ICT Security Policies Security Policies What is Security?What is a policy? The aims or plan of action of a person or group. School OED Precaution against theft. School OED Keeping something safe and secure. What do we need to apply policies to?

ICT Security Policies ICT Systems What are the main features of an ICT system in a business?

ICT Security Policies ICT systems in a business consist of: Hardware (Computers, monitors, peripherals) Software (Operating systems, applications) Data ( The information the company needs in order to work ie customer orders) Data Storage (Hard drives, CD, DVD, flash memory) Communication (Networking, Intranet, Internet) People who use them (Key to disk operators, managers) What are the threats to data and systems?

ICT Security Policies Threats to data Deliberate Terrorism Criminal vandalism/sabotage White collar crime (Theft) Accidental Floods and fire, Accidental altering of data Natural disasters

ICT Security Policies Companies must Ensure data, hardware and software is not lost or damaged. Restore communication systems as quickly as possible in the event of a problem. What are the possible consequence of these threats becoming a reality?

ICT Security Policies Any of the threats previously mentioned could result in the loss of systems and data; leaving the organisation unable to function. The organisation could suffer:- Loss of income; Catalogue firm who cannot access orders data. Loss of business reputation; An insurance company not able to process claims from their customers Legal Action; Prosecution under DPA, Computer Misuse Act Consequences

ICT Security Policies Deliberate Threats Terrorism e,g Oklahoma bomber Oklahoma Federal Building on April 19th, 1995 destroyed federal records. Criminal vandalism/sabotage e.g. the deliberate destruction of network servers by putting on viruses. Theft of data by employees to sell to competitors White collar crime such as the deliberate altering of data in a database e,g, transferring funds from company accounts into private accounts.

ICT Security Policies Accidental Threats Floods and fire, e.g when the Buncefield oil terminal blew up it destroyed the company records in a nearby industrial estate Accidental altering of data e.g. by inexperienced employees deleting an order in a customer files Natural disasters such as the Tsunami destroyed population birth death bank records. How can we prevent against these?

ICT Security Policies Prevent accidental loss Accidental destruction of files due to fire, terrorism, floods Backup systems must be described keep back up files - offsite - and in fireproof containers use an online tape or disc streamer which automatically backs up data on a network use grandfather father son security system in batch processing systems. e.g. payroll RAID systems – mirror discs (Redundant Array of Inexpensive Disc) Accidental destruction of files due to human error etc. Validation and verification measures Prevent overwriting Level of access and rights make hard discs read only

ICT Security Policies How can we prevent deliberate threats? (which include)

ICT Security Policies Prevention of malicious damage Hacking unauthorised access Spreading of a computer crime Computer fraud Physical destruction by vandalism and terrorism

ICT Security Policies Hacking – unauthorised access Prevention Define security status and access rights for users All authorised users should be given user names and passwords. This will limit unauthorised access to the network. Hierarchy of Passwords IdentificationUser Name Authentification Password Authorisation What files you can see and what your allowed to do Restrict physical access to files e.g. smart cards to control entrance to rooms. Secured areas to hold servers

ICT Security Policies Prevention of malicious damage……Hacking Cont. Biometric scans; such as voice or hand prints; retina scans; Firewalls; a special environment set up to trap a hacker logging in over remote connections. It authenticates messages coming into the network and verifies the legitimacy of the user to enter the network. Proxy servers; This device tries to stop intruders from identifying the IP (Internet Protocol) address of a user workstation accessing the Internet.

ICT Security Policies Call Back procedures Some companies operate a dial-back system. A user logs on to a computer which immediately disconnects the line and dials the user back. This would stop a user logging on with someone else's password. Encryption Data transmitted over a network is coded before transmission. This means that anybody intercepting the transmitted data would not be able to understand it. The data needs to be de-coded by the proper recipient. Prevention of malicious damage……Hacking Cont.

ICT Security Policies Spreading a computer virus Prevention Don’t’ download unknown programs from the Internet attachments straight to hard disc. Only use reputable sources. Write protect media so can’t be written onto Don’t copy illegal software Use a virus scanning software and virus eradication program. Make sure this is kept up to date with the latest virus definitions – available from the Internet. Use diskless workstations on networks These are programs introduced into computer systems which destroy or alter files by rewriting over data or by copying themselves over and over again until computer system is full and cannot continue.

ICT Security Policies Computer fraud – white-collar crime Bogus data entry when entering data (fictitious bank customer) Bogus output -output may be destroyed to prevent discovery of fraudulent data entry or processing Alteration of files e.g. employee alters salary rate or hours worked Prevention or ‘White Collar’ computer crimes Monitor all programs and users actions should be monitored and logged. All users should be identifiable and all files capable of being audited keep online transaction logs Auditing procedures to detect fraud

ICT Security Policies ThreatConsequencePrevention TerrorismLoss of business and income Backups Criminal vandalism/sabotage/ Legal actionRestrict access White collar crimeLoss of reputationAudit trails Transaction logs Floods and fire,Loss of business and income Backups kept offsite Accidental altering of data Loss of business and income Validation Verification Read only / write protection Natural disastersLoss of business and income Online backups kept in different city

ICT Security Policies This document aims to reduce the risk from potential threats both Deliberate and Accidental. ICT Security Policy Document

ICT Security Policies A Security Policy is a formal document which sets down the rules, procedures and responsibilities associated with the protection of information systems; the hardware and software used to run them and the data they contain. This policy should be written by senior management who have strategic responsibility for the organisation ICT Security Policy Definition What factors should be taken into account when designing security policies?

ICT Security Policies The factors to take into account when designing security policies Physical security Prevention of misuse Availability of an alternative computer system and back up power supply Audit trails for detection Operational Procedures* Continuous investigation of irregularities System Access - establishing procedures for accessing data such as log on procedures, firewalls Disaster recovery planning and dealing with threats from viruses Personnel administration Staff code of conduct and responsibilities; staff training Policy and maintenance staff available. Disciplinary procedures.

ICT Security Policies *Operational Procedures Disciplinary procedures. Screening potential employees Routines for distributing updated virus information and virus scanning procedures Define procedures for downloading from the Internet, use of USB discs, personal backup procedures Establish security rights for updating web pages Establish a disaster recovery programme Set up auditing procedures (Audit trails) to detect misuse.

ICT Security Policies Example ICT Security Policy

ICT Security Policies All organisations should have a SECURITY POLICY The first step in creating such a policy is to find out what the RISKS are, and the possible effects upon the company. Known as Risk Analysis.

ICT Security Policies Factors determining how much a company spends to develop control, minimising risk by; Identifying potential risks Assessing the likelihood of risk occurring Short and Long term consequence of threat How well equipped the is the company to deal with threat Costs are not always financial;

ICT Security Policies 1. What to do before?  Do a ‘ risk analysis’ of potential threats –Identify potential risks –Likelihood of risk occurring –Short and long term consequences of threat –How well equipped is the company to deal with threat  Put preventive measures in place. –Establish physical protection system (firewalls etc.) –Establish security rights for file access and updating web pages –Establish a disaster recovery programme –Set up auditing procedures (Audit trails) to detect misuse  Staff training in operational procedures. –Screening potential employees –Routines for distributing updated virus information and virus scanning procedures –Define procedures for downloading from the Internet, use of USB drives, personal backup procedures –Define staff code of conduct for using computer systems e.g. no abusive s. No illicit use etc.

ICT Security Policies 2. What to do during?  What response should staff make when the disaster occurs? 3. What to do after? Implement recovery measures  Hardware can be replaced.  Software can be re-installed. (or de-bugged by the programming department).  The real problem is the data. No business can afford to lose its data.  Backups of all data should be regularly made. This means that the worst case scenario is that the business has to go back to the situation of the last backup and carry on from there. Backups may take a long time - often tape- streamed at night.  Alternative communication /computer systems may be arranged in case a network goes down or alternative power supply.

ICT Security Policies What methods or practices are available to an organisation who wish to protect their ICT systems? Many methods are available, some or all should be used by organisations who want to protect their valuable data. These methods are known as LAYERS of SECURITY (CONTROL)

ICT Security Policies Layers of Control Personnel screening Operational security Communications security Authorisation software Terminal use controls Building security Guards, Ids, Visitors passes, sign in/out IT SYSTEMS AND DATA Locks, swipe cards, biometric measures (e.g. fingerprint recognition) Access rights (e.g. no access, read-only, read-write) Automatic callback, encryption, hand-shaking procedures Audit trails, unusual patterns of use, virus checks, backup and recovery procedures Hiring policies, separation of duties, education and training, establishing standards of honesty Espionage, fraud and theft, threats, blackmail Errors in programming, input and output procedures, operations Natural disasters and accidents Invasions of privacy, virus introduction, malicious destruction of data

ICT Security Policies Layers of control  Building and equipment security – locks and window grills, guards, alarms and automatic fire extinguishers, Id cards, visitor’s pass  Authorisation software – user ids and passwords  Communications security – Databases vulnerable to outside hackers. Combat illegal access with callback, handshaking, encryption  Operational security – Audit controls track what happens on a network  Audit trail – record that traces a transaction  Personnel safeguards – users and computer personnel within an organisation are more likely to breach security than outsiders

ICT Security Policies Case Study; War on the Web Should we be more worried about terrorists using digital weapons rather than chemical and biological attacks? A cyber-terrorist attack on our “critical information structure” – the electronic systems vital for government, armed forces, business, finance, telecommunications, utilities, energy services – could paralyse the country and bring all these systems to a grinding halt. It is not hard to imagine that terrorist organisations are training and preparing hackers and virus writers around the world for large scale, co-ordinated assault that piles attack upon attack until systems fall over. It would be cheap and involve little risk of those involved ever being caught. What can organisations do to protect themselves from cyber- terrorists?