Information Security KRISHNAKUMAR RAGHAVAN (KK) NASWA's Information Technology Support Center 1

■ Confidentiality o Ability to hide information from unauthorized access. ■ Integrity o Maintaining consistency, accuracy and trustworthiness of data over its entire lifecycle. ■ Availability o Information requested is readily available to authorized entity NASWA's Information Technology Support Center 2 CIA TRIAD CIA triad no longer adequately address security of changing technology environment

 Identity & Access Management o An enterprise access management system with the capability of identity provisioning, identifying and authorizing users and systems  Intrusion Prevention System Confidentiality NASWA's Information Technology Support Center 3 Security ControlIRS 1075 GuidanceNIST Reference IA-7: Cryptographic Module Authentication The information system uses mechanisms for authentication to a cryptographic module that meet the requirements of applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication. NIST Recommended Security Controls for Federal Information Systems. FIPS – Security Requirements for Cryptographic Modules

 Public Key Infrastructure o An enterprise PKI infrastructure to assure cryptography during data acquisition, transit and rest. o Non Repudiation – digital signature, encryption and checksum using hash o Transport Layer Security (TLS)/Secured Socket Layer (SSL)  Nonce o Avoid replay attacks  Auditing o Logging,  Social Engineering NASWA's Information Technology Support Center 4 Integrity

Security ControlIRS 1075 GuidanceNIST Reference SC-8: Transmission IntegrityThe information system protects the integrity of transmitted information. NIST – guidance on the use of Transport Layer Security (TLS) NIST – guidance on the use of Ipsec SC-9: Transmission ConfidentialityThe information system protects the confidentiality of transmitted information. NIST – guidance on the use of Transport Layer Security (TLS) NIST – guidance on the use of IPsec NIST – guidance on the use of Ipsec SC-12: Cryptographic Key Establishment and Management When cryptography is required and employed within the information system, the organization establishes and manages cryptographic keys using automated mechanisms with supporting procedures or manual procedures. NIST – guidance on cryptographic key establishment NIST – guidance on cryptographic key management NIST – guidance on the use of Ipsec SC-13: Use of CryptographyValidation certificates issued by the NIST Cryptographic Module Validation Program (including FIPS 140-1, FIPS 140-2, and future amendments) remain in effect and the modules remain available for continued use and purchase until a validation certificate is specifically revoked. FIPS – Security Requirements for Cryptographic Modules NIST – guidance on the use of Ipsec SC-17: Public Key Infrastructure Certificates User certificates, each agency either establishes an agency certification authority cross-certified with the Federal Bridge Certification Authority at medium assurance or higher or uses certificates from an approved, shared service provider, as required by OMB Memorandum NIST – guidance on public key technology NASWA's Information Technology Support Center 5 Integrity Security Controls

 Enterprise Monitoring systems o Intrusion Detection System – NIST o Vulnerability assessment tools – NIST o Malicious software detection systems – NIST  Risk Management – NIST o Enterprise patch management NIST o Enterprise Firewall management NIST o Configuration management NIST NASWA's Information Technology Support Center 6 Availability

 Tools o CA Site minder o Oracle Access Manager o IBM o Dell o Sail Point o ForgeRock (Open Source) NASWA's Information Technology Support Center 7 Identity and Access Management

 OpenSSL  NetBeans NASWA's Information Technology Support Center 8 Public Key Infrastructure

NASWA's Information Technology Support Center 9 Non Repudiation

NASWA's Information Technology Support Center 10 Intrusion detection and prevention systems

NASWA's Information Technology Support Center 11 Capabilities of IDS

NASWA's Information Technology Support Center 12 Questions