Chapter 11: Policies and Procedures Security+ Guide to Network Security Fundamentals Second Edition.

Slides:



Advertisements
Similar presentations
CWSP Guide to Wireless Security
Advertisements

Information Privacy and Data Protection Lexpert Seminar David YoungDecember 9, 2013 Breach Prevention – Due Diligence and Risk Reduction.
S3-1 © 2001 Carnegie Mellon University OCTAVE SM Process 3 Identify Staff Knowledge Software Engineering Institute Carnegie Mellon University Pittsburgh,
HIPAA: FEDERAL REGULATIONS REGARDING PATIENT SECURITY.
ICS 417: The ethics of ICT 4.2 The Ethics of Information and Communication Technologies (ICT) in Business by Simon Rogerson IMIS Journal May 1998.
Smart Grid - Cyber Security Small Rural Electric George Gamble Black & Veatch
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 14 Security Policies and Training.
1 INTERNAL CONTROLS A PRACTICAL GUIDE TO HELP ENSURE FINANCIAL INTEGRITY.
9-Performing Vulnerability Assessments Dr. John P. Abraham Professor UTPA.
Security Controls – What Works
Security Awareness: Applying Practical Security in Your World
Security+ Guide to Network Security Fundamentals, Fourth Edition
Laboratory Personnel Dr/Ehsan Moahmen Rizk.
Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 1 Unit Outline Qualitative.
Security Awareness: Applying Practical Security in Your World, Second Edition Chapter 6 Enterprise Security.
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 9 Performing Vulnerability Assessments.
ISO 17799: Standard for Security Ellie Myler & George Broadbent, The Information Management Journal, Nov/Dec ‘06 Presented by Bhavana Reshaboina.
Auditing A Risk-Based Approach To Conducting A Quality Audit
Principles of Information Security, 2nd Edition1 Risk Management.
Computer Security: Principles and Practice
Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 1 Unit Outline Information.
Risk Management.
Session 3 – Information Security Policies
Network security policy: best practices
Internal Auditing and Outsourcing
Information Security Compliance System Owner Training Richard Gadsden Information Security Office Office of the CIO – Information Services Sharon Knowles.
Chapter 11: Policies and Procedures
SEC835 Database and Web application security Information Security Architecture.
Basics of OHSAS Occupational Health & Safety Management System
Information Systems Security Computer System Life Cycle Security.
Security in Practice Enterprise Security. Business Continuity Ability of an organization to maintain its operations and services in the face of a disruptive.
Security Architecture
Important acronyms AO = authorizing official ISO = information system owner CA = certification agent.
Policy Review (Top-Down Methodology) Lesson 7. Policies From the Peltier Text, p. 81 “The cornerstones of effective information security programs are.
INFORMATION SECURITY & RISK MANAGEMENT SZABIST – Spring 2012.
April 14, A Watershed Date in HIPAA Privacy Compliance: Where Should You Be in HIPAA Security Compliance and How to Get There… John Parmigiani National.
PRIVACY, SECURITY & ID THEFT PREVENTION - TIPS FOR THE VIGILANT BUSINESS - SMALL BUSINESS & ECONOMIC DEVELOPMENT FORUM October 21, WITH THANKS TO.
John Carpenter & lecture & Information Security 2008 Lecture 1: Subject Introduction and Security Fundamentals.
IT Professionalism Ethics Modified by Andrew Poon.
Security Policies and Procedures. cs490ns-cotter2 Objectives Define the security policy cycle Explain risk identification Design a security policy –Define.
Chapter 1 Overview The NIST Computer Security Handbook defines the term Computer Security as:
Security+ Guide to Network Security Fundamentals, Third Edition Chapter 9 Performing Vulnerability Assessments.
Database Security and Auditing: Protecting Data Integrity and Accessibility Chapter 1 Security Architecture.
.  Define risk and risk management  Describe the components of risk management  List and describe vulnerability scanning tools  Define penetration.
Alaa Mubaied Risk Management Alaa Mubaied
Slides copyright 2010 by Paladin Group, LLC used with permission by UMBC Training Centers, LLC.
Data Governance 101. Agenda  Purpose  Presentation (Elijah J. Bell) Data Governance Data Policy Security Privacy Contracts  FERPA—The Law  Q & A.
Introduction to Information Security
Chapter 16 Presented By: Stephen Lambert Disaster Recovery and Business Continuity.
Policies and Procedures Security+ Guide to Network Security Fundamentals Chapter 11.
Networked Systems Survivability CERT ® Coordination Center Software Engineering Institute Carnegie Mellon University Pittsburgh, PA © 2002 Carnegie.
ISO/IEC 27001:2013 Annex A.8 Asset management
International Security Management Standards. BS ISO/IEC 17799:2005 BS ISO/IEC 27001:2005 First edition – ISO/IEC 17799:2000 Second edition ISO/IEC 17799:2005.
Database Security and Auditing: Protecting Data Integrity and Accessibility Chapter 1 Security Architecture.
Chap 8: Administering Security.  Security is a combination Technical – covered in chap 1 Administrative Physical controls SE571 Security in Computing.
Chapter 3: Business Continuity Planning. Planning for Business Continuity Assess risks to business processes Minimize impact from disruptions Maintain.
Important acronyms AO = authorizing official ISO = information system owner CA = certification agent.
INFORMATION ASSURANCE POLICY. Information Assurance Information operations that protect and defend information and information systems by ensuring their.
Risk Controls in IA Zachary Rensko COSC 481. Outline Definition Risk Control Strategies Risk Control Categories The Human Firewall Project OCTAVE.
Principles of Information Security, Fourth Edition Risk Management Ch4 Part I.
CompTIA Security+ Study Guide (SY0-401)
CompTIA Security+ Study Guide (SY0-401)
Security Standard: “reasonable security”
COMP3357 Managing Cyber Risk
IS4680 Security Auditing for Compliance
DIGITAL BUSINESS APPLICATIONS
CompTIA Security+ Study Guide (SY0-501)
Cybersecurity compliance for attorneys
IS4680 Security Auditing for Compliance
Presentation transcript:

Chapter 11: Policies and Procedures Security+ Guide to Network Security Fundamentals Second Edition

Security+ Guide to Network Security Fundamentals, 2e 2 Objectives Define the security policy cycle Explain risk identification Design a security policy Define types of security policies Define compliance monitoring and evaluation

Security+ Guide to Network Security Fundamentals, 2e 3 Understanding the Security Policy Cycle First part of the cycle is risk identification Risk identification seeks to determine the risks that an organization faces against its information assets That information becomes the basis of developing a security policy A security policy is a document or series of documents that clearly defines the defense mechanisms an organization will employ to keep information secure

Security+ Guide to Network Security Fundamentals, 2e 4 Understanding the Security Policy Cycle (continued)

Security+ Guide to Network Security Fundamentals, 2e 5 Reviewing Risk Identification First step in security policy cycle is to identify risks Involves the four steps: –Inventory the assets –Determine what threats exist against the assets and by which threat agents –Investigate whether vulnerabilities exist that can be exploited –Decide what to do about the risks

Security+ Guide to Network Security Fundamentals, 2e 6 Reviewing Risk Identification (continued)

Security+ Guide to Network Security Fundamentals, 2e 7 Asset Identification An asset is any item with a positive economic value Many types of assets, classified as follows: –Physical assets– Data –Software– Hardware –Personnel Along with the assets, attributes of the assets need to be compiled

Security+ Guide to Network Security Fundamentals, 2e 8 Asset Identification (continued) After an inventory of assets has been created and their attributes identified, the next step is to determine each item’s relative value Factors to be considered in determining the relative value are listed on pages 386 and 387 of the text

Security+ Guide to Network Security Fundamentals, 2e 9 Threat Identification A threat is not limited to those from attackers, but also includes acts of God, such as fire or severe weather Threat modeling constructs scenarios of the types of threats that assets can face The goal of threat modeling is to better understand who the attackers are, why they attack, and what types of attacks may occur

Security+ Guide to Network Security Fundamentals, 2e 10 Threat Identification (continued) A valuable tool used in threat modeling is the construction of an attack tree An attack tree provides a visual image of the attacks that may occur against an asset

Security+ Guide to Network Security Fundamentals, 2e 11 Threat Identification (continued)

Security+ Guide to Network Security Fundamentals, 2e 12 Vulnerability Appraisal After assets have been inventoried and prioritized and the threats have been explored, the next question becomes, what current security weaknesses may expose the assets to these threats? Vulnerability appraisal takes a current snapshot of the security of the organization as it now stands

Security+ Guide to Network Security Fundamentals, 2e 13 Vulnerability Appraisal (continued) To assist with determining vulnerabilities of hardware and software assets, use vulnerability scanners These tools, available as free Internet downloads and as commercial products, compare the asset against a database of known vulnerabilities and produce a discovery report that exposes the vulnerability and assesses its severity

Security+ Guide to Network Security Fundamentals, 2e 14 Risk Assessment Final step in identifying risks is to perform a risk assessment Risk assessment involves determining the likelihood that the vulnerability is a risk to the organization Each vulnerability can be ranked by the scale Sometimes calculating anticipated losses can be helpful in determining the impact of a vulnerability

Security+ Guide to Network Security Fundamentals, 2e 15 Risk Assessment (continued) Formulas commonly used to calculate expected losses are: –Single Loss Expectancy –Annualized Loss Expectancy An organization has three options when confronted with a risk: –Accept the risk –Diminish the risk –Transfer the risk

Security+ Guide to Network Security Fundamentals, 2e 16 Risk Assessment (continued)

Security+ Guide to Network Security Fundamentals, 2e 17 Designing the Security Policy Designing a security policy is the logical next step in the security policy cycle After risks are clearly identified, a policy is needed to mitigate what the organization decides are the most important risks

Security+ Guide to Network Security Fundamentals, 2e 18 What Is a Security Policy? A policy is a document that outlines specific requirements or rules that must be met –Has the characteristics listed on page 393 of the text –Correct vehicle for an organization to use when establishing information security A standard is a collection of requirements specific to the system or procedure that must be met by everyone A guideline is a collection of suggestions that should be implemented

Security+ Guide to Network Security Fundamentals, 2e 19 Balancing Control and Trust To create an effective security policy, two elements must be carefully balanced: trust and control Three models of trust: –Trust everyone all of the time –Trust no one at any time –Trust some people some of the time

Security+ Guide to Network Security Fundamentals, 2e 20 Designing a Policy When designing a security policy, you can consider a standard set of principles These can be divided into what a policy must do and what a policy should do

Security+ Guide to Network Security Fundamentals, 2e 21 Designing a Policy (continued)

Security+ Guide to Network Security Fundamentals, 2e 22 Designing a Policy (continued) Security policy design should be the work of a team and not one or two technicians The team should have these representatives: –Senior level administrator –Member of management who can enforce the policy –Member of the legal staff –Representative from the user community

Security+ Guide to Network Security Fundamentals, 2e 23 Elements of a Security Policy Because security policies are formal documents that outline acceptable and unacceptable employee behavior, legal elements are often included in these documents The three most common elements: –Due care –Separation of duties –Need to know

Security+ Guide to Network Security Fundamentals, 2e 24 Elements of a Security Policy (continued)

Security+ Guide to Network Security Fundamentals, 2e 25 Due Care Term used frequently in legal and business settings Defined as obligations that are imposed on owners and operators of assets to exercise reasonable care of the assets and take necessary precautions to protect them

Security+ Guide to Network Security Fundamentals, 2e 26 Separation of Duties Key element in internal controls Means that one person’s work serves as a complementary check on another person’s No one person should have complete control over any action from initialization to completion

Security+ Guide to Network Security Fundamentals, 2e 27 Need to Know One of the best methods to keep information confidential is to restrict who has access to that information Only that employee whose job function depends on knowing the information is provided access

Security+ Guide to Network Security Fundamentals, 2e 28 Types of Security Policies Umbrella term for all of the subpolicies included within it In this section, you examine some common security policies: –Acceptable use policy –Human resource policy –Password management policy –Privacy policy –Disposal and destruction policy –Service-level agreement

Security+ Guide to Network Security Fundamentals, 2e 29 Types of Security Policies (continued)

Security+ Guide to Network Security Fundamentals, 2e 30 Types of Security Policies (continued)

Security+ Guide to Network Security Fundamentals, 2e 31 Types of Security Policies (continued)

Security+ Guide to Network Security Fundamentals, 2e 32 Acceptable Use Policy (AUP) Defines what actions users of a system may perform while using computing and networking equipment Should have an overview regarding what is covered by this policy Unacceptable use should also be outlined

Security+ Guide to Network Security Fundamentals, 2e 33 Human Resource Policy Policies of the organization that address human resources Should include statements regarding how an employee’s information technology resources will be addressed

Security+ Guide to Network Security Fundamentals, 2e 34 Password Management Policy Although passwords often form the weakest link in information security, they are still the most widely used A password management policy should clearly address how passwords are managed In addition to controls that can be implemented through technology, users should be reminded of how to select and use passwords

Security+ Guide to Network Security Fundamentals, 2e 35 Privacy Policy Privacy is of growing concern among today’s consumers Organizations should have a privacy policy that outlines how the organization uses information it collects

Security+ Guide to Network Security Fundamentals, 2e 36 Disposal and Destruction Policy A disposal and destruction policy that addresses the disposing of resources is considered essential The policy should cover how long records and data will be retained It should also cover how to dispose of them

Security+ Guide to Network Security Fundamentals, 2e 37 Service-Level Agreement (SLA) Policy Contract between a vendor and an organization for services Typically contains the items listed on page 403

Security+ Guide to Network Security Fundamentals, 2e 38 Understanding Compliance Monitoring and Evaluation The final process in the security policy cycle is compliance monitoring and evaluation Some of the most valuable analysis occurs when an attack penetrates the security defenses A team must respond to the initial attack and reexamine security policies that address the vulnerability to determine what changes need to be made to prevent its reoccurrence

Security+ Guide to Network Security Fundamentals, 2e 39 Incidence Response Policy Outlines actions to be performed when a security breach occurs Most policies outline composition of an incidence response team (IRT) Should be composed of individuals from: –Senior management– IT personnel –Corporate counsel– Human resources –Public relations

Security+ Guide to Network Security Fundamentals, 2e 40 Incidence Response Policy (continued)

Security+ Guide to Network Security Fundamentals, 2e 41 Ethics Policy Codes of ethics by external agencies have encouraged its membership to adhere to strict ethical behavior within their profession Codes of ethics for IT professionals are available from the Institute for Electrical and Electronic Engineers (IEEE) and the Association for Computing Machinery (ACM), among others Main purpose of an ethics policy is to state the values, principles, and ideals each member of an organization must agree to

Security+ Guide to Network Security Fundamentals, 2e 42 Summary The security policy cycle defines the overall process for developing a security policy There are four steps in risk identification: –Inventory the assets and their attributes –Determine what threats exist against the assets and by which threat agents –Determine whether vulnerabilities exist that can be exploited by surveying the current security infrastructure –Make decisions regarding what to do about the risks

Security+ Guide to Network Security Fundamentals, 2e 43 Summary (continued) A security policy development team should be formed to create the information security policy An incidence response policy outlines actions to be performed when a security breach occurs A policy addressing ethics can also be formulated by an organization