IS4550 Security Policies and Implementation Unit 10 Automated Policy Compliance Systems

Class Agenda 8/18/16 Lesson Covers Chapter 15 Learning Objectives 9/19/2018 Class Agenda 8/18/16 Lesson Covers Chapter 15 Learning Objectives Lesson Presentation and Discussions. Assignments and Lab Activities. Break Times as per School Regulations. Exams Review. Read the text book for Exams. Exams will be held in the next class Final Group Project is due in the next class. (c) ITT Educational Services, Inc.

Learning Objective Describe the different issues related to defining, tracking, monitoring, reporting, automating, and configuring compliance systems and emerging technologies.

Key Concepts Baseline definition for information systems security Tracking, monitoring, and reporting for information technology (IT) security baseline definition and policy compliance Automate IT security policy compliance, and policy configuration management and change control management Best practices for IT security policy compliance monitoring Differences between public and private IT security policy compliance monitoring

Baseline security. Baseline is used to deploy security policy settings It ensures that all affected system have the same security settings. Is the starting point and provide the basic and the minimum security. Example: Protocols, Services must be set to what will provide the minimum security. Baseline configuration could be created by imaging operating system and application..

Monitoring for compliance. Baseline need to monitored to ensure compliance. Both authorized and unauthorized changes to the baseline should be tracked monitored. Method to verify changes include: Automated systems. Manual tracking and reporting Audit for compliance

EXPLORE: CONCEPTS

Automated Policy Compliance and Emerging Technologies Have you ever made any transaction through online banking? What do you think are the benefits of making transaction through the Internet?

Manual vs. Automatic Monitoring and Reporting Why do you think that an online banking system is better than traditional banking system?

Automated system for baseline compliance. Software tools are used to enforce policy compliance Automated tools work by taking your security policies and procedures and implementing them into control points It can regularly query systems to verify compliance. Automated tools have scheduled ability.

Public and Private IT Security Policy Compliance Monitoring Differences between Public and Private Public Regulations require reporting on a timely basis Compliance law requires specific reporting guidelines Governmental laws stipulate when reports are due Private Reporting set by owners with no set timeline Government compliance laws may not apply so reporting of that data is not required Problems often go undisclosed

Windows Automated tools Microsoft Baseline Security Analyzer (MBSA) Windows Server Update Services (WSUS) System Management Server (SMS) Microsoft System Center Configuration Manager (SCCM) (Allow student should explore theses applications)

Other Unix and Linux automated tools. Nessus Nmap Security Administrators Integrated and network Tools (SIANT) Symantec Altiris

Manual Tracking and reporting. Manual intervention to track adherence to the policies Provides procedures and guidelines necessary for day-to-day operations Typical procedures include antivirus, password aging and log monitoring. The process is extremely hands-on Example: Someone has to intervene to correlate the data between the various control points, including antivirus programs, IDSes, firewalls and authentication systems such as Active Directory.

Problems of Manual Tracking for compliance Manually monitoring for policy compliance can be quite cumbersome. Detecting this policy deviation and correcting it can be extremely time-consuming Cheaper than automated systems. Not ideal for big organization

EXPLORE: ROLES

Roles and Responsibilities Reporting IT Management Information Security Management Auditing Risk Management Monitoring Information system (IS) Management System Administrators

Roles and Responsibilities (Continued) Compliance Executive Management

EXPLORE: RATIONALE

Benefits of Automating Security Policy Compliance Cost reductions as full time employees can be re-tasked Efficiency due to computers doing the policy compliance monitoring Better reporting functions and data capture

Benefits of Automating Security Policy Compliance (Continued) Online real-time compliance reporting and monitoring Increased accuracy

Summary In this presentation, the following were covered: Automated policy compliance systems and emerging technologies Difference between manual and automatic monitoring and reporting Benefits of automating security policy compliance Differences between public and private IT security policy compliance monitoring Roles and responsibilities associated with automated policy compliance systems

Unit 10 Assignment and Lab Discussion 10.1 Tracking, Monitoring, and Reporting Lab 10.2 Align an IT Security Policy Framework to the 7Domains of a Typical IT Infrastructure Assignment 10.3 Automated Policy Compliance Systems