1. Module 9: Designing Security for Data

2. Overview Creating a Security Plan for Data Creating a Design for Security of Data

3. Lesson 1: Creating a Security Plan for Data MSF and Security of Data Defense in Depth and Security of Data What Is Access Control? STRIDE Threat Model and Security of Data Activity: Identifying Threats to Data

4. MSF and Security of Data The MSF envisioning and planning phases help you to: Decide which locations your plan will help to protect Ensure that appropriate countermeasures are applied Consider appropriate DACL configuration Decide which locations your plan will help to protect Ensure that appropriate countermeasures are applied Consider appropriate DACL configuration 3 3 4 4 5 5 Plan Envision

5. Defense in Depth and Security of Data Policies, Procedures, and Awareness Physical Security Perimeter Internal Network Application Host Data

6. What Is Access Control? Stored on the user’s computer Contains the SIDs of the users account and groups Lists the user rights for the user Stored on the user’s computer Contains the SIDs of the users account and groups Lists the user rights for the user Access Token Contains an ACE for each permission that is assigned SIDs compared to SIDs in the access token Contains an ACE for each permission that is assigned SIDs compared to SIDs in the access token DACL Defines the protections that apply to an object ACE

7. STRIDE Threat Model and Security of Data Administrators and users have improper rights Spoofing Computers running Windows use default NTFS and share permissions Tampering Hardware fails Repudiation Permissions are assigned incorrectly Information disclosure A user irreversibly encrypts a file Denial of service A virus corrupts or deletes data Elevation of privilege

8. Activity: Identifying Threats to Data In this practice you will: Read the scenario Answer the questions Discuss with the class Read the scenario Answer the questions Discuss with the class

9. Lesson 2: Creating a Design for Security of Data Process for Designing an Access Control Model Considerations for Combining NTFS and Share Permissions Multimedia: How Encryption Works Process for Designing EFS Policies Guidelines for Managing Data Securely Activity: Data Threats and Countermeasures

10. To design an access control model, follow these steps: Determine access control requirements Create the access control model Implement the model Determine access control requirements Create the access control model Implement the model 1 1 3 3 2 2 Process for Designing an Access Control Model Accounts Global Group Domain Local Group Permissions

11. Considerations for Combining NTFS and Share Permissions PermissionsApplied Share When the data is accessed remotely over a network NTFS When a user accesses data on an NTFS volume locally or remotely

12. Multimedia: How Encryption Works How EFS Works How BitLocker Works

13. To ensure the proper use of encryption in your organization, design: Policies for encrypting files Procedures for recovering encrypted files A user education strategy Policies for encrypting files Procedures for recovering encrypted files A user education strategy 1 1 3 3 2 2 Process for Designing Encryption Policies

14. Guidelines for Managing Data Securely For each areaDetermine Data storage location How to store data on the network What data to store locally Backup strategy Who can back up and restore files How frequently to back up files How to secure backup media Auditing How to audit data access How to review data access audit logs Management permissions Who manages data Where to manage data Hardware replacement How to use hardware redundancy technology How often to replace hardware Data retention How long to retain data on the network How and where to archive data from the network

15. Activity: Data Threats and Countermeasures In this practice you will: Read the scenario Choose the best risk management strategy Determine an appropriate security response Discuss with the class Read the scenario Choose the best risk management strategy Determine an appropriate security response Discuss with the class

16. Lab: Designing Security for Data Exercise 1 Identifying Potential Data Vulnerabilities Exercise 2 Designing Countermeasures