Security in Practice

1. Security in Practice Enterprise Security

2. Business Continuity • Ability of an organization to maintain its operations and services in the face of a disruptive event • Computer attack • Natural disaster • Many organizations are either unprepared or have not tested their plans • Common elements • Redundancy planning • Disaster recovery procedures • Incident response procedures

3. Redundancy Planning • Building excess capacity in order to protect against failures • Servers • Protect against single point of failure • Redundant servers or parts • May take too long to get back online • Server cluster • Design the network infrastructure so that multiple servers are incorporated into the network • Types: asymmetric and symmetric

4. Redundancy Planning (cont’d.) Server cluster

5. Redundancy Planning (cont’d.) • Storage • Hard disk drives often are the first component of a system to fail • Implement RAID (Redundant Array of Independent Drives) technology • Uses multiple hard disk drives for increased reliability and performance

6. Redundancy Planning (cont’d.) • Networks • Redundant network ensures that network services are always accessible • Virtually all network components can also be duplicated

7. Redundancy Planning (cont’d.) • Power • Uninterruptible power supply (UPS) • Device that maintains power to equipment in the event of an interruption in the primary electrical power source • On-line • Off-line • Backup generator

8. Redundancy Planning (cont’d.) • Sites • Hot site • Run by a commercial disaster recovery service • Allows a business to continue computer and network operations to maintain business continuity • Cold site • Provides office space • Customer must provide and install all the equipment needed to continue operations

9. Redundancy Planning (cont’d.) • Warm site • All of the equipment installed • Does not have active Internet or telecommunications facilities • Does not have current backups of data

10. Disaster Recovery Procedures • Procedures and processes for restoring an organization’s operations following a disaster • Focuses on restoring computing and technology resources to their former state • Planning • Disaster recovery plan (DRP) • Written document • Details the process for restoring computer and technology resources

11. Disaster Recovery Procedures (cont’d.) • Common features of DRP • Purpose and scope • Recovery team • Preparing for a disaster • Emergency procedures • Restoration procedures

12. Disaster Recovery Procedures (cont’d.) Sample from a DRP

13. Disaster Recovery Procedures (cont’d.) • Disaster exercises • Test the effectiveness of the DRP • Objectives • Test the efficiency of interdepartmental planning and coordination in managing a disaster • Test current procedures of the DRP • Determine the strengths and weaknesses in disaster responses

14. Disaster Recovery Procedures (cont’d.) • Enterprise data backups • Significantly different than those for a home user • Disk to disk (D2D) • Continuous data protection (CDP)

15. Incident Response Procedures • What is forensics? • Forensics • Application of science to questions that are of interest to the legal profession • Computer forensics • Attempt to retrieve information that can be used in the pursuit of the attacker or criminal • Importance of computer forensics is due in part to • High amount of digital evidence • Increased scrutiny by the legal profession • Higher level of computer skill by criminals

16. Incident Response Procedures (cont’d.) • Responding to a computer forensics incident • Secure the crime scene • Response team must be contacted immediately • Document physical surroundings • Take custody of computer • Interview users and document information • Preserve the evidence • First capture any volatile data • Random access memory (RAM) • Mirror image backup or bit-stream backup

17. Incident Response Procedures (cont’d.) • Establish the chain of custody • Documents that the evidence was under strict control at all times • No unauthorized person was given the opportunity to corrupt the evidence • Examine the evidence • Mirror image is examined to reveal evidence • Mine and expose hidden clues • Windows page file • Slack • Metadata

18. Slack

19. Security Policies • Plans and policies must be established by the organization • To ensure that people correctly use the hardware and software defenses • Organizational security policy

20. What Is a Security Policy? • Document that outlines the protections that should be enacted • Functions • Communicates organization’s information security culture and acceptable information security behavior • Detail specific risks and how to address them • Help to create a security-aware organizational culture • Ensure that employee behavior is directed and monitored to ensure compliance with security requirements

21. Balancing Trust and Control • Approaches to trust • Trust everyone all of the time • Trust no one at any time • Trust some people some of the time • Deciding on the level of control for a specific policy is not always clear • Not all users have positive attitudes toward security policies

22. Balancing Trust and Control (cont’d.) Possible negative attitudes toward security

23. Designing a Security Policy • Definition of a policy • Characteristics • Communicate a consensus of judgment • Define appropriate behavior for users. • Identify what tools and procedures are needed • Provide directives for Human Resource action in response to inappropriate behavior • May be helpful in the event that it is necessary to prosecute violators

24. Designing a Security Policy (cont’d.) • Due care • Obligations imposed on owners and operators of assets • Exercise reasonable care of the assets and take necessary precautions to protect them • Care that a reasonable person would exercise under the circumstances • Examples

25. Designing a Security Policy (cont’d.) • The security policy cycle • Three-phase cycle • Performing a risk management study • Asset identification • Threat identification • Vulnerability appraisal • Risk assessment • Risk mitigation • Creating a security policy based on the information from the risk management study • Reviewing the policy for compliance

26. Designing a Security Policy (cont’d.) Security policy cycle

27. Types of Security Policies • Acceptable use policy (AUP) • Defines the actions users may perform while accessing systems and networking equipment • Unacceptable use may also be outlined by the AUP • Security-related human resource policy • Include statements regarding how an employee’s information technology resources will be addressed • Presented at an orientation session when the employee is hired • May contain due process statement

28. Types of security policies

29. Types of Security Policies (cont’d.) • Personally identifiable information (PII) policy • Outlines how the organization uses personal information it collects • Disposal and destruction policy • Addresses the disposal of resources that are considered confidential

30. Types of Security Policies (cont’d.) Sample PII (privacy) policy

31. Types of Security Policies (cont’d.) • Ethics policy • Refocus attention on ethics in the enterprise • Written code of conduct • Central guide and reference for employees in support of day-to-day decision making

32. Summary • Redundancy planning • Building excess capacity in order to protect against failures • Disaster recovery • Procedures and processes for restoring an organization’s operations following a disaster • Forensic science • Application of science to questions that are of interest to the legal profession

33. Summary (cont’d.) • Security policy • Written document that states how an organization plans to protect the company’s information technology assets