Module 3 - Information Assurance Concepts.pdf
- 2. 1 Discuss Defense in Depth in Information Assurance 2 Explain the CIS Triad 3 Discuss what is IAAA 4 Explain Nonrepudiation and Authentication Expected Learning Outcome:
- 3. Defense in Depth The 19th century military strategist Helmuth von Moltke is right, he could discourage even the best planner with his aphorism of “No plan survives contact with the enemy.” Once engaged, attackers have the advantage: They know what they are going to do and what their objective is. To provide an effective defense, each layer must be composed of multiple countermeasures of varying complexity, application, and rigor; this is defense-in-depth.
- 4. Defense in Depth Defense-in-depth provides an adequate information assurance posture, but it tends to be reactive. Defense must always be planned because it is the de facto deployment in response to the escalating sophistication of attack experiences. As former U.S. Defense Secretary Donald H. Rumsfeld stated, “You go to war with the army you have, not the army you might want or wish to have at a later time.” A defensive strategy cannot be expected to respond to unknown and potentially urgent risk situations such as last-minute patches and catch-up planning, but it can reduce the impact of such weaknesses. A proper defense-in-depth strategy may mean the difference between a difficult survivability and being put out of business.
- 5. Defense in Depth A correctly planned, dynamic, information assurance strategy becomes an essential emergent property of the system it protects. To provide defense-in-depth, the strategy and the program it defines cannot be static. Rick Dove, an expert on systems and artificial intelligence, proposes that defense-in-depth must provide parity with the agility of intelligent attacking systems. A defense-in-depth strategy must have six characteristics. • Self-organizing • Adapting to unpredictable situations • Evolving in concert with an ever-changing environment • Reactively resilient • Proactively innovative • Harmonious with system purpose
- 6. Defense in Depth Defense-in-depth is most appropriately defined as part of an organization’s security architecture. Smaller to mid-size organizations may not have the resources to develop fully an information assurance architecture and will therefore often rely on risk assessments to help find weaknesses in their security posture. The security architecture of an organization must develop defenses for every level of an application, system, or workflow using physical, logical, and technical countermeasures to slow the attack of an adversary. To slow the attackers, defenders must present numerous challenges through various dimensions of countermeasures.
- 7. Defense in Depth Defense-in-depth is most appropriately defined as part of an organization’s security architecture. Smaller to mid-size organizations may not have the resources to develop fully an information assurance architecture and will therefore often rely on risk assessments to help find weaknesses in their security posture. The security architecture of an organization must develop defenses for every level of an application, system, or workflow using physical, logical, and technical countermeasures to slow the attack of an adversary. To slow the attackers, defenders must present numerous challenges through various dimensions of countermeasures.
- 8. Defense in Depth Defense-in-depth relies heavily on the application of segmentation. Segmentation ensures that a single compromised element of a system cannot compromise the system as a whole. Segmentation also ensures the most efficient use of controls throughout the organization. Information and services require varying degrees of defensive protection depending on their value to the organization. Figure-1 illustrates the relationship between assets, impacts, and segmentation.
- 9. Figure 1. Defense-in-depth conceptual model
- 10. The CIA triad When dealing with information assurance and its subcomponent information security, you should be familiar with three primary security objectives—confidentiality, integrity, and availability—to identify problems and provide proper solutions. This concept is widely known as the CIA triad, as shown in Figure2. Confidentiality, Integrity, and Availability
- 11. Figure 2 CIA triad Confidentiality, Integrity, and Availability
- 12. Confidentiality Confidentiality and privacy are related terms but are not synonymous. Confidentiality is the assurance of data secrecy where no one is able to read data except for the intended entity. Confidentiality should prevail no matter what the data state is—whether data resides on a system, is being transmitted, or is in a particular location (for example, a file cabinet, a desk drawer, or a safe). Privacy, on the other hand, involves personal autonomy and control of information about oneself. Both are discussed in this chapter. The word classification merely means categorization in certain industries.
- 13. Confidentiality Assign an appropriate sensitivity categorization to information to maintain confidentiality. Different categorizations will address the degree of security controls needed. For example, a range of military classification (categorization in the military) includes unclassified, confidential, secret, and top secret. A military document classified (categorized) as top secret will require control mechanisms to eliminate threats that may expose the location or characteristics of an important asset.
- 14. Integrity People understand integrity in terms of dealing with people. People understand the sentiment “Jill is a woman of integrity” to mean Jill is a person who is truthful, is trustworthy, and can be relied upon to perform as she promises. When considering integrity in an information assurance perspective, organizations will use it not only from a personnel perspective but also from a systems perspective.
- 15. Integrity In information systems, integrity is a service that assures that the information in a system has not been altered except by authorized individuals and processes. It provides assurance of the accuracy of the data and that it has not been corrupted or modified improperly. Integrity may be achieved by applying a mathematical technique whereby the information will later be verified. Examples of integrity controls are watermarks, bar codes, hashing, checksums, and cyclic redundancy check (CRC). A second form of integrity control manages the processes to enter and manipulate information. For example, a physician (and the patient) would want the integrity of medical records. The records should reflect the actual data from the laboratory, and once the data is stored, it should be stored so it is unchangeable outside defined processes.
- 16. Availability Availability is the service that assures data and resources are accessible to authorized subjects or personnel when required. The second component of the availability service is that resources such as systems and networks should provide sufficient capacity to perform in a predictable and acceptable manner. Secure and quick recovery from disruptions is crucial to avoid delays or decreased productivity. Therefore, it is necessary that protection mechanisms should be in place to ensure availability and to protect against internal and external threats. Availability is also often viewed as a property of an information system or service. Most service level agreements and measures of performance for service providers surround availability above all else. The availability of a system may be one of its most marketable properties.
- 17. CIA Balance The three fundamental security requirements are not equally critical in each application. For example, to one organization, service availability and the integrity of information may be more important than the confidentiality of information. A web site hosting publicly available information is an example. Therefore, you should apply the appropriate combination of CIA in correct portions to support your organization’s goals and provide users with a dependable system.
- 18. Nonrepudiation and Authentication The MSR model of information assurance describes additional services associated with nonrepudiation. Digital transactions are prone to frauds in which participants in the transaction could repudiate (deny) a transaction. A digital signature is evidence that the information originated with the asserted sender of the information and prevents subsequent denial of sending the message. Digital signatures may provide evidence that the receiver has in fact received the message and that the receiver will not be able to deny this reception. This is commonly known as nonrepudiation. In large organizations such as the U.S. government, efforts are in place to implement digital signatures through smartcards, mobile devices, and even biometric Nonrepudiation
- 19. Nonrepudiation and Authentication The term nonrepudiation describes the service that ensures entities are honest in their actions. There are variants of nonrepudiation, but the most often used are as follows: • Nonrepudiation of source prevents an author from false refusal of ownership to a created or sent message, or the service will prove it otherwise. • Nonrepudiation of acceptance prevents the receiver from denying having received a message, or else the service will prove it otherwise.
- 20. Nonrepudiation and Authentication The term nonrepudiation describes the service that ensures entities are honest in their actions. There are variants of nonrepudiation, but the most often used are as follows: • Nonrepudiation of source prevents an author from false refusal of ownership to a created or sent message, or the service will prove it otherwise. • Nonrepudiation of acceptance prevents the receiver from denying having received a message, or else the service will prove it otherwise.
- 21. Identification, Authentication, Authorization, and Accountability (IAAA) Identification, authentication, authorization, and accountability are the essential functions in providing an access management system. This service as described by the MSR model of information assurance is summarized as authentication but reflects the entire IAAA process. The overall architecture of an access management system includes the means of identifying its users, authenticating a user’s identity and credentials, and setting and controlling the access level of a user’s authorization. In addition, it should provide for logging and auditing the trail of a user’s activity in search of privilege violations or attempted violations and accounting for system resource usage.
- 22. Figure 3. Steps of IAAA
- 23. Authentication Authentication validates the identification provided by a user. In other words, it makes sure the entity presenting the identification can further prove to be who they claim. To be authenticated, the entity must produce minimally a second credential. Three basic factors of authentication are available to all types of identities. • What you should know (a shared secret, such as a password, which both the user and the authenticator know) • What you should have (a physical identification, such as a smartcard, hardware token, or identification card) • What you are (a measurable attribute, such as biometrics, a thumbprint, or facial recognition)
- 24. Authentication Authentication validates the identification provided by a user. In other words, it makes sure the entity presenting the identification can further prove to be who they claim. To be authenticated, the entity must produce minimally a second credential. Three basic factors of authentication are available to all types of identities. • What you should know (a shared secret, such as a password, which both the user and the authenticator know) • What you should have (a physical identification, such as a smartcard, hardware token, or identification card) • What you are (a measurable attribute, such as biometrics, a thumbprint, or facial recognition)
- 25. Authorization Authorization Once a user presents a second credential and is identified, the system checks an access control matrix to determine their associated privileges. If the system allows the user access, the user is authorized.
- 26. Accountability The act of being responsible for actions taken within a system is accountability. The only way to ensure accountability is to identify the user of a system and record their actions. Accountability makes nonrepudiation extremely important.
- 27. Privacy’s Relationship to Information Assurance As mentioned earlier, a security concept that is often confused with confidentiality is privacy. Privacy describes the control people have to regulate the flow of information about themselves selectively. In contrast, confidentiality requires that only an authorized party access information. This makes confidentiality one of the goals in information assurance but with a less personal emphasis. Despite the subtle difference, both concepts are interrelated. For example, identity theft could be a result of lack of privacy or failure in confidentiality.
- 28. Q. & A.
- 30. Thank You