1. Security Management Practices
Risk Management
Identifying, assessing, and reducing risk to an acceptable level
Implementing mechanisms to maintain risk level
Security Policies
Security Education

2. Security Administration
Person or group must be responsible
Clear reporting structure to senior management
Information owners dictate who can access data
Executive with management responsibilities
Security Administrators ensure that’s what happens

3. Security Controls Administrative Controls Technical Controls
Policies & Standards
Technical Controls
Password & Resource Management
Security Devices
Physical Controls
Locks, fences, walls

4. Failure – Managements fault?
Must have buy-in from Senior Management
Security should not be viewed as expensive and unnecessary
Lack of security controls much more expensive
Foster a healthy relationship between Security & Senior Management

5. CIA Triad Confidentiality Integrity Availability
Only those that should see it can see it
Integrity
Assurance that data is accurate and reliable
Availability
Reliable and timely access to data

6. Definitions & the Security Circle of Life

7. Hacker
Disgruntled Employee
Enemy government
Random actor
Environment
Virus
They create….

8. Denial of Service
Loss of data
Changes to data
Tornado
Equipment failure
Exploits…

9. Open firewall port
Bug in software
Lack of proper controls
Lack of redundancy
Leads to…

10. Low
Medium
High
Can damage…

11. File Server
Marketing plan
Research
Facility
And causes an…

12. Wasted man hours to reproduce data
Lost sales
Law suits
Can be countermeasured by…

13. Firewall
Hot backup site
Fire suppression
Directly affects…

14. And then it starts all over again

15. Top Down Security Planning Step 1
Assess Business Objectives
Senior management must participate
Operational Goals – Daily
Tactical Goals – Near future
Strategic Goals – Long term
Budgets
Benefits in other areas?

16. Top Down Security Planning Step 2
Vulnerability Assessment
Report of where vulnerabilities exist
Catalog each asset and system
Research known vulnerabilities
Accuracy is key
Penetration Testing
Active, systematic attack on owned assets
Outsource or in-house

17. Top Down Security Planning Step 3
Risk Analysis
Assign value to assets
Costs to acquire or develop asset
Cost to maintain asset
Value to owners or users
Value to adversaries
Price others are willing to pay
Cost to replace the asset if lost
Loss of productivity if asset is unavailable
Liability issues if the asset is compromised

18. Perform threat analysis
Estimate loss per risk
Single Loss Expectancy (SLE) = asset value X exposure factor (EF)
EF represents the estimated loss per occurrence
Cost of recovery
Cost of lost productivity
Perform threat analysis
Gather info about likelihood of each risk happening
Past occurrences
Industry occurrences
Estimate Annualized Rate of Occurrence (ARO) = probability occurrence will take place during a given year
0.0 = never, 0.5 = every other year, 1.0 = always

19. Derive overall loss potential per risk
Annualized Loss Expectancy (ALE) = SLE X ARO
Select countermeasures for each risk
Quantify the Total Cost of Ownership (TCO) for each counter measure
Acquirement Cost + Yearly Support Costs
Reduce, assign, or accept each risk
Reduction (need not be 100%)
Install security controls
Improve procedures
Assignment
Buy insurance
Acceptance
Live with the risk
Is countermeasure TCO more expensive than ALE?

20. Things to Consider When Selecting a Countermeasure
Modularity
Provides uniform protection
Allows administrator to override
Independence from asset and other safeguards
Flexibility and functionality
Clear distinctions between user classes
Minimal human intervention needed
Easily upgradeable
Auditing functionality
Able to be reset without affecting protection level
Testable
Does not introduce other compromises
Acceptable negative affects on performance of users and systems
Proper and flexible alerting facilities

21. Top Down Security Planning Step 4
Define protection requirements
How aggressive will you be?
Classify data
Define data classes
Assign data and assets to classes
Identify data custodian
Document, document, document
Evaluate functionality of chosen countermeasures

22. Top Down Security Planning Step 5
Evaluate legal liabilities
Who can sue you?
Perform security awareness training
Customize content for different audiences – Management, Staff, Technical
Must be repeated continually
Evaluate system reliability of countermeasures

23. Top Down Security Planning Step 5, con’t
Publish policies and procedures
Policies
Management Statements
Organizational
Issue Specific
System Specific
Standards
Compulsory rules that must be followed
Guidelines
Recommended actions
Procedures
Detailed step-by-step actions to complete a specific task

24. Top Down Security Planning Step 5, con’t
Areas covered by Policies and Procedures
Accountability controls
Physical and environmental controls
Administration controls
Access controls
Use and required types of cryptography
BCP controls
Computer operations
Incident handling

25. Top Down Security Planning Step 6
Roll out selected countermeasures
Be sure the roll out plan does not adversely affect users and customers
Monitor countermeasures

26. Top Down Security Planning Step 7
Reevaluate and repeat regularly!

27. Layers of Security Responsibility
Senior Manager
Person ultimately responsible for the security of the organization
Security Professional
Functionally responsible for security
Data Owner
Determines data classification of info
Data Custodian
Maintains the data according to classification guidelines
User
Uses data for daily tasks
Auditor
Regularly examines the security practices and mechanisms

28. More Terminology Due Care Due Diligence Nondisclosure agreements (NDA)
Organization has taken steps necessary to protect its assets from possible risks
Due Diligence
Accomplished by activities that ensure that countermeasures are continually maintained and operational
Nondisclosure agreements (NDA)
Job rotation

29. Homework Assignment Read Chapter 4 Paper
Choose and document 5 common vulnerabilities
List (and justify if not obvious) the threat agent, threat, risk, possible affected asset, exposure, safeguard
Stick to common vulnerabilities, but try to choose from the entire realm of security issues