1. Lesson 9-Information Security Best Practices

2. Overview Understanding administrative security. Security project plans. Understanding technical security. Making use of ISO 17799.

3. Understanding Administrative Security Administrative security policies: Define the importance of information and information systems to the company and its employees. Define the resources required to accomplish appropriate risk management activities. Identify the individuals responsible for managing the information security risk for the organization.

4. Understanding Administrative Security Administrative security policies fall under the following areas: Policies and procedures. Resources. Responsibility. Education. Contingency plans.

5. Policies and Procedures The most important policies that organizations must draft are: Information policy - Defines the level of sensitivity of information assets within the organization. Security policy - Defines the technical controls and security configurations to be implemented on all computer systems.

6. Policies and Procedures The most important policies that organizations must draft are (continued): Use policy - Identifies the approved uses of organization computer systems and the penalties for misusing such systems. Backup policy - Defines the frequency of information backups and the method of moving backups to an off-site storage.

7. Policies and Procedures Organizations must define the following procedures: User management - Includes information about individuals who can authorize access to the organization’s computer systems. System administration - Defines the process of implementing the organization’s security policy on various systems. Configuration management - Defines the steps for making changes to production systems.

8. Resources Determining required resources depends on: The size of the organization. The organization’s business. The risk to the organization. The full risk assessment of the organization. The plan to manage risk.

9. Resources The project management triangle

10. Resources The security department staff members should have the following skills: Security administration - A thorough understanding of day- to-day administration of security devices. Policy development - Hands-on experience in the development and maintenance of security policies, procedures, and plans. Architecture - An understanding of network and system architectures and implementation of new systems.

11. Resources The security department staff members should have the following skills (continued): Research - The examination of new security technologies for risk assessment. Assessment - Experience in conducting risk assessment activities, such as penetration and security testing. Audit - Experience in conducting system and procedure audits.

12. Resources An organization’s security budget is based on: The scope and time frame of the security project. The capital expenditures, current operations, and cost of training. The security project plans.

13. Responsibility An executive-level position must own security responsibilities within an organization. They should have the authority to define the organization’s policy and sign off on all security-related policies. They should also have the authority to enforce policy. They should develop metrics to track the progress toward security goals.

14. Education The best practices for education includes: Preventive measures. Enforcement measures. Incentive measures.

15. Preventive Measures Preventive measures can be used to explain the importance and need to protect an organization’s information assets. It will make employees comply with policies and procedures. It includes awareness programs, publicity campaigns, electronic mail messages, and pop-up windows.

16. Enforcement Measures Enforcement measures force employees to abide by the organization’s policies and procedures. It can be enforced in the form of security-awareness training. Employees can also be provided copies of relevant policies. They can also be asked to sign a security statement.

17. Incentive Programs Incentive programs: Can increase the reporting of security issues. Can be in the form of monetary incentives or verbal encouragement. Can also be used for suggestions on how to improve security.

18. Contingency Plans Contingency plans include: Incident response - Defines the series of steps to be taken in the event of a compromise. Backup and data archival - Defines how and when backups are to be taken. It also specifies the backup storage and restore mechanisms. Disaster recovery - Identifies the most critical resources and states the need and objectives in the event of a disaster.

19. Security Project Plans Best practices recommend that the security department must establish the following plans: Improvement plans - Address the risk areas and implement appropriate changes to the environment. Vulnerability assessment - Includes regular scans of the organization’s systems. It also includes regular follow-up with system administrators to ensure corrective actions are being taken.

20. Security Project Plans Best practices recommend that the security department must establish the following plans (continued): Assessment plans - Frequently assess the risk to the organization. Audit plans - Ensures policy compliance. Training - Includes schedules for awareness training classes and publicity campaigns. Policy evaluation - Includes built-in review schedules.

21. Understanding Technical Security Network connectivity. Malicious code protection. Authentication. Monitoring.

22. Understanding Technical Security Encryption. Patching systems. Backup and recovery. Physical security.

23. Network Connectivity To protect an organization from unwanted intrusions, the following network connectivity practices are recommended: Permanent connections - Network connection to other organizations or the Internet is protected by a firewall. This prevents damage in one network to spread to others. Remote access connections - These connections can be dial-in connections or connections across the Internet. Two-factor authentication, such as dial-back modems or dynamic passwords is recommended.

24. Malicious Code Protection To protect systems from computer viruses or Trojan horse programs: Use anti-virus programs for servers, desktops, and e-mail systems. Allow frequent signature updates and the delivery of updates.

25. Authentication The following are the recommended best practices for password usage: Passwords must be a minimum of eight characters in length. The last ten passwords should not be reused. It should always be stored in encrypted form, which is inaccessible to normal users. It should not be more than 60 days old. It should be composed of alphanumeric characters.

26. Authentication The following are the recommended best practices for password usage (continued): Dynamic passwords or other two-factor authentication mechanisms offer added security. Systems should be configured to start a screen saver while the employee is away. The system should require re- authentication to access the system.

27. Monitoring Auditing is a mechanism of monitoring actions that occur on a computer system. The audit log or files must keep track of the following events: Login/logoff. Failed login attempts. Dial-in connection attempts. Supervisor/administrator/root login. Supervisor/administrator/root privileged functions. Sensitive file access.

28. Monitoring Intrusion detection systems (IDS) monitor networks or systems. They trigger an alarm when security is compromised. Host-based IDS may be used to examine log files. Network-based IDS helps monitor the network for attacks or unusual traffic.

29. Encryption Encrypt information while transmitting over unsecured lines or electronic mail. Choose an algorithm that matches the sensitivity of the information being protected. Use well-known and well- tested encryption algorithms.

30. Encryption Use link encryption for transmission lines between organization facilities. Follow regulatory standards, such as HIPAA while transmitting over open networks.

31. Patching Systems Patches correct vulnerabilities. Install patches only after testing. Install patches according to the organization’s change control procedures. Check for new patches frequently.

32. Backup and Recovery Information on servers should be backed up regularly. Verify all backups to determine if the backup successfully copied the important files. Establish regular schedules of tests. Backups must be accessible to restore systems in the event of system failures. Backups should be stored off-site for protection.

33. Physical Security The following physical security mechanisms are recommended: Physical access - Restrict access to data center, where all sensitive computers are kept. Climate - Configure climate control units to notify administrators if a failure occurs.

34. Physical Security The following physical security mechanisms are recommended (continued): Fire suppression - Configure fire-suppression systems to prevent any damage to the systems in the data center. Electrical power - Size battery backups to provide sufficient power for computer systems to shut down.

35. Making Use of ISO 17799 The Information Technology - Code of Practice for Information Security Management (ISO 17799) covers the following areas: Security policy - Covers the need for a security policy. It also recommends regular reviews and evaluation of the document.

36. Making Use of ISO 17799 The Information Technology - Code of Practice for Information Security Management (ISO 17799) covers the following areas (continued): Organizational security - Covers how information security functions are managed within an organization. Asset classification and control - Covers the need to properly protect both physical and information assets.

37. Making Use of ISO 17799 ISO 17799 key concepts include: Personal security - Discusses the need to manage the risk within the hiring process and ongoing employee education. Physical and environmental security - Discusses the need to protect all physical assets from theft, fire, and other hazards. Communication and operations management- Covers the need for documented management procedures for computers and networks.

38. Making Use of ISO 17799 ISO 17799 key concepts include (continued): Access control - Discusses the control of access to information, systems, networks, and applications. Systems development and maintenance - Discusses the inclusion of security in development projects.

39. Making Use of ISO 17799 ISO 17799 key concepts include (continued): Business continuity management - Discusses the risks of business interruptions and various alternatives for continuity management. Compliance - Discusses how the organization should enforce policy and check compliance.

40. Summary Administrative security practices include policies and procedures, resources, responsibility, education, and contingency plans. The security department must establish plans for improvement, assessment, vulnerability assessment, audits, training, and policy evaluation.

41. Summary Technical security measures deal with the implementation of security controls on computers and networked systems. ISO 17799 standards help establish an effective security program.