Network Security
4 likes495 views
This document discusses the importance of information and communication technology (ICT) security and provides guidance on developing an effective security policy. It recommends performing a risk analysis to identify valuable assets, potential threats, and the likelihood and costs of attacks. This will help determine the appropriate level of security needed. The document also stresses the importance of documenting security procedures and developing a clear, enforceable policy to communicate expectations and responsibilities for maintaining a secure network environment.
Network Security
- 1. Information & Communication Technology (ICT) Security أمن تقنية المعلومات والإتصالات نظرة فلسفية وإقتصادية
- 2. Overview Why Secure your Network and Information? 2. How Much Security Do You Need? 3. How to Developing a Security Policy?
- 3. Introduction Setting for every user a password and correct level of file permissions, does not mean we could go to sleep at night confident that our network environment was secure. Internet have accelerated the pace of information dissemination. Individuals with Malicious intent have always had places to exchange ideas, Pirate bulletin boards existed since 1980s. The Internet has become an excellent means to get vulnerability info. Into the hands of network security specialist. Increased Awareness brings increased Responsibility. This is true for S/W company’s as well as network administrators to deploy the Fix. Where to begin ??? Need to view security not as static package, but as a constant process incorporating all facets of Network and I.T.
- 4. Why Secure Network Computer based attacks are on the rise. Not all attacks are publicized. Large Number of attacks go undocumented. Thinking Like an Attacker In order to determine how to best guard your resources, you must identify who would want to disrupt them. An Attacker is someone who looks to steal or disrupt your assets, like a spy or crook. A Hacker is a person with deep knowledge of computers and networking structure. feels the need to go beyond the obvious and to further their understanding of any information system. Cracker who uses this knowledge to illegally or un-ethically penetrate systems.
- 5. Why would someone Want to Ruin My Day? It is extremely rare for staging attacks randomly. Something must be gained by the attack. 70% of Attacks are from Within. Intentional or out of ignorance. External Attacks can come from many diverse sources. Competitors Militant Viewpoints High Profile Bouncing Mail
- 7. How Much Security Do You Need? Begin first by analyzing your network to determine what level of fortification you actually require. Then use this information to develop your security policy. Having done so, you are in good position to start making intelligent decisions about your security structure.
- 8. Performing a Risk Analysis It is the process of identifying the assets you wish to protect and the potential threats against them. What Assets do I need to protect? From what sources am I trying to protect these assets? Who may wish to compromise my network and to what gain? How likely is it that threat will violate my assets. What is the immediate cost if an asset is compromised? What is the cost of recovering from an attack or failure? How can these assets be protected in a cost-effective manner? Am I governed by a regulatory body that dictates the required level of security for my environment?
- 9. What Assets Do I need to Protect? Physical Resources Intellectual Resources Time Resources Perception Resources
- 10. What Sources Am I trying to protect theses Assets from? Internal Systems. Access from field Office Location. Access through a WAN link to Business partner. Access through the Internet. Access through modem pool.
- 11. Who May Wish to Compromise Our Network Employees. Temporary or Consulting Personnel. Competitors. Individuals with viewpoints or objectives radically different from those of your organization. Individuals who wish to gain due to your organization’s public visibility.
- 12. What is the Likelihood of an Attack? Now that we identified our resources and who might attack them, we can assess our organization’s level of potential risk attacks. Is our network isolated or has many entry points? Could an attacker find value in exploiting one of these access points in order to gain access to your network resources? Appraising the attack value of our network is highly subjective. Soliciting inputs
- 13. What is the immediate Cost? For each asset listed, record the immediate cost impact of having that resource compromised or destroyed. Do not include long term effects, such as failure to meet shipping deadlines. Simply calculate the cost for having that asset inaccessible as a network resource. Examples: Hard Drive, new products’ schematic lists, medical records in a hospital, low stock prices, consumer confidence…etc.
- 14. What are the Long-Term recovery Costs? Now that we have quantified the cost of initial failure, we should evaluate the costs incurred when recovering from a failure or a compromise. Identifying the financial impact of various levels of loss. For example given a server that holds corporate information: What is the cost of momentary glitch that disconnects all users? What is the cost of denial-service attack? What is the cost of recovering critical files that have been damaged or deleted? What is the cost of recovering from a failure of a single hardware component? What is the cost of recovering from a complete server failure? What is the cost of recovery when information has been stolen and theft goes goes undetected? Based on those figures, What should be spent to secure our assets? Do not forget assets like reputation, consumer & investor confidence.
- 15. How can I Protect my Assets Cost Effectively? Consider how much security will cost when determining what level of protection is appropriate for your networking environment. We face difficult security choices: Is packet filtering enough? Should I invest in a firewall? Is one firewall sufficient or should I invest in two? Is it worth it to have hybrid firewalls (i.e. hardware and software)? The general guideline is that the cost of all security measures taken to protect a particular asset should be less than the cost of recovering that asset from from a disaster. That’s why it is important to quantify potential threats as well as the cost of recovery.
- 16. Am I Governed by a regulatory Body? Even though you have created a painstakingly accurate risk analysis of your network, there may be some regulatory or overview body that dictates your minimum level of security. It may not be sufficient to simply justify your security precautions. You may be required to meet certain minimum security requirements, regardless of the cost outlay to your organization.
- 17. Budgeting Security Network Depreciable items (server hardware, firewalls and constructions of secured areas) Recurring costs (security personnel, audits and system maintenance) Old Wisdom, “Do not put all your eggs in one basket”. i.e. do not put all your budget on one security mode. Combine budget expenditure with other groups in your organization. Document your findings….
- 18. Developing a Security Policy Why do I even need a security policy? It serves many functions: It is a central document that describes in details, acceptable network activity and penalties for misuse. It also provides a forum for identifying and clarifying security goals and objectives. It shows each employee how he/she is responsible for helping to maintain a secure environment.
- 19. Security Policy Basics In order for a policy to be enforceable, it needs to be: Consistent with other corporate policies. Accepted by the network support staff and appropriate level of management. Enforceable using existing network equipment and procedures. Compliant with local laws.
- 20. What makes a good security usage Policy? Be readily accessible to all members of the organization. Define a clear set of security goals. Accurately define each issue discussed in the policy. Clearly show the organization’s position on each issue. Describe the justification of the policy regarding each issue. Define under what circumstances the issue is applicable. State the role and responsibilities of organizational members with regard to the described issue. Spell-out the consequences of noncompliance with the described policy. Provide contact information for further details. Define the user’s expected level of privacy. Include the organization’s stance on issues not specifically defined.
- 21. Sample Security Policy “ Access to Internet-based Web server resources shall only be allowed for the express purpose of performing work related duties. This policy is to insure the Effectiveness use of networking resources and shall apply equally to all employees. This policy shall be enforced during both production and non-production time periods. All Web server access can be monitored by networking personnel, and employees may be required to justify Web server access to their direct supervisor. Failure to comply with this policy will result in the issuance of a written warning. For more information regarding what is considered appropriate Web server access of internet resources, please consult your direct supervisor. ”
- 22. Summary You should know which assets you need to protect and their inherent value to your organization. Risk Analysis is the cornerstone for each of the security precautions discussed. You should know how to write effective security policy, understanding the importance of a precise security policy to securing your environment. Distribute sample policy notes….
- 23. Thank You
Editor's Notes
- #15: The cost of various levels of failure, combined with the expectation of how frequently a failure or attempted attack may occur, provide metrics to determine the financial impact of disaster recovery for the organization’s network.
- #16: While security precautions are necessary in the modern networking environment, many of us are still required to justify the cost of these precautions.