Chapter 8 – Administering Security Security Planning Risk Analysis Security Policies Physical Security
Security Planning Policy Current state – risk analysis Requirements Recommended controls Accountability Timetable Continuing attention
Security Planning - Policy Who should be allowed access? To what system and organizational resources should access be allowed? What types of access should each user be allowed for each resource?
Security Planning - Policy What are the organization’s goals on security? Where does the responsibility for security lie? What is the organization’s commitment to security?
OCTAVE Methodology Identify enterprise knowledge. Identify operational area knowledge. Identify staff knowledge. Establish security requirements. Map high-priority information assests to information infrastructure. Perform an infrastructure vulnerability evaluation. Conduct a multidimensional risk analysis. Develop a protection strategy.
Security Planning – Requirements of the TCSEC Security Policy – must be an explicit and well- defined security policy enforced by the system. Every subject must be uniquely and convincingly identified. Every object must be associated with a label that indicates its security level. The system must maintain complete, secure records of actions that affect security. The computing system must contain mechanisms that enforce security. The mechanisms that implement security must be protected against unauthorized change.
Security Planning Team Members Computer hardware group System administrators Systems programmers Application programmers Data entry personnel Physical security personnel Representative users
Security Planning Assuring Commitment to a Security Plan Business Continuity Plans Assess Business ImpactAssess Business Impact Develop StrategyDevelop Strategy Develop PlanDevelop Plan Incident Response Plans Advance PlanningAdvance Planning Response TeamResponse Team After the Incident is ResolvedAfter the Incident is Resolved