Security Management Practices Risk Management Identifying, assessing, and reducing risk to an acceptable level Implementing mechanisms to maintain risk level Security Policies Security Education

Security Administration Person or group must be responsible Clear reporting structure to senior management Information owners dictate who can access data Executive with management responsibilities Security Administrators ensure that’s what happens

Security Controls Administrative Controls Technical Controls Policies & Standards Technical Controls Password & Resource Management Security Devices Physical Controls Locks, fences, walls

Failure – Managements fault? Must have buy-in from Senior Management Security should not be viewed as expensive and unnecessary Lack of security controls much more expensive Foster a healthy relationship between Security & Senior Management

CIA Triad Confidentiality Integrity Availability Only those that should see it can see it Integrity Assurance that data is accurate and reliable Availability Reliable and timely access to data

Definitions & the Security Circle of Life

Hacker Disgruntled Employee Enemy government Random actor Environment Virus They create….

Denial of Service Loss of data Changes to data Tornado Equipment failure Exploits…

Open firewall port Bug in software Lack of proper controls Lack of redundancy Leads to…

Low Medium High Can damage…

File Server Marketing plan Research Facility And causes an…

Wasted man hours to reproduce data Lost sales Law suits Can be countermeasured by…

Firewall Hot backup site Fire suppression Directly affects…

And then it starts all over again

Top Down Security Planning Step 1 Assess Business Objectives Senior management must participate Operational Goals – Daily Tactical Goals – Near future Strategic Goals – Long term Budgets Benefits in other areas?

Top Down Security Planning Step 2 Vulnerability Assessment Report of where vulnerabilities exist Catalog each asset and system Research known vulnerabilities Accuracy is key Penetration Testing Active, systematic attack on owned assets Outsource or in-house

Top Down Security Planning Step 3 Risk Analysis Assign value to assets Costs to acquire or develop asset Cost to maintain asset Value to owners or users Value to adversaries Price others are willing to pay Cost to replace the asset if lost Loss of productivity if asset is unavailable Liability issues if the asset is compromised

Perform threat analysis Estimate loss per risk Single Loss Expectancy (SLE) = asset value X exposure factor (EF) EF represents the estimated loss per occurrence Cost of recovery Cost of lost productivity Perform threat analysis Gather info about likelihood of each risk happening Past occurrences Industry occurrences Estimate Annualized Rate of Occurrence (ARO) = probability occurrence will take place during a given year 0.0 = never, 0.5 = every other year, 1.0 = always

Derive overall loss potential per risk Annualized Loss Expectancy (ALE) = SLE X ARO Select countermeasures for each risk Quantify the Total Cost of Ownership (TCO) for each counter measure Acquirement Cost + Yearly Support Costs Reduce, assign, or accept each risk Reduction (need not be 100%) Install security controls Improve procedures Assignment Buy insurance Acceptance Live with the risk Is countermeasure TCO more expensive than ALE?

Things to Consider When Selecting a Countermeasure Modularity Provides uniform protection Allows administrator to override Independence from asset and other safeguards Flexibility and functionality Clear distinctions between user classes Minimal human intervention needed Easily upgradeable Auditing functionality Able to be reset without affecting protection level Testable Does not introduce other compromises Acceptable negative affects on performance of users and systems Proper and flexible alerting facilities

Top Down Security Planning Step 4 Define protection requirements How aggressive will you be? Classify data Define data classes Assign data and assets to classes Identify data custodian Document, document, document Evaluate functionality of chosen countermeasures

Top Down Security Planning Step 5 Evaluate legal liabilities Who can sue you? Perform security awareness training Customize content for different audiences – Management, Staff, Technical Must be repeated continually Evaluate system reliability of countermeasures

Top Down Security Planning Step 5, con’t Publish policies and procedures Policies Management Statements Organizational Issue Specific System Specific Standards Compulsory rules that must be followed Guidelines Recommended actions Procedures Detailed step-by-step actions to complete a specific task

Top Down Security Planning Step 5, con’t Areas covered by Policies and Procedures Accountability controls Physical and environmental controls Administration controls Access controls Use and required types of cryptography BCP controls Computer operations Incident handling

Top Down Security Planning Step 6 Roll out selected countermeasures Be sure the roll out plan does not adversely affect users and customers Monitor countermeasures

Top Down Security Planning Step 7 Reevaluate and repeat regularly!

Layers of Security Responsibility Senior Manager Person ultimately responsible for the security of the organization Security Professional Functionally responsible for security Data Owner Determines data classification of info Data Custodian Maintains the data according to classification guidelines User Uses data for daily tasks Auditor Regularly examines the security practices and mechanisms

More Terminology Due Care Due Diligence Nondisclosure agreements (NDA) Organization has taken steps necessary to protect its assets from possible risks Due Diligence Accomplished by activities that ensure that countermeasures are continually maintained and operational Nondisclosure agreements (NDA) Job rotation

Homework Assignment Read Chapter 4 Paper Choose and document 5 common vulnerabilities List (and justify if not obvious) the threat agent, threat, risk, possible affected asset, exposure, safeguard Stick to common vulnerabilities, but try to choose from the entire realm of security issues