Auditing for Security Management By Cyril Onwubiko Network Security Analyst at COLT Telecom Invited Guest Lecture delivered at London Metropolitan University, for the MSc in IT Security Students. A copy of this presentation is available at London Metropolitan University

 Background  Practice  Audit Trail Analysis Overview

London Metropolitan University Background

Networking and Communications Group Problem Statement To asses the effectiveness of an organisation ability to protect its valued/critical asset:  To asses the effectiveness of an organisation ability to protect its valued/critical asset:  To Evaluate/Examine:  Policy  Processes and Procedures  Operations London Metropolitan University Context Why Security Audit is performed to ensure:  Security Audit is performed to ensure:  Compliance with Standards & Laws  Valued assets are protected  To Recommend:  Improvement and Enforce Controls

Practice London Metropolitan University

Networking and Communications Group General Concept London Metropolitan University Auditing Security Policy Backup controls Logging & Monitoring Data Protection System and Network Protection Disaster Recovery Compliance Web Usage & Filtering Security Threats Security Vulnerability Business Continuity Physical Access

Networking and Communications Group Things to Consider before an Audit?  Who to Use:  Internal Auditor  External Auditor  Type of Audit:  IS Technical: - Minimise Loss/Failure  IS Efficiency: - Minimise Costs and Increase RoI  IS Assessment: - Certification & Compliance  Software Assessment: - Inventory/People/Performance  Information Security: - Verify Compliance/Best Practices.  Guarantee:  Due Care London Metropolitan University

Networking and Communications Group  Authority:  ISACA: Information Security Audit & Control Association  Recommend Computer Systems Audit and controls.  Example: COBIT - Control Objectives for Information & related Technology (IT Governance Institute)  Laws:  HIPAA: Health Insurance Portability & Accountability Act  Responsible for ensuring health information are protected and secured.  Protected Health Information (PHI) Guidelines London Metropolitan University

Networking and Communications Group  Laws:  GLBA: Gramm-Leach-Bliley Act  Financial Section guideline for IS Controls  Provides Risk Management Controls  CISAA: Corporate Information Security Accountability Act  Information Security Accountability Controls  GAISP – Generally accepted information security principles  CSBIA: California Security Breach Information Act  Disclosure of security breaches  Responsible to: Shareholders, Customers & 3rd parties. Guidelines-2 London Metropolitan University

Networking and Communications Group Audit Trail Analysis

Networking and Communications Group Security Audit London Metropolitan University Audit How?Who?What?When?Where?Which?

Networking and Communications Group  A collection of logged Computer Network Events:  Comprising of –  Operating System,  Application and  User Activities  Example :  Syslog, Sulog, Lastlog and EventViewer Audit Trail Analysis Audit Trail: London Metropolitan University

Networking and Communications Group Audit Policy Fig. 1: Event Viewer London Metropolitan University Fig. 2: Audit Policy

Networking and Communications Group Data Analysers  Intrusion Detection Systems  Integrity Checks – Example Tripwire  Security Information Management Systems – Example Arcsight & SEC  Accountability Tools – Example RADIUS & Loglogic  Investigation – Security Forensic  Recovery – Business Continuity, Backup Controls London Metropolitan University

Sample Event Log – Anonymity~ised London Metropolitan University more./messages | grep backupuser Mar 20 05:21: Mar :40:04: %PIX : User logged in: Uname: backupuser Mar 20 05:21: Mar :45:56: %PIX : SSH session from on interface testbackup-mgmt for user "backupuser" Mar 20 05:21: Mar :59:59: %PIX : Authentication succeeded for user 'backupuser' from /24936 to /22 on interface testbackup-mgmt Mar 20 05:21: Mar :59:59: %PIX : Login permitted from /24936 to testbackup-mgmt: /ssh for user "backupuser"

Networking and Communications Group Correlation London Metropolitan University Event 1Event 2 Event 3 Incident Fig. 3: Events correlated to an incident h4 h2 h5 h3 h1 Fig. 4: Example of a Port scan incident

 SEC (Simple Event Correlator)  OS-SIM (Open Source Security Information Management)  PADS (Passive Asset Detection Systems)  SNORT – Open Source IDS  BASE (Basic Analysis Security Engine), E.g. Alert Management Open Source Initiatives  Software  PreventSys – McAfee PreventSys Risk and Compliance Audit  QualysGuard Consultant  Proactive Monitoring Technique: London Metropolitan University

Networking and Communications Group Conclusion  Audit for management aims to evaluate:  Policies, practices and operations  For compliance, detection, protection and forensic.  Requires Tools and Techniques  Recommendations:  Periodic security audit to assess if security needs are satisfied  Make contingency, business continuity and disaster recovery plans in case controls fail. London Metropolitan University

Networking and Communications Group Resources/References 1.CEE: Common Event Expression 2.PreventSys QualysGuard Consultant CAPEC: Common Attack Pattern Enumeration and Classification ATFG: Audit Trails Format Group SEC: Simple Event Correlator BASE: Basic Analysis and Security Engine ISACA – 9.COBIT – 10.HIPAA - London Metropolitan University

Networking and Communications Group Question & Answer Thank-You Author’s Contact: A copy of this presentation is available at: London Metropolitan University