1. Information Security Introduction to Information Security Michael Whitman and Herbert Mattord 14-1

2. Chapter 14 Chapter Objectives Af ter studying this chapter you should be able to: – NSTISSC Security Model – Compare SDLC and SecSDLC Phases – Security Management and Project Team – Threat to Information Security – Design Security Architecture – Security Technology 14-2

3. NSTISSC Security Model p.15 National Security Telecommunications and Information Systems Security Committee presented “National Training Standard for Information Security Professionals NSTISSI No. 4011” document which o - Define information security as “the protection of information and the systems and hardware that use, store, and transmit that information.” 1. - Develop an NSTISSC Security Model (p.15) 2. - Secure five components of the IS (p.123) 14-3

4. Chapter 14 14-4

5. Chapter 14 The security SDLC has all the common steps in the traditional SDLC, plus steps unique to the security SDLC. The steps unique to the security SDLC are: – Phase 1: Investigation Management defines project processes and goals and documents these in the program security policy – Phase 2: Analysis Analyze existing security policies and programs Analyze current threats and controls Examine legal issues Perform risk analysis Compare SDLC and SecSDLC Phases p. 26 14-5

6. Chapter 14 – Phase 3: Logical Design Develop security blueprint Plan incident response actions Plan business response to disaster Determine feasibility of continuing and/or outsourcing the project – Phase 4: Physical Design Select technologies needed to support security blueprint Develop definition of successful solution Design physical security measures to support technological solutions Review the approval project Compare SDLC and SecSDLC Phases p. 26 14-6

7. Chapter 14 – Phase 5: Implementation Buy or develop security solutions At end of phase, present tested package to management for approval – Phase 6: Maintenance Constantly monitor, test, modify, update, and repair to meet changing threats Compare SDLC and SecSDLC Phases p. 26 14-7

8. Chapter 14 Security Management and Project Team p.31 – Senior Management Chief Information Officer (CIO) Chief Information Security Officer – responsible for assessment, management, and implementation of securing the information in the organization. –May also be referred to as the manager for Security, the security administrator, or a similar title. –Usually reports directly to the CIO 14-8

9. Chapter 14 Security Management and Project Team Security Management and Project Team – Security Project Team Champion Team leader Security policy developer Risk assessment specialists Security professionals Systems administrators End users 14-9

10. Chapter 14 Threat to Information Security ( David Kroenke, 2009) 14-10

11. Chapter 14 Design Security Architecture p.225 - Defense in depth Develop security in layers - Security Perimeter Defines the edge between the outer limit of an organization’s security and the beginning of the outside world. Is the first level of security that protects all internal systems from outside threats. – Key Security Technologies 14-11

12. Chapter 14 Security Technology p.275 1. Firewall 2. Dial-up Protection: – RADIUS (Remote Authentication Dial-in User Service) Configuration: Figure 8-6 (p.285) 1. Remote worker dials RAS (Remote Access Server) system 2. RAS passes username and password to RADIUS server 3. RADIUS server approves or rejects request and provides access authorization 4. RAS provides access to authorized remote worker TeleworkerRASRADIUS 14-12 1 4 3 2

13. Chapter 14 Security Technology p.275 3. Intrusion Detection Systems (IDSs) – Host based IDS: resides on a host and monitor only activities on the host. – Network IDS: monitor network traffic and examine packets on network ad alerts administrators of unusual patterns – Signature-based IDS or knowledge-based IDS: examine data traffic in search of something that matches signatures, which are preconfigured, predetermined attack patterns. – Statistical Anomaly-based IDS: collect data from normal traffic and establish a baseline. Then periodically samples network activity, based on statistical methods, and compares the samples to the baseline. When the activity is outside the baseline parameters, IDS notify the administrator. - 14-13

14. Chapter 14 Security Technology p.275 4. Scanning and Analysis Tools – Port Scanners p292 (network channel or connection) – Vulnerability Scanners Scan networks for highly detailed information – Packet Sniffers A network tool that collects copies of packets form the network and analyzes them. 5. Content Filters restrict accessible content from within a network. E.g. restriction of web sites with nonbusiness related material; restriction of spam e-mail form outside sources 14-14

15. Chapter 14 Security Technology p.275 6. Cryptography and Encryption-based Solutions – Symmetric encryption (private key encryption) use a single key for encryption and decryption – Asymmetric encryption (public key encryption) use two different keys – Digital Signature – PKI: Public Key Infrastructure – Digital certificate An electronic document, similar to digital signature, attached to a file certifying that this file is from the organization it claims to be from and has not been modified from the original format 14-15

16. Chapter 14 Security Technology p.275 – Digital Authority An agency that manages the issuance of certificates and serves as the electronic notary public to verify their worth and integrity. E.g. when downloading or uploading software on the Internet, a pop-up window shows that the files did in fact come from the purported agency, and thus can be trusted. – Securing E-Mail S/MIME (Secure Multipurpose Internet Mail Extensions) PEM (Privacy Enhanced Mail) PGP (Pretty Good Privacy) 14-16

17. Chapter 14 Security Technology p.275 – Securing Web (p.309) SET (Secure Electronic Transactions) SHTTP (Secured HTTP): encryption IPSec (IP Security) 7. Access Control Devices – Authentication: Are you whom you claim to be? What you know: password What you have: dumb cards such as ID cards, or ATM cards What you are: biometrics 14-17