Fundamentals of Information Systems Security PDF

Preview

Summary

fundamentals of information systems security - Mr. Iraya...

Description

Fundamentals of Information Systems Security/Information Security and Risk Management < Fundamentals of Information Systems Security Jump to navigationJump to search A Wikibookian believes this page should be split into smaller pages with a narrower subtopic. You can help by splitting this big page into smaller ones. Please make sure to follow the naming policy. Dividing books into smaller sections can provide more focus and allow each one to do one thing well, which benefits everyone. You can ask for help in dividing this book in the assistance reading room.

Contents [hide] 







1 Introduction o 1.1 Security Program o 1.2 Security Controls o 1.3 The Elements of Security 2 Core Information Security Principles o 2.1 Confidentiality o 2.2 Integrity o 2.3 Availability 3 Information Security Management Governance o 3.1 Security Governance o 3.2 Security Policies, Procedures, Standards, Guidelines, and Baselines  3.2.1 Policies  3.2.2 Standards  3.2.3 Procedures  3.2.4 Baselines  3.2.5 Guidelines  3.2.6 Putting It All Together o 3.3 Organizational Security Models  3.3.1 COSO  3.3.2 ITIL  3.3.3 COBIT 4.X  3.3.4 ISO/IEC 27000 Series (Formerly BS 7799/ISO 17799)  3.3.4.1 BS 7799  3.3.4.2 ISO 17799  3.3.4.3 ISO 27000 Series 4 Organizational Behavior









o 4.1 Organizational Structure Evolution o 4.2 Best Practices  4.2.1 Job Rotation  4.2.2 Separation of Duties  4.2.3 Least Privilege (Need to Know)  4.2.4 Mandatory Vacations  4.2.5 Job Position Sensitivity o 4.3 Security Roles and Responsibilities  4.3.1 Levels of Responsibilities  4.3.2 Classification of Roles and their Responsibilities o 4.4 Reporting Model o 4.5 Enterprise-wide Security Oversight  4.5.1 Defining the Goals  4.5.2 Security Planning  4.5.3 Personnel Security 5 Security Awareness, Training, and Education o 5.1 Conducting A Formal Security Awareness Training o 5.2 Awareness Activities and Methods 6 Information Risk Management o 6.1 Risk Management Concepts o 6.2 Risk Handling Strategies o 6.3 Risk Assessment/Analysis  6.3.1 Identifying The Risk Elements  6.3.2 A Quantitative Approach to Risk Analysis  6.3.3 A Qualitative Approach to Risk Analysis  6.3.4 Selecting and Implementing a Countermeasure 7 Information Classification o 7.1 Introduction o 7.2 Classification Types o 7.3 Guidelines for Information Classification o 7.4 Criteria for Information Classification o 7.5 Data Classification Procedures o 7.6 Classification Controls 8 Ethics o 8.1 Basic Concepts o 8.2 Professional Code of Ethics  8.2.1 Computer Ethics Institute  8.2.2 Internet Architecture Board  8.2.3 The (ISC)2Code of Ethics o 8.3 Example Topics in Computer Ethics  8.3.1 Computers in the Workplace  8.3.2 Computer Crime  8.3.3 Privacy and Anonymity  8.3.4 Intellectual Property  8.3.5 Professional Responsibility  8.3.6 Globalization o 8.4 Common Computer Ethics Fallacies o 8.5 Hacking and Hacktivism  8.5.1 The Hacker Ethics



9 References

Introduction[edit] Information security means protecting information (data) and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction. Information Security management is a process of defining the security controls in order to protect the information assets.

Security Program[edit] The first action of a management program to implement information security is to have a security program in place. Though some argue the first act would be to gain some real "proof of concept" "explainable thru display on the monitor screen" security knowledge. Start with maybe understanding where OS passwords are stored within the code inside a file within a directory. If you don't understand Operating Systems at the root directory level maybe you should seek out advice from somebody who does before even beginning to implement security program management and objectives. Security Program Objectives      

Protect the company and its assets. Manage Risks by Identifying assets, discovering threats and estimating the risk Provide direction for security activities by framing of information security policies, procedures, standards, guidelines and baselines Information Classification Security Organization and Security Education

Security Management Responsibilities   

Determining objectives, scope, policies,re expected to be accomplished from a security program Evaluate business objectives, security risks, user productivity, and functionality requirements. Define steps to ensure that all the above are accounted for and properly addressed

Approaches to Build a Security Program 



Top-Down Approach o The initiation, support, and direction comes from the top management and work their way through middle management and then to staff members. o Treated as the best approach but seems to based on the I get paid more therefor I must know more about everything type of mentality. o Ensures that the senior management who are ultimately responsible for protecting the company assets is driving the program. Bottom-Up Approach

o The lower-end team comes up with a security control or a program without proper management support and direction. o It is oft considered less effective and doomed to fail for the same flaw in thinking as above; I get paid more therefor I must know more about everything. Since advancement is directly tied to how well you can convince others, who often fall outside of your of job duties and department, as to your higher value to the company as stated by your own effective written communication this leads to amazing resume writers and take no blame style of email responses that seems to definitely lead to the eventual failure of company's standards and actual knowledge. It is often covered up by relationships which form at the power levels within any group of people and those who are considered so-called experts having no real idea what is really involved under the hood of the reports/applications they use and no proof presented in emails written when self declared claims of their expertise is made or blame is to be put on another.

Security Controls[edit] Security Controls can be classified into three categories Administrative Controls which include    

Developing and publishing of policies, standards, procedures, and guidelines. Screening of personnel. Conducting security-awareness training and Implementing change control procedures.

Technical or Logical Controls which include     

Implementing and maintaining access control mechanisms. Password and resource management. Identification and authentication methods Security devices and Configuration of the infrastructure.

Physical Controls which include     

Controlling individual access into the facility and different departments Locking systems and removing unnecessary floppy or CD-ROM drives Protecting the perimeter of the facility Monitoring for intrusion and Environmental controls.

Security Note: It is the responsibility of the information owner (usually a Sr. executive within the management group or head of a specific dept) to protect the data and is the due care (liable by the court of law) for any kind of negligence

The Elements of Security[edit]

Vulnerability   

It is a software, hardware, or procedural weakness that may provide an attacker the open door he is looking for to enter a computer or network and have unauthorized access to resources within the environment. Vulnerability characterizes the absence or weakness of a safeguard that could be exploited. E.g.: a service running on a server, unpatched applications or operating system software, unrestricted modem dial-in access, an open port on a firewall, lack of physical security etc.

Threat   

Any potential danger to information or systems. A threat is a possibility that someone (person, s/w) would identify and exploit the vulnerability. The entity that takes advantage of vulnerability is referred to as a threat agent. E.g.: A threat agent could be an intruder accessing the network through a port on the firewall

Risk   

Risk is the likelihood of a threat agent taking advantage of vulnerability and the corresponding business impact. Reducing vulnerability and/or threat reduces the risk. E.g.: If a firewall has several ports open, there is a higher likelihood that an intruder will use one to access the network in an unauthorized method.

Exposure   

An exposure is an instance of being exposed to losses from a threat agent. Vulnerability exposes an organization to possible damages. E.g.:If password management is weak and password rules are not enforced, the company is exposed to the possibility of having users' passwords captured and used in an unauthorized manner.

Countermeasure or Safeguard  

It is an application or a s/w configuration or h/w or a procedure that mitigates the risk. E.g.: strong password management, a security guard, access control mechanisms within an operating system, the implementation of basic input/output system (BIOS) passwords, and security-awareness training.

The Relation Between the Security Elements   

Example: If a company has antivirus software but does not keep the virus signatures up-to-date, this is vulnerability. The company is vulnerable to virus attacks. The threat is that a virus will show up in the environment and disrupt productivity. The likelihood of a virus showing up in the environment and causing damage is the risk.

 

If a virus infiltrates the company's environment, then vulnerability has been exploited and the company is exposed to loss. The countermeasures in this situation are to update the signatures and install the antivirus software on all computers

Threat Agent gives rise to Threat exploits Vulnerability leads to Risk can damage Assets and causes an Exposure can be counter measured by Safeguard directly effects Threat Agent

Alternative Description: A threat agent causes the realisation of a threat by exploiting a vulnerability. The measurement of the extent that this exploitation causes damage is the exposure. The organisational loss created within the exposure is the impact. Risk is the probability that a threat event will generate loss and be realised within the organisation. Example:         

Target: A bank contains money. Threat: There are individuals who want, or need, additional money. Vulnerability: The bank uses software that has a security flaw. Exposure: 20% of the bank's assets are affected by this flaw. Exploit: By running a small snippet of code (malware), the software can be accessed illegally. Threat Agent: There are hackers who have learned how to use this malware to control the bank's software. Exploitation: The hackers access the software using the malware and steal money. Impact: The bank loses monetary assets, reputation, and future business. Risk: The likelihood that a hacker will exploit the bank's software vulnerability and impact the bank's reputation and monetary resources.

Core Information Security Principles[edit] The three fundamental principles of security are availability, integrity, and confidentiality and are commonly referred to as CIA or AIC triad which also form the main objective of any security program. The level of security required to accomplish these principles differs per company, because each has its own unique combination of business and security goals and requirements. All security controls, mechanisms, and safeguards are implemented to provide one or more of these principles. All risks, threats, and vulnerabilities are measured for their potential capability to compromise one or all of the AIC principles

Confidentiality[edit] 

Ensures that the necessary level of secrecy is enforced at each junction of data processing and prevents unauthorized disclosure. This level of confidentiality should





prevail while data resides on systems and devices within the network, as it is transmitted and once it reaches its destination. Threat sources o Network Monitoring o Shoulder Surfing- monitoring key strokes or screen o Stealing password files o Social Engineering- one person posing as the actual Countermeasures o Encrypting data as it is stored and transmitted. o By using network padding o Implementing strict access control mechanisms and data classification o Training personnel on proper procedures.

Integrity[edit]  



Integrity of data is protected when the assurance of accuracy and reliability of information and system is provided, and unauthorized modification is prevented. Threat sources o Viruses o Logic Bombs o Backdoors Countermeasures o Strict Access Control o Intrusion Detection o Hashing

Availability[edit]  



Availability ensures reliability and timely access to data and resources to authorized individuals. Threat sources o Device or software failure. o Environmental issues like heat, cold, humidity, static electricity, and contaminants can also affect system availability. o Denial-of-service (DoS) attacks Countermeasures o Maintaining backups to replace the failed system o IDS to monitor the network traffic and host system activities o Use of certain firewall and router configurations

Information Security Management Governance[edit] Security Governance[edit] Governance is the set of responsibilities and practices exercised by the board and executive management with the goal of providing strategic direction, ensuring that objectives are

achieved, ascertaining that risks are managed appropriately and verifying that the enterprise's resources are used responsibly. Information Security Governance or ISG, is a subset discipline of Corporate Governance focused on information Security systems and their performance and risk management.

Security Policies, Procedures, Standards, Guidelines, and Baselines[edit] Policies[edit] A security policy is an overall general statement produced by senior management (or a selected policy board or committee) that dictates what role security plays within the organization. A well designed policy addresses: 1. . What is being secured? - Typically an asset. 2. . Who is expected to comply with the policy? - Typically employees. 3. . Where is the vulnerability, threat or risk? - Typically an issue of integrity or responsibility. Types of Policies 





Regulatory: This type of policy ensures that the organization is following standards set by specific industry regulations. This policy type is very detailed and specific to a type of industry. This is used in financial institutions, health care facilities, public utilities, and other government-regulated industries. E.g.: TRAI. Advisory: This type of policy strongly advises employees regarding which types of behaviors and activities should and should not take place within the organization. It also outlines possible ramifications if employees do not comply with the established behaviors and activities. This policy type can be used, for example, to describe how to handle medical information, handle financial transactions, or process confidential information. Informative: This type of policy informs employees of certain topics. It is not an enforceable policy, but rather one to teach individuals about specific issues relevant to the company. It could explain how the company interacts with partners, the company's goals and mission, and a general reporting structure in different situations.

Types of Security Policies 

Organizational o Management establishes how a security program will be set up, lays out the program's goals, assigns responsibilities, shows the strategic and tactical value of security, and outlines how enforcement should be carried out. o Provides scope and direction for all future security activities within the organization. o This policy must address relative laws, regulations, and liability issues and how they are to be satisfied. o It also describes the amount of risk senior management is willing to accept.





o Characteristics  Business objectives should drive the policy's creation, implementation, and enforcement. The policy should not dictate business objectives.  It should be an easily understood document that is used as a reference point for all employees and management.  It should be developed and used to integrate security into all business functions and processes.  It should be derived from and support all legislation and regulation applicable to the company.  It should be reviewed and modified as a company changes, such as through adoption of a new business model, merger with another company, or change of ownership.  Each iteration of the policy should be dated and under version control.  The units and individuals who are governed by the policy must have access to the applicable portions and not be expected to have to read all policy material to find direction and answers Issue-specific o Addresses specific security issues that management feels need more detailed explanation and attention to make sure a comprehensive structure is built and all employees understand how they are to comply with these security issues o E.g.: An e-mail policy might state that management can read any employee's e-mail messages that reside on the mail server, but not when they reside on the user's workstation System-specific o Presents the management's decisions that are specific to the actual computers, networks, applications, and data. o This type of policy may provide an approved software list, which contains a list of applications that may be installed on individual workstations. o E.g.: This policy may describe how databases are to be used and protected, how computers are to be locked down, and how firewalls, IDSs, and scanners are to be employed.

Standards[edit]   

Standards refer to mandatory activities, actions, rules, or regulations. Standards can give a policy its support and reinforcement in direction. Standards could be internal, or externally mandated (government laws and regulations).

Procedures[edit]  



Procedures are detailed step-by-step tasks that should be performed to achieve a certain goal. E.g.: we can write procedures on how to install operating systems, configure security mechanisms, implement access control lists, set up new user accounts, assign computer privileges, audit activities, destroy material, report incidents, and much more. Procedures are considered the lowest level in the policy chain because they are closest to the computers and users (compared to policies) and provide detailed steps for configuration and installation issues.

 

Procedures spell out how the policy, standards, and guidelines will actually be implemented in an operating environment. If a policy states that all individuals who access confidential information must be properly authenticated, the supporting procedures will explain the steps for this to happen by defining the access criteria for authorization, how access control mechanisms are implemented and configured, and how access activities are audited

Baselines[edit] 

  

A baseline can refer to a point in time that is used as a comparison for future changes. Once risks have been mitigated, and security put in place, a baseline is formally reviewed and agreed upon, after which all further comparisons and development are measured against it. A baseline results in a consistent reference point. Baselines are also used to define the minimum level of protection that is required. In security, specific baselines can be defined per system type, which indica...