA is to enhance security by: Improving awareness of the need to protect system resources Developing skills and knowledge so computer users can perform their jobs more securely Building in-depth knowledge, as needed, to design, implement, or operate security programs for organizations and systems.
  33. Security Education Everyone in an organization needs to be trained and aware of information security, but not every member of the organization needs a formal degree or certificate in information security. When formal education for appropriate individuals in security is needed, with the support of management, an employee can identify curriculum available from local institutions of higher learning or continuing education. A number of universities have formal coursework in information security. (See for example http://infosec.kennesaw.edu).
  34. Security Training Security training involves providing members of the organization with detailed information and hands-on instruction designed to prepare them to perform their duties securely. Management of information security can develop customized in-house training or outsource the training program.
  35. Security Awareness One of the least frequently implemented, but the most beneficial programs is the security awareness program. A security awareness program is designed to keep information security at the forefront of the users’ minds at they work day-to-day. These programs don’t have to be complicated or expensive. The goal is to keep the idea of information security in the user’s minds and to stimulate them to care about security. If the program is not actively implemented, employees begin to ‘tune out’, and the risk of employee accidents and failures increases.
  36. Comments On The Design Of Security Architecture Defense in Depth – One of the foundations of security architectures is the requirement to implement security in layers. Defense in depth requires that the organization establish sufficient security controls and safeguards, so that an intruder faces multiple layers of controls. Security Perimeter – The point at which an organization’s security protection ends, and the outside world begins, is referred to as the security perimeter. Unfortunately the perimeter does not apply to internal attacks from employee threats, or on-site physical threats.
  37. Key Technology Components A few other key technology components that are important to understand during the design phase of a security architecture are the firewall, proxy server, intrusion detection systems, and the DMZ. A firewall is a device that selectively discriminates against information flowing into or out of the organization. A firewall is usually a computing device, or specially configured computer that allows or prevents information from entering or exiting the defined area based on a set of predefined rules. The DMZ (demilitarized zone) is a no-man’s land, between the inside and outside networks, where some organizations place Web servers. These servers provide access to organizational Web pages, without allowing Web requests to enter the interior networks. An alternative approach to this strategy is to use a proxy server or firewall. A proxy server performs actions on behalf of another system. When an outside client requests a particular Web page, the proxy server receives the request then asks for the same information from the true Web server. In an effort to detect unauthorized activity within the inner network, or on individual machines, an organization may wish to implement Intrusion Detection Systems or IDS. Host-based IDS are usually installed on the machine the organization wishes to protect and to safeguard that particular system from unauthorized use by monitoring the status of various files stored on that system. Network-based IDS look at patterns of network traffic and attempt to detect unusual activity based on previous baselines.