Security in Practice Enterprise Security

Business Continuity Ability of an organization to maintain its operations and services in the face of a disruptive event –Computer attack –Natural disaster Many organizations are either unprepared or have not tested their plans Common elements –Redundancy planning –Disaster recovery procedures –Incident response procedures 2

Redundancy Planning Building excess capacity in order to protect against failures Servers –Protect against single point of failure –Redundant servers or parts May take too long to get back online –Server cluster Design the network infrastructure so that multiple servers are incorporated into the network Types: asymmetric and symmetric 3

Redundancy Planning (cont’d.) Server cluster 4

Redundancy Planning (cont’d.) Storage –Hard disk drives often are the first component of a system to fail –Implement RAID (Redundant Array of Independent Drives) technology Uses multiple hard disk drives for increased reliability and performance 5

Redundancy Planning (cont’d.) Networks –Redundant network ensures that network services are always accessible –Virtually all network components can also be duplicated 6

Redundancy Planning (cont’d.) Power –Uninterruptible power supply (UPS) Device that maintains power to equipment in the event of an interruption in the primary electrical power source On-line Off-line –Backup generator 7

Redundancy Planning (cont’d.) Sites –Hot site Run by a commercial disaster recovery service Allows a business to continue computer and network operations to maintain business continuity –Cold site Provides office space Customer must provide and install all the equipment needed to continue operations 8

Redundancy Planning (cont’d.) –Warm site All of the equipment installed Does not have active Internet or telecommunications facilities Does not have current backups of data 9

Disaster Recovery Procedures Procedures and processes for restoring an organization’s operations following a disaster Focuses on restoring computing and technology resources to their former state Planning –Disaster recovery plan (DRP) Written document Details the process for restoring computer and technology resources 10

Disaster Recovery Procedures (cont’d.) Common features of DRP –Purpose and scope –Recovery team –Preparing for a disaster –Emergency procedures –Restoration procedures 11

Disaster Recovery Procedures (cont’d.) Sample from a DRP 12

Disaster Recovery Procedures (cont’d.) Disaster exercises –Test the effectiveness of the DRP –Objectives Test the efficiency of interdepartmental planning and coordination in managing a disaster Test current procedures of the DRP Determine the strengths and weaknesses in disaster responses 13

Disaster Recovery Procedures (cont’d.) Enterprise data backups –Significantly different than those for a home user –Disk to disk (D2D) –Continuous data protection (CDP) 14

Incident Response Procedures What is forensics? –Forensics Application of science to questions that are of interest to the legal profession –Computer forensics Attempt to retrieve information that can be used in the pursuit of the attacker or criminal Importance of computer forensics is due in part to –High amount of digital evidence –Increased scrutiny by the legal profession –Higher level of computer skill by criminals 15

Incident Response Procedures (cont’d.) Responding to a computer forensics incident –Secure the crime scene Response team must be contacted immediately Document physical surroundings Take custody of computer Interview users and document information –Preserve the evidence First capture any volatile data –Random access memory (RAM) Mirror image backup or bit-stream backup 16

Incident Response Procedures (cont’d.) –Establish the chain of custody Documents that the evidence was under strict control at all times No unauthorized person was given the opportunity to corrupt the evidence –Examine the evidence Mirror image is examined to reveal evidence Mine and expose hidden clues –Windows page file –Slack –Metadata 17

Slack 18

Security Policies Plans and policies must be established by the organization –To ensure that people correctly use the hardware and software defenses Organizational security policy 19

What Is a Security Policy? Document that outlines the protections that should be enacted Functions –Communicates organization’s information security culture and acceptable information security behavior –Detail specific risks and how to address them –Help to create a security-aware organizational culture –Ensure that employee behavior is directed and monitored to ensure compliance with security requirements 20

Balancing Trust and Control Approaches to trust –Trust everyone all of the time –Trust no one at any time –Trust some people some of the time Deciding on the level of control for a specific policy is not always clear Not all users have positive attitudes toward security policies 21

Balancing Trust and Control (cont’d.) Possible negative attitudes toward security 22

Designing a Security Policy Definition of a policy –Characteristics Communicate a consensus of judgment Define appropriate behavior for users. Identify what tools and procedures are needed Provide directives for Human Resource action in response to inappropriate behavior May be helpful in the event that it is necessary to prosecute violators 23

Designing a Security Policy (cont’d.) Due care –Obligations imposed on owners and operators of assets –Exercise reasonable care of the assets and take necessary precautions to protect them –Care that a reasonable person would exercise under the circumstances –Examples 24

Designing a Security Policy (cont’d.) The security policy cycle –Three-phase cycle Performing a risk management study –Asset identification –Threat identification –Vulnerability appraisal –Risk assessment –Risk mitigation Creating a security policy based on the information from the risk management study Reviewing the policy for compliance 25

Designing a Security Policy (cont’d.) Security policy cycle 26

Types of Security Policies Acceptable use policy (AUP) –Defines the actions users may perform while accessing systems and networking equipment –Unacceptable use may also be outlined by the AUP Security-related human resource policy –Include statements regarding how an employee’s information technology resources will be addressed –Presented at an orientation session when the employee is hired –May contain due process statement 27

Types of security policies 28

Types of Security Policies (cont’d.) Personally identifiable information (PII) policy –Outlines how the organization uses personal information it collects Disposal and destruction policy –Addresses the disposal of resources that are considered confidential 29

Types of Security Policies (cont’d.) Sample PII (privacy) policy 30

Types of Security Policies (cont’d.) Ethics policy –Refocus attention on ethics in the enterprise –Written code of conduct –Central guide and reference for employees in support of day-to-day decision making 31

Summary Redundancy planning –Building excess capacity in order to protect against failures Disaster recovery –Procedures and processes for restoring an organization’s operations following a disaster Forensic science –Application of science to questions that are of interest to the legal profession 32

Summary (cont’d.) Security policy –Written document that states how an organization plans to protect the company’s information technology assets 33