IT-Secrurity Cookbook Enter your login: Enter your password:

What is IT-Securiry Protection of information, systems and services Against disasters, mistakes and manipulation So that likelihood and impact of security incidents is minimised

IT-Security consists of Confidentiality Sensitive business objects Disclosed ONLY to authorised persons Integrity Control modification of objects Ensure that objects are accurate and complete Availability Ensure reliability of services Legal Compliance Legislation of relevant countries

IT-Security - Exercise Confidentiality Integrity Availability Legal Compliance Two persons – discuss and present eksamples of the different types of security concepts listed above.

The Network is the Computer Common causes of damage: Human error52% Fire15% Water10% Dishonest people10% Technical Sabotage10% Terrorism3%

The Network is the Computer Who Causes damage? Current employees81% Outsiders13% Former employees6%

The Network is the Computer Types of computer crime Money Theft44% Damage to software16% Theft of information16% Alteration af data12% Theft og services10% Trespass2%

How to improve security Knowing what need to be protected Recognising the threats Judging possible impacts Calculating the risks Counter measures Develop startegy to reduce risks

Important to observe When improving security remember: Keep it simple Keep it coherent (logical links) Keep to standards Your improvements should be able to function in a crisis situation, where people have no time to think deeply!

Bottom-UP approach If you know WHAT to protect from WHOM and to WHAT DEGREE: Create an attack situation (i.e. as if you were the attacker) Summarize weaknesses Judge the impacts Create counter measures

Top-Down Approach Start analysing – creating an overview: Define security objectives and analyse threats Make an impact analysis Calculate risk Analyse constraints (from environment) Decide on counter strategy Implement

Calculations! Calculate the risk: Risk = impact * likelihood Risk = impact + likelihood + threats

Risk planning Description of the risk Costs/ impacts 1(Low) – 5(High) Possibility 1(Low) – 5(High) ImpactsIndica- tors Mitigra-tion strategy Contin- gencyplan Tot- al prio rity Virus and worms 43System stop Slow systems Malfunctio ns System log entries Slow systems Virus protec-tion program- mes Firewall Safe backup Re- installation plan 12 Minor natural disasters 51Damage to HW and SW Rain Storm Remote Backup Re- installation plan 5

Security Isues - Exercise Give some examples of security isues based on your project organisation. Use the scheme from the previus slide.

Security Organization Roles and responsibilities: Executives: security strategy IT-Security Manager: guidelines, risk analysis Line Managers: awareness of policies Users: responsible for their actions Auditor: independent person

Security Processes Security hotline Change management System monitoring Intruder detection (”uninvited” guests) Data backup and recovery Systems audits

Crisis Management ”Firecall”: Who is on ”firecall” If ”firecall” can´t solve it: Who is ”emergency standby” Crisis management: Who will be in charge of crisis management on the spot (decide in beforehand on a chain of command) Keep a list of crisis staff off-line!

Information Classification Availability classification Classify as to: Maximum allowed server downtime per event Expected availability percentage Sensitivity classification Decide on a concept Decide on who is to declare sensitivity

Sensitivity Classification Concept Concept: All data has an owner The owner must classify the information The owner is responsible for the information All documents should be classified Classification: Public / non classified information Internal information Confidential information Secret information

Requirements on systems System model i layers: Physical: Buildings, hardware Users and organization Application Network and communication Database or transaction monitor Operating system

Requirements to each class Public / non classified data A virus scanner, screen locking, only authorised persons allowed access Internal data Security design philosophy Systems architecture Confidential data Trusted facility manual Secure data transmission Secret data Process isolation, security testing and testing Mandatory access control