Chapter 6 of the Executive Guide manual Technology

Intro & Overview Its’ important to deploy few products successfully than to implement all security product with minimal success. Its also important to have process and procedures to ensure on-going effectiveness of security products implemented. You must evaluate current environment to plan for future desire environment. Need to assess technology strategy, components and administration to determine effectiveness of Security program

Technology Strategy Constant changes in business requires IT regularly update it’s IT security strategy as well. IT architecture should address best practice & growth opportunities via Zone & Layering security schema. – Zone & Layering restrict access & protect critical systems at the gateway, servers & client levels.

Technology Components Complexity of deployed technology depends on the business and maturity of the security program. Basic technology starts with Authentication, Authorization and Accounting (AAA) Then anti-virus, firewalls – Anti-virus can protects the gateway, server & client – Firewall filter for authorized traffic

Technology Components Cont. Vulnerability management & intrusion detection/prevention (IDS/IPS) tools works to monitor and protect systems against viruses/intrusions. Small Co may not have the resources or tools necessary to security information assets. Outsource is a option but make sure to do Due Diligence on the vendor to ensure they meet your requirements.

Technology Administration Independent evaluation of your security program is important and can include: – Penetration tests – Risk assessment – Audits Metrics reporting is critical to provide Executive Management and Board for their support & funding Change management is important to stay current on changing threats & requirements.

Design Future state of Technology Strategy Separate your infrastructure into digital zones and layering Digital zone is to divide environment into zones with defined security levels & priority. – Mission critical zone requiring highest level of security standards to be applied – Critical zone requiring medium security application See Figure 6-1 for graphic layout

Extranet Allows customers and business partners to access limited resources to conduct business Extranet connects to the Internet so it’s best practice to deploy a few tools including: – Network-based intrusion detection – Network vulnerability management – Host – based intrusion detection – Network- intrusion prevention

Intranet This is where most normal front-end business activities are processed by employee, contractors, consultants, business partners… Deployed security should include – Role base user administrations (access based on job responsibilities and least privilege concept) – Access control with user ID and password at minimum – Required periodic password changes – Deactivate account after 60 days of inactivates – Connection Scan

Mission-Critical Zone This zone contains critical applications, databases, systems that is vital to the continued operation of your business. Security controls should include: – Full suite of intrusion detection/prevention and vulnerability management tools. – Updated anti-virus tools – Restricted access and periodic monitoring of privilege accounts – System performance monitoring – Daily/Weekly back up

Defense-in-Depth Gateway, Server & Clients level Gateway- connection btw sections of systems Security controls should include: – Firewalls, – Anti-virus – DMZ area – Honeypot – Monitoring

Server Share computer that performs functions for multiple end users (printers, ERP applications, databases, etc.). Security controls should includes: – Anti-virus – Intrusion detection/prevention – Vulnerability management tools – Back-up & recovery – Capacity monitoring – Access controls

Client Individual laptops, desktops, PDAs Security controls should/can includes: – Anti-virus – Encryption – Access Controls – Image scan – Restrict external storage connections – Time-out screen lock – Monitoring

Mixed Solutions Select the tools the can integrate & support your organization model Implement a few good tools well Monitor and fine-tune the tools for effective security controls End Goal is to Be Open yet Secure

Practical Deployment of Technology Authentication/Authorization/Accounting Firewalls Anti-Virus Vulnerability Management IDS/IPS

Technology Administration Regular scaning & remediation program Periodic penetration tests Audit of information security program Regular updates of anti-virus Change management Metric & Report to Executive Management & Board

Technology summary Technology is an essential component of Information Security program Program must support current and future business models Basic security includes AAA, firewalls, anti-virus, vulnerability management, IDS/IPS, encryption, monitoring Regular risk assessment, vulnerability scans, pen test is important to ensure security program remains effective. Metrics & report to Executive get support & resource for program.