Chapter 3

 Security Framework  Operational Security Lifecycle  Security Perimeter  Access Control  Social Engineering  Environmental Issues

 Protection = Prevention + (Detection + Response).  Prevention techniques are static barriers to the intruders.  Detection and Response technologies are dynamic and an ongoing process.

 Systems, technologies and network constantly change with time, thus we have to monitor the systems regularly.  Monitoring the security infrastructure in the organization is an essential part of any organization’s security program.

 An organization’s security framework is very important in implementing the security.  Security framework includes ◦ Policies ◦ Procedures ◦ Standards ◦ Guidelines

 Policies are high-level, broad statements of what the organization wants to accomplish.  Policies are formulated by management when laying out organization's position on some issue.

 Standards are mandatory elements regarding the implementation of a policy.  They are accepted specifications providing specific details on how a policy is to be enforced.  Standards can be set by the organization or by an external agency.

 Guidelines are recommendations relating to a policy.  Guidelines are optional.

 Procedures are the steps-by-step instructions on how to implement policies in the organization.  Procedures describe exactly how employees are expected to act in a given situation.

 The policies, procedures, standards and guidelines are dynamic.  They must be revises periodically.  The operational security lifecycle has 4 phases ◦ Plan (adjust) ◦ Implement ◦ Monitor ◦ Evaluate

 Planning - In this stage, all the policies, procedures, standards and guidelines for your organization’s security are developed and designed.  Implement - In this stage you implement and enforce the policies, procedures, standards and guidelines. All the employees affected by these new policies, procedures, standards and guidelines will come to know about these changes.

 Monitoring - In this stage, all the policies, procedures, standards, guidelines, hardware and software are monitored to check the effectiveness of organization’s security.  Evaluate – In this stage, all the policies, procedures, standards and guidelines are again re-evaluated to ensure that the security is adequate.

PlanImplementMonitorEvaluate

 The basic idea of a security perimeter is to provide a “complete” security to the corporate network.  Access by external entities to the corporate network (Internal) is controlled and monitored via the security perimeter.

Internet Telephone Company

 The purpose of access controls is to restrict access to only those who are authorized to have it.  Common forms of physical access controls are the use of security guard and the lock (including many new variations of the combination locks)

 Physical security consist of all the mechanisms used to ensure that physical access to the computers and the networks is restricted to only authorized users.  Physical security adds an extra layer of security and protects the sensitive data.

 Physical barriers provide the outmost security.  These barriers are highly visible to the public.

 Biometrics is a more sophisticated access control approach.  Examples – fingerprint readers, retinal & iris scan, voice samples.  Biometric solutions are very expensive to implement.

 Social engineering is the process of convincing an authorized individual to provide confidential information or access to an unauthorized individual.  Social engineering exploits the weakest point in the security perimeter – humans.  The ultimate goal of social engineering is to gradually obtain the pieces of information.

 The best way to stop social engineering is through training all the employees and instructing not to give out any piece of information.  Data Aggregation - Small and seemingly “unimportant” information may be combined with other pieces of information to potentially divulge sensitive information.

 Environmental issues deals with the general operating conditions, within which an organization operates.  Environmental issues include items like heating, ventilation, air conditioning, electrical power and the “natural forces”.  Environmental factors are used to maintain the comfort of an office environment.

 In case of electric power outage, UPS can be critical.  If natural disasters are common, having a complete backup plan is must.  In some cases, a separate off-site location can also me used.

 Fire is one of the most common reasons for the loss of data in an organization.  Common ways of fighting the fire are: ◦ Water bases fire suppression systems ◦ Chemical based fire suppression systems ◦ Handheld fire suppression systems ◦ Fire detection systems

 Very commonly used systems.  Can have adverse effects of computer and electrical systems.

 Clean Agent Fire Suppression Systems. ◦ Uses CO 2 ◦ Safe for general usage  Halon Bases Fire Suppression System ◦ Not used anymore ◦ Very dangerous on human health

Class of FireType of FireExample of Combustible Material Examples of Suppression Methods A Common Combustibles Wood, Paper, ClothWater and dry chemicals B Combustible LiquidsPetroleum ProductsCO 2 or dry chemicals C ElectricalElectrical Wiring and equipments CO 2 or dry chemicals D Flammable MetalsMagnesium, TitaniumCopper metal or sodium chloride

 Fire detection devices are of several types ◦ Smoke Activated ◦ Temperature Activated ◦ Flame Activated

 Wireless environment provides portability.  Wireless networks are prone to security threats, if not properly secured.