ISAA PPt
- 2. Module-3: Information Security Management Monitor systems and apply controls Security assessment using automated tools Backups of security devices Performance Analysis, Root cause analysis and Resolution, Information Security Policies, Procedures, Standards and Guidelines
- 3. 1. What is security assessment? 2. What are the non-intrusive types? 3. How do you choose between these types? 4. What are the intrusive types? 5. What are the types of risk reduction? 6. What is effective security? 7. What are the limitations to security assessment? Security Assessment Outline
- 4. 1. Definition – Security assessment • identifies existing IT vulnerabilities (weakness) and • recommends countermeasures for mitigating potential risks. • Goal – Make the infrastructure more secure – Identify risks and reduce them • Consequences of Failure – Loss of services – Financial loss – Loss of reputation – Legal consequences Security Assessment Overview
- 5. • Non-Intrusive 1. Security Audit 2. Risk Assessment 3. Risk Analysis • Intrusive 1. Vulnerability Scan 2. Penetration Testing / Ethical Hacking • All have the goal of identifying vulnerabilities and improving security. – (what is allowed, legal liability, purpose of analysis, etc.). Security Assessment 2. Types
- 6. Independent review and examination of system records & Activities to determine capability of system controls Ensure compliance of security policy & Operational procedures, Detect cracks in security, and Recommend changes in these processes. Security Assessment: Non-Intrusive Types 1. Security Audit
- 7. • Features –Formal Process –Paper Oriented • Review Policies for Compliance and Best Practices –Review System Configurations • Questionnaire • Automated Scanning –Checklists Security Assessment: Non-Intrusive Types 1. Security Audit
- 8. • Risk Assessment (Vulnerability Assessment) is: –determination of state of risk associated with a system based upon thorough analysis –includes recommendations to support subsequent security controls/decisions. –takes into account business, as well as legal constraints. Security Assessment: Non-Intrusive Types 2. Risk Assessment
- 9. • Involves more testing than traditional paper audit • Primarily required to identify weaknesses in the information system • Steps –Identify security holes in the infrastructure –Look but not intrude into the systems –Focus on best practices (company policy is secondary) Security Assessment: Non-Intrusive Types 2. Risk Assessment
- 10. • Risk Analysis is the identification or study of: –an organization’s assets –threats to these assets –system’s vulnerability to the threats • Risk Analysis is done in order to determine exposure and potential loss. Security Assessment: Non-Intrusive Types 3. Risk Analysis
- 11. • Computationally intensive and requires data to –Compute probabilities of attack –Valuation of assets –Efficacy of the controls • usually requires an analytically trained person Security Assessment: Non-Intrusive Types 3. Risk Analysis
- 12. Security Assessment Assessment vs. Analysis vs. Audit Assessment Analysis Audit Objective Baseline Determine Exposure and Potential Loss Measure against a Standard Method Various (including use of tools) Various (including tools) Audit Program/ Checklist Deliverables Gaps and Recommendations Identification of Assets, Threats & Vulnerabilities Audit Report Performed by: Internal or External Internal or External Auditors Value Focused Improvement Preparation for Assessment Compliance
- 13. • Definition – Scan the network using automated tools to identify security holes in the network • Usually a highly automated process – Fast and cheap • Limitations – False findings – System disruptions (due to improperly run tools) • Differences in regular scans can often identify new vulnerabilities Security Assessment: Intrusive Types 1. Vulnerability Scan
- 14. • Definition (Ethical Hacking) – Simulated attacks on computer networks to identify weaknesses in the network. • Steps – Find a vulnerability – Exploit the vulnerability to get deeper access – Explore the potential damage that the hacker can cause • Example – Scan web server: Exploit buffer overflow to get an account – Scan database (from web server) – Find weakness in database: Retrieve password – Use password to compromise firewall Security Assessment: Intrusive Types 2. Penetration Testing
- 15. There are three strategies for risk reduction: • Avoiding the risk – by changing requirements for security or other system characteristics • Transferring the risk – by allocating the risk to other systems, people, organizations assets or by buying insurance • Assuming the risk – by accepting it, controlling it with available resources Security Assessment Risk Reduction
- 16. • Effective security relies on several factors – Security Assessments – Policies & Procedures – Education (of IT staff, users, & managers) – Configuration Standards/Guidelines • OS Hardening • Network Design • Firewall Configuration • Router Configuration • Web Server Configuration – Security Coding Practices Security Assessment Effective Security
- 17. Risk Analysis Concept Map • Threats exploit system vulnerabilities which expose system assets. • Security controls protect against threats by meeting security requirements.
- 18. • Assets- • Vulnerability- • Threat- • Security Risk- • Security Controls- Risk Analysis Basic Definitions
- 19. • Assets: Something that the agency values and has to protect. Assets include all information and supporting items that an agency requires to conduct business. • Data – Breach of confidentiality – Loss of data integrity – Denial of service – Corruption of Applications – Disclosure of Data Risk Analysis Assets • Organization – Loss of trust – Embarrassment – Management failure • Personnel – Injury and death – Sickness – Loss of morale
- 20. • Infrastructure – Electrical grid failure – Loss of power – Chemical leaks – Facilities & equipment – Communications Risk Analysis Assets Cont’d • Legal – Use or acceptance of unlicensed software – Disclosure of Client Secrets • Operational – Interruption of services – Loss/Delay in Orders – Delay in Shipments
- 21. • Vulnerabilities are flaws within an asset, such as an operating system, router, network, or application, which allows the asset to be exploited by a threat. Risk Analysis Vulnerabilities
- 22. • Examples – Software design flaws – Software implementation errors – System misconfiguration (e.g. misconfigured firewalls) – Inadequate security policies – Poor system management – Lack of physical protections – Lack of employee training (e.g. passwords on post-it notes in drawers or under keyboards) Risk Analysis Vulnerabilities
- 23. • Threats are potential causes of events which have a negative impact. – Threats exploit vulnerabilities causing impact to assets • Examples – Denial of Service (DOS) Attacks – Spoofing and Masquerading – Malicious Code – Human Error – Insider Attacks – Intrusion Risk Analysis Threats
- 24. Risk Analysis Sources of Threats Source Examples of Reasons External Hackers with Malicious Intent • Espionage • Intent to cause damage • Terrorism External Hackers Seeking Thrill • Popularity Insiders with Malicious Intent • Anger at company • Competition with co-worker(s) Accidental Deletion of Files and Data • User errors Environmental Damage • Floods • Earthquakes • Fires Equipment and Hardware Failure • Hard disk crashes
- 25. • Risk is the probability that a specific threat will successfully exploit a vulnerability causing a loss. • Risks of an organization are evaluated by three distinguishing characteristics: – loss associated with an event, e.g., disclosure of confidential data, lost time, and lost revenues. – likelihood that event will occur, i.e. probability of event occurrence – Degree that risk outcome can be influenced, i.e. controls that will influence the event Risk Analysis Security Risk
- 26. • Physical Asset Risks –Relating to items with physical and tangible items that have an associated financial value Risk Analysis Physical Asset Risks
- 27. • Mission Risks –Relating to functions, jobs or tasks that need to be performed Risk Analysis Mission Risks
- 28. • Security Risks –Integrates with both asset and mission risks Risk Analysis Security Risks
- 29. • ISO 17799 – Title: Information technology -- Code of practice for information security management – Starting point for developing policies – http://www.iso.ch/iso/en/prods- services/popstds/.../en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=33441 &ICS1=35 • ISO 13335 – Title: Information technology -- Guidelines for the management of IT Security -- Part 1: Concepts and models for IT Security – Assists with developing baseline security. – http://www.iso.ch/iso/en/CatalogueDetailPage.CatalogueDetail?CSNUMBER=217 33&ICS1=35 • NIST SP 800-xx – Different standards for various applications – http://csrc.nist.gov/publications/nistpubs/ • Center for Internet Security – Configuration Standards (benchmarks) – http://www.cisecurity.org/ Risk Analysis: Define Objectives Standards
Editor's Notes
- #7: “The terms Risk Analysis, Risk Assessment, and Risk Management are used interchangeably by some individuals and, in the field of Program Management, are construed to represent similar concepts but the order of precedence is inverse to that for Automation or Computer Security.” Definition: “Risk Analysis is the identification of a specific installation’s assets, the threats to them, the system’s vulnerability to those threats, and the presumed loss in consideration of existing and projected safeguards. To accomplish either qualitative or quantitative analysis of the system’s risk posture, presumptions should be made that the threats actually occur periodically, if unpredictably, and result in significant damage to system assets that constitute some discernable value to the organization; further, safeguards under review should be considered to be properly conceived and to work correctly in order to make reasonable comparisons. Although approximations and simplifications may be made for the sake of expediency to accomplish a risk analysis, objectivity can prevail when reasonable compromises are made. The most realistic portrayal of actual situations can be made when figures used in computations closely represent the documented local conditions as contrasted with generic, averaged conditions. A concurrent or subsequent security test and evaluation of those very safeguards should be made to establish whether, in fact, the presumptions are correct and, if not, what improvement should be effected.” Definition: “Risk Assessment is a comprehensive determination of the state of risk associated with a system based upon a thorough analysis of the foregoing considerations; by definition, the assessment should include recommendations to support subsequent management decision for (elimination of unnecessarily onerous restrictions and/or) adoption of specific additional safeguards that would reduce the level of system risk to an acceptable level within the constraints imposed by mission, budgetary, political, societal, and other relevant factors.”
- #8: “The terms Risk Analysis, Risk Assessment, and Risk Management are used interchangeably by some individuals and, in the field of Program Management, are construed to represent similar concepts but the order of precedence is inverse to that for Automation or Computer Security.” Definition: “Risk Analysis is the identification of a specific installation’s assets, the threats to them, the system’s vulnerability to those threats, and the presumed loss in consideration of existing and projected safeguards. To accomplish either qualitative or quantitative analysis of the system’s risk posture, presumptions should be made that the threats actually occur periodically, if unpredictably, and result in significant damage to system assets that constitute some discernable value to the organization; further, safeguards under review should be considered to be properly conceived and to work correctly in order to make reasonable comparisons. Although approximations and simplifications may be made for the sake of expediency to accomplish a risk analysis, objectivity can prevail when reasonable compromises are made. The most realistic portrayal of actual situations can be made when figures used in computations closely represent the documented local conditions as contrasted with generic, averaged conditions. A concurrent or subsequent security test and evaluation of those very safeguards should be made to establish whether, in fact, the presumptions are correct and, if not, what improvement should be effected.” Definition: “Risk Assessment is a comprehensive determination of the state of risk associated with a system based upon a thorough analysis of the foregoing considerations; by definition, the assessment should include recommendations to support subsequent management decision for (elimination of unnecessarily onerous restrictions and/or) adoption of specific additional safeguards that would reduce the level of system risk to an acceptable level within the constraints imposed by mission, budgetary, political, societal, and other relevant factors.”
- #9: “The terms Risk Analysis, Risk Assessment, and Risk Management are used interchangeably by some individuals and, in the field of Program Management, are construed to represent similar concepts but the order of precedence is inverse to that for Automation or Computer Security.” Definition: “Risk Analysis is the identification of a specific installation’s assets, the threats to them, the system’s vulnerability to those threats, and the presumed loss in consideration of existing and projected safeguards. To accomplish either qualitative or quantitative analysis of the system’s risk posture, presumptions should be made that the threats actually occur periodically, if unpredictably, and result in significant damage to system assets that constitute some discernable value to the organization; further, safeguards under review should be considered to be properly conceived and to work correctly in order to make reasonable comparisons. Although approximations and simplifications may be made for the sake of expediency to accomplish a risk analysis, objectivity can prevail when reasonable compromises are made. The most realistic portrayal of actual situations can be made when figures used in computations closely represent the documented local conditions as contrasted with generic, averaged conditions. A concurrent or subsequent security test and evaluation of those very safeguards should be made to establish whether, in fact, the presumptions are correct and, if not, what improvement should be effected.” Definition: “Risk Assessment is a comprehensive determination of the state of risk associated with a system based upon a thorough analysis of the foregoing considerations; by definition, the assessment should include recommendations to support subsequent management decision for (elimination of unnecessarily onerous restrictions and/or) adoption of specific additional safeguards that would reduce the level of system risk to an acceptable level within the constraints imposed by mission, budgetary, political, societal, and other relevant factors.”
- #10: “The terms Risk Analysis, Risk Assessment, and Risk Management are used interchangeably by some individuals and, in the field of Program Management, are construed to represent similar concepts but the order of precedence is inverse to that for Automation or Computer Security.” Definition: “Risk Analysis is the identification of a specific installation’s assets, the threats to them, the system’s vulnerability to those threats, and the presumed loss in consideration of existing and projected safeguards. To accomplish either qualitative or quantitative analysis of the system’s risk posture, presumptions should be made that the threats actually occur periodically, if unpredictably, and result in significant damage to system assets that constitute some discernable value to the organization; further, safeguards under review should be considered to be properly conceived and to work correctly in order to make reasonable comparisons. Although approximations and simplifications may be made for the sake of expediency to accomplish a risk analysis, objectivity can prevail when reasonable compromises are made. The most realistic portrayal of actual situations can be made when figures used in computations closely represent the documented local conditions as contrasted with generic, averaged conditions. A concurrent or subsequent security test and evaluation of those very safeguards should be made to establish whether, in fact, the presumptions are correct and, if not, what improvement should be effected.” Definition: “Risk Assessment is a comprehensive determination of the state of risk associated with a system based upon a thorough analysis of the foregoing considerations; by definition, the assessment should include recommendations to support subsequent management decision for (elimination of unnecessarily onerous restrictions and/or) adoption of specific additional safeguards that would reduce the level of system risk to an acceptable level within the constraints imposed by mission, budgetary, political, societal, and other relevant factors.”
- #11: “The terms Risk Analysis, Risk Assessment, and Risk Management are used interchangeably by some individuals and, in the field of Program Management, are construed to represent similar concepts but the order of precedence is inverse to that for Automation or Computer Security.” Definition: “Risk Analysis is the identification of a specific installation’s assets, the threats to them, the system’s vulnerability to those threats, and the presumed loss in consideration of existing and projected safeguards. To accomplish either qualitative or quantitative analysis of the system’s risk posture, presumptions should be made that the threats actually occur periodically, if unpredictably, and result in significant damage to system assets that constitute some discernable value to the organization; further, safeguards under review should be considered to be properly conceived and to work correctly in order to make reasonable comparisons. Although approximations and simplifications may be made for the sake of expediency to accomplish a risk analysis, objectivity can prevail when reasonable compromises are made. The most realistic portrayal of actual situations can be made when figures used in computations closely represent the documented local conditions as contrasted with generic, averaged conditions. A concurrent or subsequent security test and evaluation of those very safeguards should be made to establish whether, in fact, the presumptions are correct and, if not, what improvement should be effected.” Definition: “Risk Assessment is a comprehensive determination of the state of risk associated with a system based upon a thorough analysis of the foregoing considerations; by definition, the assessment should include recommendations to support subsequent management decision for (elimination of unnecessarily onerous restrictions and/or) adoption of specific additional safeguards that would reduce the level of system risk to an acceptable level within the constraints imposed by mission, budgetary, political, societal, and other relevant factors.”
- #12: “The terms Risk Analysis, Risk Assessment, and Risk Management are used interchangeably by some individuals and, in the field of Program Management, are construed to represent similar concepts but the order of precedence is inverse to that for Automation or Computer Security.” Definition: “Risk Analysis is the identification of a specific installation’s assets, the threats to them, the system’s vulnerability to those threats, and the presumed loss in consideration of existing and projected safeguards. To accomplish either qualitative or quantitative analysis of the system’s risk posture, presumptions should be made that the threats actually occur periodically, if unpredictably, and result in significant damage to system assets that constitute some discernable value to the organization; further, safeguards under review should be considered to be properly conceived and to work correctly in order to make reasonable comparisons. Although approximations and simplifications may be made for the sake of expediency to accomplish a risk analysis, objectivity can prevail when reasonable compromises are made. The most realistic portrayal of actual situations can be made when figures used in computations closely represent the documented local conditions as contrasted with generic, averaged conditions. A concurrent or subsequent security test and evaluation of those very safeguards should be made to establish whether, in fact, the presumptions are correct and, if not, what improvement should be effected.” Definition: “Risk Assessment is a comprehensive determination of the state of risk associated with a system based upon a thorough analysis of the foregoing considerations; by definition, the assessment should include recommendations to support subsequent management decision for (elimination of unnecessarily onerous restrictions and/or) adoption of specific additional safeguards that would reduce the level of system risk to an acceptable level within the constraints imposed by mission, budgetary, political, societal, and other relevant factors.”
- #14: “The terms Risk Analysis, Risk Assessment, and Risk Management are used interchangeably by some individuals and, in the field of Program Management, are construed to represent similar concepts but the order of precedence is inverse to that for Automation or Computer Security.” Definition: “Risk Analysis is the identification of a specific installation’s assets, the threats to them, the system’s vulnerability to those threats, and the presumed loss in consideration of existing and projected safeguards. To accomplish either qualitative or quantitative analysis of the system’s risk posture, presumptions should be made that the threats actually occur periodically, if unpredictably, and result in significant damage to system assets that constitute some discernable value to the organization; further, safeguards under review should be considered to be properly conceived and to work correctly in order to make reasonable comparisons. Although approximations and simplifications may be made for the sake of expediency to accomplish a risk analysis, objectivity can prevail when reasonable compromises are made. The most realistic portrayal of actual situations can be made when figures used in computations closely represent the documented local conditions as contrasted with generic, averaged conditions. A concurrent or subsequent security test and evaluation of those very safeguards should be made to establish whether, in fact, the presumptions are correct and, if not, what improvement should be effected.” Definition: “Risk Assessment is a comprehensive determination of the state of risk associated with a system based upon a thorough analysis of the foregoing considerations; by definition, the assessment should include recommendations to support subsequent management decision for (elimination of unnecessarily onerous restrictions and/or) adoption of specific additional safeguards that would reduce the level of system risk to an acceptable level within the constraints imposed by mission, budgetary, political, societal, and other relevant factors.”
- #15: “The terms Risk Analysis, Risk Assessment, and Risk Management are used interchangeably by some individuals and, in the field of Program Management, are construed to represent similar concepts but the order of precedence is inverse to that for Automation or Computer Security.” Definition: “Risk Analysis is the identification of a specific installation’s assets, the threats to them, the system’s vulnerability to those threats, and the presumed loss in consideration of existing and projected safeguards. To accomplish either qualitative or quantitative analysis of the system’s risk posture, presumptions should be made that the threats actually occur periodically, if unpredictably, and result in significant damage to system assets that constitute some discernable value to the organization; further, safeguards under review should be considered to be properly conceived and to work correctly in order to make reasonable comparisons. Although approximations and simplifications may be made for the sake of expediency to accomplish a risk analysis, objectivity can prevail when reasonable compromises are made. The most realistic portrayal of actual situations can be made when figures used in computations closely represent the documented local conditions as contrasted with generic, averaged conditions. A concurrent or subsequent security test and evaluation of those very safeguards should be made to establish whether, in fact, the presumptions are correct and, if not, what improvement should be effected.” Definition: “Risk Assessment is a comprehensive determination of the state of risk associated with a system based upon a thorough analysis of the foregoing considerations; by definition, the assessment should include recommendations to support subsequent management decision for (elimination of unnecessarily onerous restrictions and/or) adoption of specific additional safeguards that would reduce the level of system risk to an acceptable level within the constraints imposed by mission, budgetary, political, societal, and other relevant factors.”
- #30: “The terms Risk Analysis, Risk Assessment, and Risk Management are used interchangeably by some individuals and, in the field of Program Management, are construed to represent similar concepts but the order of precedence is inverse to that for Automation or Computer Security.” Definition: “Risk Analysis is the identification of a specific installation’s assets, the threats to them, the system’s vulnerability to those threats, and the presumed loss in consideration of existing and projected safeguards. To accomplish either qualitative or quantitative analysis of the system’s risk posture, presumptions should be made that the threats actually occur periodically, if unpredictably, and result in significant damage to system assets that constitute some discernable value to the organization; further, safeguards under review should be considered to be properly conceived and to work correctly in order to make reasonable comparisons. Although approximations and simplifications may be made for the sake of expediency to accomplish a risk analysis, objectivity can prevail when reasonable compromises are made. The most realistic portrayal of actual situations can be made when figures used in computations closely represent the documented local conditions as contrasted with generic, averaged conditions. A concurrent or subsequent security test and evaluation of those very safeguards should be made to establish whether, in fact, the presumptions are correct and, if not, what improvement should be effected.” Definition: “Risk Assessment is a comprehensive determination of the state of risk associated with a system based upon a thorough analysis of the foregoing considerations; by definition, the assessment should include recommendations to support subsequent management decision for (elimination of unnecessarily onerous restrictions and/or) adoption of specific additional safeguards that would reduce the level of system risk to an acceptable level within the constraints imposed by mission, budgetary, political, societal, and other relevant factors.”