SlideShare a Scribd company logo
Operations Security
Muhammad Wajahat Rajab
Question…
Operations Security seeks to primarily protect against
which of the following?
A. Object reuse
B. Facility disaster
C. Compromising emanations
D. Asset threats
Question…
Operations Security seeks to primarily protect against
which of the following?
A. Object reuse
B. Facility disaster
C. Compromising emanations
D. Asset threats
Punch Line
• Primarily concerned with the protection and control of
information processing assets
Overview
Domain Introduction
• Mixture of all the domains…
• Core goal of Operations Security?
– Availability
• Are others important?
– Surely, they are!
• The domain is divided into following sections:
– Privileged Entity Controls
– Resource Protection
– Continuity of Operations
– Change Control Management
Points to ponder
• What is the state of being free from danger or injury?
• What are the opposite terms for the following?
– Availability
– Integrity
– Confidentiality
Privileged Entity Controls
Introduction
• Privileged Entity Controls are the mechanisms that give
privileged access to…
– Hardware
– Software
– Data
• Where do the controls that permit privileged functions
usually reside?
Privileged Entity Controls
• Account Management
• System Accounts
• System Operators
• Ordinary Users
• System Administrators
• Security Administrators
Account Management
• Involves life-cycle process for every account in a system
• Primarily four types of accounts…
– Root
– Service
– Privileged user
– Ordinary user
• Accounts not needed should be disabled or deleted!
Account Management (2)
• Efficient management requires assignment of individual
accounts into groups or roles
– What is a group account?
• Group management involves assigning a user account to
one or multiple groups
– Each group is given a set of permissions to access objects
within a system!
System Accounts
• Dedicated accounts to provide a variety of system
services using autonomous processes
– Services are background processes that run in their own
security context
– DBMS contain number of these accounts
System Operators
• Work in data center environments where mainframe
systems are used
– Given elevated privileges
• Which can lead to circumvention of security policy!
• Use of these privileges should be monitored through audit log
• Responsibilities assigned to operators include…
– Implementing the initial program load
– Monitoring execution of the system
– Volume mounting
System Operators (2)
– Controlling job flow
– Bypass label processing
– Renaming and relabeling resources
– Reassignment of ports
Operations Security Presentation
Ordinary Users
• Given restrictive system privileges!
• Allowed access that require minimum privileges to run
• Work in client/server architecture environment
• Should not be allowed to monitor system execution
• Should not be allowed to reassign ports
• Should not be allowed the re-labeling of the resources
System Administrators
• Manage system operations and maintenance
• Ensure system is functioning properly for system users
• Privileges assigned to trained and authorized individuals
• Privileges to affect critical operations such as setting…
– Time, Boot sequence, System logs and Passwords
Security Administrators
• Oversee the security operations of a system
• Security operations include:
– Account management
– Assignment of file sensitive labels
– System security settings
– Audit data review
– Provide a check and balance of the power assigned to
System Administrators
• Through auditing and reviewing the activities
Security Administrator Functions
• File Sensitivity Labels
• Clearances
• System Security Characteristics
• Passwords
• Audit Data Analysis and Management
File Sensitivity Labels
• Implemented to control access to information
• Allow privileges or deny access to a file
• Prevent data from being written to an area on the system
with a lower sensitivity
Clearances
• Assigned according to trustworthiness and the level of
access needed for sensitive information
• Ensure proper level of clearance has been assigned prior
to providing access
System Security Characteristics
• Define the security settings of systems and applications…
– Network devices
– Database Management Systems
• Improper configuration can impact the proper operation
of the system or network!
Passwords
• Password distribution is an important function
• Trusted distribution channels needed to avoid a
compromise
• Types of passwords?
Audit Data Analysis and Management
• Auditing information can be obtained from
– Servers, Workstations, Databases, Firewalls, etc…
• Tools used must detect unauthorized activity or attacks
• Auditing mechanism must support organizational policy
• Auditing can affect the system availability…
– Consume CPU time, Network bandwidth, Storage Space!
• Keep in mind the log retaining issues
– Regulations
Operations Security Presentation
Question…
What setup should an administrator use for regularly
testing the strength of user passwords?
A. A networked workstation so that the live password database can
easily be accessed by the cracking program.
B. A networked workstation so the password database can easily be
copied locally and processed by the cracking program.
C. A standalone workstation on which the password database is copied
and processed by the cracking program.
D. A password-cracking program is unethical; therefore it should not be
used.
Question…
What setup should an administrator use for regularly
testing the strength of user passwords?
A. A networked workstation so that the live password database can
easily be accessed by the cracking program.
B. A networked workstation so the password database can easily be
copied locally and processed by the cracking program.
C. A standalone workstation on which the password database is copied
and processed by the cracking program.
D. A password-cracking program is unethical; therefore it should not be
used.
Resource Protection
Introduction
• Resource protection includes…
– Facilities
– Hardware
– Software
– Documentation
– Threats to Operations
– Control Methods
– Data and Media Control
– Disposal Control
Facilities
• Use systems and controls to sustain the IT operation
environment
– Fire detection and suppression systems
– HVAC
– Water and sewage systems
– Reliable power supply and distribution system
– Power line conditioners
– Telecommunication systems
– Access control and intrusion detection systems
Hardware
• Appropriate physical security needed to ensure CIA…
– Concept of least privilege
– Restricted access
– Escorting a visitor
– Protecting workstations
– Protecting the printing devices
– Authorized access to firewalls
– Limited access to…
• Routers, Switches etc
– Periodic inspection of network cables
Hardware (2)
– Use of strong encryption in wireless communication
• WPA over WEP
Software
• Preventing copyright infringements
• Preventing illegal duplication and distribution of software
– Periodic inventory scans
• Software escrow
– Need?
• Proper SDLC procedures
• Proper testing and version control
– Separation of duties
• Protecting the Operating System passwords
• Protecting the Audit Logs
Documentation
• Ensuring the protection of documentation related to…
– Network design
– Vulnerabilities
– Proprietary methods
• Proprietary information  Trade secrets
– Source code
• All important documentation should be controlled and
catalogued!
Threats to Operations
• Disclosure of sensitive information
– Confidentiality
• Corruption/modification of processes
– Integrity
• Theft / Removal of resources
– Confidentiality, Integrity, Availability
• Destruction of resources
– Availability
• Interruption of resources
– Availability
Operations Security Presentation
Control Methods
• Input / Output Control
• Equipment Control
• Support System Control
• Personnel Control
• Antivirus Management
Input / Output Control
• Input…
– Time-stamping, Authentication, Logging
– Audit trails
• Record of data entered into the system
• Record of the data edited
• Output…
– Release sensitive data after signing it
– Empty report should contain "No Output"
– Information storage area must be protected
Equipment Control
• Regular monitoring, maintenance
• Penetration test should be conducted
• Use encryption for data communication
• Remote maintenance should be restricted
• Third party maintenance should be supervised
• Data center should have minimal exposure from
environmental threats
• Restricted access to secure room where operational
components are located
– Keep log of equipment moving in and out of restricted
room!
Operations Security Presentation
Personnel Control
• Security awareness training
• Background checks and screening
• Separation of duties
• Job rotation
• Accountability through logging and monitoring
– Need to know basis
– The principle of least privilege
• Mandatory vacation!
Antivirus Management
• Continuous monitored updates
• Automatic scheduled scanning
– Issues?
• Antivirus software must be present
in...
– Email servers
– File servers
– Workstations
Data and Media Control
• Data
– Backup data
– Encrypt sensitive data
• Media
– Use a media library/librarian
– Marking
– Logging
– Integrity verification
– Physical Access Protection
– Transmittal
– Disposition
Disposal Control
• Initiates at the end of life cycle of a system
• Ensure that regulations do not require to keep specific
data for a period of time
• Prevent dumpster diving
• Properly erasing data from media
– Degaussing
– Zeroization
– Physical destruction
Degaussing
• Data is stored on magnetic media by the representation
of the polarization of the atoms
• Degaussing changes this polarization (magnetic
alignment) by using a type of large magnet to bring it
back to its original flux
Zeroization
• Purging (Overwriting) existing data with '1s' and '0s‘…
– Single pass - Data area is overwritten once with '1' or '0'
– DoD Method - The data area is overwritten with '0s' then
'1s' and then once with pseudo random data
– NSA erasure algorithm - Data is overwritten seven times
with '0' pattern then with '1' and so on…
– Gutmann Method - The data is overwritten 35 times!
Physical Destruction
• Best method for papers and read only media
– There are highly specialized recovery programs to recover
data after disk wiping
Question
What is the main issue with media reuse?
A. Degaussing
B. Data remanence
C. Media destruction
D. Purging
Question
What is the main issue with media reuse?
A. Degaussing
B. Data remanence
C. Media destruction
D. Purging
Continuity of Operations
Introduction
• Backup Types
• Backup Methods
• Hardware
• Communications
• Facilities
• Operational Controls
• Problem Management
Backup Types
• Full Backup
• Incremental Backup
• Differential Backup
Full Backup
• All files are backed up
• Fastest restoration process
• Takes the longest to perform backup
Incremental Backup
• Backs up files that have changed since last backup
• Backups can be performed quickly
• Restoration takes longer
Differential Backup
• Backs up files that have changed since last full backup
• For restoration, full backup is restored and then
differential backup is restored
Backup Methods
• Hierarchical Storage Management
• Disk Mirroring
• Disk Duplexing
• RAID
• Storage Area Network
Hierarchical Storage Management
• Uses hard disk and optical or tape jukebox technology to
offer continuous online backup functionality
• Files are moved along a hierarchy of storage devices to
less expensive form storage based on rules tied to the
frequency of data access
• Transparent to users
Disk Mirroring
• Exact same data is written to two or more hard disks
• Uses one disk controller
– Controller is the single point of failure
Disk Duplexing
• Exact same data is written to two or more hard disks
• Backup device has more than one disk controller
RAID
• Level 0
– Striping
• No fault tolerance
– High performance
• Level 1
– Mirroring
• Level 2
– Data strip over all drives at the bit level
– Parity = Yes
– Requires 39 disks (Not Practical)
RAID (2)
• Level 3
– Byte level parity
– All parity data is on one disk
• Level 4
– Block level parity
• Level 5
– Parity = Yes
– Parity over all disks!
Operations Security Presentation
Operations Security Presentation
Byte level
Operations Security Presentation
Storage Area Network
• Several distinct storage systems that connected together
to create a backup network
• High speed sub-network of shared storage devices
• Transparent to user
Hardware
• Redundant and backup components
– Hot spares / Cold spares
• Multiple power supplies
• Fail over devices
– Router, Firewalls etc
• Standby services
Communications
• Redundant communication links
– Multiple lines between distributed resources
• Backup communication links include...
– Local Phone company
– Long distance carriers
– Competitive telecommunication carriers
– Broadband through telephone lines
– Broadband over cable modems
– Wireless metropolitan area networks
– Satellite links
Facilities
• Continuous well regulated power
– Redundant feeds, Power line regulators
– Back up power sources
• UPS, Generators
• Proper humidity and temperature level
– 40% to 60%
– 70° to 74° F
• Physical Security
– Access controls, Intrusion detection systems, Guards etc.
• Well documented contingency plans
Operations Security Presentation
Operational Controls
• Development and enforcement of SOPs
– System start up
– Error conditions and how to handle them?
– System shutdown
– Restoring the system from backup media
• Boot up sequence (C:, A:, D:) should not be available to
reconfigure
• Writing activities to system logs should not be bypassed
Operational Controls (2)
• Output should not be able to be rerouted
• Fail secure (Fail closed)
• Fail safe (Fail open)
• Recovery action…
– Warm reboot (Controlled, Automatic)
– Emergency system restart (Uncontrolled, Automatic)
– System cold start (Uncontrolled, Manual)
Problem Management
• Problem = Unknown cause of one or more incidents
• Known error = Successfully diagnosed problem
– For which a solution or work around has been identified!
• Problem tracking and reporting
• Advantages:
– Lowering impact
– Reducing failures
– Preventing from reoccurring
Problem Management (2)
• Problems to be investigated…
– Any incident different from standard procedures
– Unexplainable, Randomly occurring process
– Any processing anomalies
• Examples…
– System component failure
– Power failure
– Telecommunication failure
Problem Management (3)
• Examples
– Tampering
– Production delay
– Input / Output errors
– Spam
– Phishing
– Malware
– Spyware
– Denial of service
Operations Security Presentation
Change Control Management
Introduction
• Change Control Management
– Change Control Process
– Configuration Management
– Contingency Planning
– Intrusion Response
– Operations Management
Change Control Management
• Authorizes changes to production systems, including
system and application software
• Changes to production system include...
– Implementation of new applications
– Modifications of existing applications
– Removing old applications
– Upgrading or patching system software
Change Control Process
• Request
• Impact assessment
• Approval/Disapproval
• Build
– Test
• Notification
• Implementation
• Monitoring
• Documentation
Configuration Management
• Performed after a change has been approved through a
change control process
• Ensures that the changes to production systems are done
properly
• Ensures that changes do not take place unintentionally or
unknowingly
• Documentation and maintenance of documents
pertaining to system and software changes
Contingency Planning
• Allows production environment to continue to operate
after disruption
• Coordinates backups and recovery plans
• Identifies mission critical functions and systems that
support them
• Identifies critical interdependencies
• Generates formal written recovery procedures
• Promotes proper training as well as testing of plans
Intrusion Response
• Audit trail monitoring
• Auditing event include…
– Monitoring and identifying system resource use
– Monitoring and analyzing network traffic and connections
– Monitoring and identifying user account and file access
– Scanning for malicious code
– Verifying file and data integrity
– Probing for system and network vulnerabilities
Operations Management
• Operation Management include reviewing…
– Implementation of vendor patches
– Operating logs
– Inventory
– Change control practices
– Incident reporting in Problem Management
– System/Audit logs
– Audits/Security reviews
Thank you…
• Any Questions…
Question 1
Critical data is?
A. Subject to classification by regulatory bodies or legislation
B. Data of high integrity
C. Always protected at the highest level
D. Instrumental for business operations
Question 1
Critical data is?
A. Subject to classification by regulatory bodies or legislation
B. Data of high integrity
C. Always protected at the highest level
D. Instrumental for business operations
Question 2
When an organization is determining which data is
sensitive, it must consider all of the following EXCEPT:
A. Expectations of customers
B. Legislation or regulations
C. Quantity of data
D. Age of the data
Question 2
When an organization is determining which data is
sensitive, it must consider all of the following EXCEPT:
A. Expectations of customers
B. Legislation or regulations
C. Quantity of data
D. Age of the data
Question 3
All of the following are examples of Preventative Control
EXCEPT?
A. Intrusion detection systems
B. Human resources policies
C. Anti-virus software
D. Fences
Question 3
All of the following are examples of Preventative Control
EXCEPT?
A. Intrusion detection systems
B. Human resources policies
C. Anti-virus software
D. Fences
Question 4
To speed up RAID disk access, an organization can:
A. Use larger hard drives
B. Stripe the data across several drives
C. Mirror critical drives
D. Disallow some queries
Question 4
To speed up RAID disk access, an organization can:
A. Use larger hard drives
B. Stripe the data across several drives
C. Mirror critical drives
D. Disallow some queries
Question 5
A timely review of system access audit records is an
example of which type of security function?
A. Avoidance
B. Deterrence
C. Prevention
D. Detection
Question 5
A timely review of system access audit records is an
example of which type of security function?
A. Avoidance
B. Deterrence
C. Prevention
D. Detection
Question 6
Which of the following is not a technique used for
monitoring?
A. Penetration testing
B. Intrusion detection
C. Violation processing (using clipping levels)
D. Countermeasures testing
Question 6
Which of the following is not a technique used for
monitoring?
A. Penetration testing
B. Intrusion detection
C. Violation processing (using clipping levels)
D. Countermeasures testing
Thank you…

More Related Content

PPTX
Access Controls
PPT
2. access control
PDF
Access Control System, BMS
PDF
Access Control Presentation
PPT
Ch07 Access Control Fundamentals
PPSX
8 Access Control
PDF
Access_Control_Systems_and_methodology
PPT
Operations_Security - Richard Mosher
Access Controls
2. access control
Access Control System, BMS
Access Control Presentation
Ch07 Access Control Fundamentals
8 Access Control
Access_Control_Systems_and_methodology
Operations_Security - Richard Mosher

What's hot (20)

PPT
Managing your access control systems
PPTX
CISSP - Chapter 3 - Physical security
PDF
An overview of access control
PPSX
6 Physical Security
PPT
Chap5 2007 C I S A Review Course
PPT
Application and Systems Development
PPTX
Data/File Security & Control
PPTX
Access control Week 1
PPTX
It security
PPT
Development of security architecture
PDF
BAIT1103 Chapter 7
PPT
3. security architecture and models
ODP
CISSP Week 22
PDF
Information systems security(1)
PPT
Access control3
PPTX
CISSP week 26
PPT
Security Architecture
PDF
PDF
Linux Security best Practices with Fedora
PPT
Security and privacy
Managing your access control systems
CISSP - Chapter 3 - Physical security
An overview of access control
6 Physical Security
Chap5 2007 C I S A Review Course
Application and Systems Development
Data/File Security & Control
Access control Week 1
It security
Development of security architecture
BAIT1103 Chapter 7
3. security architecture and models
CISSP Week 22
Information systems security(1)
Access control3
CISSP week 26
Security Architecture
Linux Security best Practices with Fedora
Security and privacy
Ad

Viewers also liked (18)

PDF
Physical Security Presentation
DOCX
Training to be done this year
PPT
Writing Goals For Your Employees
PPTX
Operational Security Intelligence
PPTX
Enterprise GIS Planning and Framework
PPTX
Operational Security
PPT
8. operations security
PPT
Training coordinator kpi
DOCX
Training coordinator performance appraisal
DOCX
G4S Security Officer Training and Benefits Proposal
PDF
Certificate Security Guard
PPT
Employee Security Training[1]@
PPS
Security Training Incident Investigation And Report Writing.Ppt
PDF
KPI Course slides
PPT
Security training module
PDF
Building Security Operation Center
PPSX
4 Operations Security
Physical Security Presentation
Training to be done this year
Writing Goals For Your Employees
Operational Security Intelligence
Enterprise GIS Planning and Framework
Operational Security
8. operations security
Training coordinator kpi
Training coordinator performance appraisal
G4S Security Officer Training and Benefits Proposal
Certificate Security Guard
Employee Security Training[1]@
Security Training Incident Investigation And Report Writing.Ppt
KPI Course slides
Security training module
Building Security Operation Center
4 Operations Security
Ad

Similar to Operations Security Presentation (20)

PPTX
Operations Security
ODP
Cissp Week 23
PPTX
operating system ppt tegeng2.pptxguktgjh
PPTX
Chapter 3 security part i auditing operating systems and networks
PPTX
chp unit 1 Provide Network System Administration.pptx
PPTX
Chapter 3 security part i auditing operating systems and networks
PPTX
providenetworksystemadministration.pptxhnnhgcbdjckk
PPTX
Securing Networks and Operating Systems.pptx
PPT
Information system securit lecture 1y .ppt
PPTX
Data security
PDF
information security introduction for campus students.pdf
PPTX
Lecturesocial media ppt social media ppt social media ppt 5.pptx
PPTX
CISSP Chapter 7 - Security Operations
PPT
08 -Securing Information Systems at workplace.ppt
PPT
Securing Management Information Systems.ppt
PPTX
Security Baselines and Risk Assessments
DOCX
Security and Ethical Challenges Contributors Kim Wanders.docx
DOCX
Security and Ethical Challenges Contributors Kim Wanders.docx
PPTX
CH01-CompSec4e.pptx
PPTX
CS5300 class presentation on managing information systems
Operations Security
Cissp Week 23
operating system ppt tegeng2.pptxguktgjh
Chapter 3 security part i auditing operating systems and networks
chp unit 1 Provide Network System Administration.pptx
Chapter 3 security part i auditing operating systems and networks
providenetworksystemadministration.pptxhnnhgcbdjckk
Securing Networks and Operating Systems.pptx
Information system securit lecture 1y .ppt
Data security
information security introduction for campus students.pdf
Lecturesocial media ppt social media ppt social media ppt 5.pptx
CISSP Chapter 7 - Security Operations
08 -Securing Information Systems at workplace.ppt
Securing Management Information Systems.ppt
Security Baselines and Risk Assessments
Security and Ethical Challenges Contributors Kim Wanders.docx
Security and Ethical Challenges Contributors Kim Wanders.docx
CH01-CompSec4e.pptx
CS5300 class presentation on managing information systems

Recently uploaded (20)

PDF
ANTIBIOTICS.pptx.pdf………………… xxxxxxxxxxxxx
PPTX
IMMUNITY IMMUNITY refers to protection against infection, and the immune syst...
PPTX
BOWEL ELIMINATION FACTORS AFFECTING AND TYPES
PDF
Business Ethics Teaching Materials for college
PPTX
Cell Types and Its function , kingdom of life
PPTX
Microbial diseases, their pathogenesis and prophylaxis
PDF
Mark Klimek Lecture Notes_240423 revision books _173037.pdf
PPTX
PPH.pptx obstetrics and gynecology in nursing
PDF
VCE English Exam - Section C Student Revision Booklet
PDF
O5-L3 Freight Transport Ops (International) V1.pdf
PPTX
Renaissance Architecture: A Journey from Faith to Humanism
PDF
Supply Chain Operations Speaking Notes -ICLT Program
PPTX
Pharma ospi slides which help in ospi learning
PDF
Complications of Minimal Access Surgery at WLH
PDF
Microbial disease of the cardiovascular and lymphatic systems
PPTX
master seminar digital applications in india
PPTX
Cell Structure & Organelles in detailed.
PDF
Abdominal Access Techniques with Prof. Dr. R K Mishra
PPTX
Final Presentation General Medicine 03-08-2024.pptx
PDF
Classroom Observation Tools for Teachers
ANTIBIOTICS.pptx.pdf………………… xxxxxxxxxxxxx
IMMUNITY IMMUNITY refers to protection against infection, and the immune syst...
BOWEL ELIMINATION FACTORS AFFECTING AND TYPES
Business Ethics Teaching Materials for college
Cell Types and Its function , kingdom of life
Microbial diseases, their pathogenesis and prophylaxis
Mark Klimek Lecture Notes_240423 revision books _173037.pdf
PPH.pptx obstetrics and gynecology in nursing
VCE English Exam - Section C Student Revision Booklet
O5-L3 Freight Transport Ops (International) V1.pdf
Renaissance Architecture: A Journey from Faith to Humanism
Supply Chain Operations Speaking Notes -ICLT Program
Pharma ospi slides which help in ospi learning
Complications of Minimal Access Surgery at WLH
Microbial disease of the cardiovascular and lymphatic systems
master seminar digital applications in india
Cell Structure & Organelles in detailed.
Abdominal Access Techniques with Prof. Dr. R K Mishra
Final Presentation General Medicine 03-08-2024.pptx
Classroom Observation Tools for Teachers

Operations Security Presentation

  • 2. Question… Operations Security seeks to primarily protect against which of the following? A. Object reuse B. Facility disaster C. Compromising emanations D. Asset threats
  • 3. Question… Operations Security seeks to primarily protect against which of the following? A. Object reuse B. Facility disaster C. Compromising emanations D. Asset threats
  • 4. Punch Line • Primarily concerned with the protection and control of information processing assets
  • 6. Domain Introduction • Mixture of all the domains… • Core goal of Operations Security? – Availability • Are others important? – Surely, they are! • The domain is divided into following sections: – Privileged Entity Controls – Resource Protection – Continuity of Operations – Change Control Management
  • 7. Points to ponder • What is the state of being free from danger or injury? • What are the opposite terms for the following? – Availability – Integrity – Confidentiality
  • 9. Introduction • Privileged Entity Controls are the mechanisms that give privileged access to… – Hardware – Software – Data • Where do the controls that permit privileged functions usually reside?
  • 10. Privileged Entity Controls • Account Management • System Accounts • System Operators • Ordinary Users • System Administrators • Security Administrators
  • 11. Account Management • Involves life-cycle process for every account in a system • Primarily four types of accounts… – Root – Service – Privileged user – Ordinary user • Accounts not needed should be disabled or deleted!
  • 12. Account Management (2) • Efficient management requires assignment of individual accounts into groups or roles – What is a group account? • Group management involves assigning a user account to one or multiple groups – Each group is given a set of permissions to access objects within a system!
  • 13. System Accounts • Dedicated accounts to provide a variety of system services using autonomous processes – Services are background processes that run in their own security context – DBMS contain number of these accounts
  • 14. System Operators • Work in data center environments where mainframe systems are used – Given elevated privileges • Which can lead to circumvention of security policy! • Use of these privileges should be monitored through audit log • Responsibilities assigned to operators include… – Implementing the initial program load – Monitoring execution of the system – Volume mounting
  • 15. System Operators (2) – Controlling job flow – Bypass label processing – Renaming and relabeling resources – Reassignment of ports
  • 17. Ordinary Users • Given restrictive system privileges! • Allowed access that require minimum privileges to run • Work in client/server architecture environment • Should not be allowed to monitor system execution • Should not be allowed to reassign ports • Should not be allowed the re-labeling of the resources
  • 18. System Administrators • Manage system operations and maintenance • Ensure system is functioning properly for system users • Privileges assigned to trained and authorized individuals • Privileges to affect critical operations such as setting… – Time, Boot sequence, System logs and Passwords
  • 19. Security Administrators • Oversee the security operations of a system • Security operations include: – Account management – Assignment of file sensitive labels – System security settings – Audit data review – Provide a check and balance of the power assigned to System Administrators • Through auditing and reviewing the activities
  • 20. Security Administrator Functions • File Sensitivity Labels • Clearances • System Security Characteristics • Passwords • Audit Data Analysis and Management
  • 21. File Sensitivity Labels • Implemented to control access to information • Allow privileges or deny access to a file • Prevent data from being written to an area on the system with a lower sensitivity
  • 22. Clearances • Assigned according to trustworthiness and the level of access needed for sensitive information • Ensure proper level of clearance has been assigned prior to providing access
  • 23. System Security Characteristics • Define the security settings of systems and applications… – Network devices – Database Management Systems • Improper configuration can impact the proper operation of the system or network!
  • 24. Passwords • Password distribution is an important function • Trusted distribution channels needed to avoid a compromise • Types of passwords?
  • 25. Audit Data Analysis and Management • Auditing information can be obtained from – Servers, Workstations, Databases, Firewalls, etc… • Tools used must detect unauthorized activity or attacks • Auditing mechanism must support organizational policy • Auditing can affect the system availability… – Consume CPU time, Network bandwidth, Storage Space! • Keep in mind the log retaining issues – Regulations
  • 27. Question… What setup should an administrator use for regularly testing the strength of user passwords? A. A networked workstation so that the live password database can easily be accessed by the cracking program. B. A networked workstation so the password database can easily be copied locally and processed by the cracking program. C. A standalone workstation on which the password database is copied and processed by the cracking program. D. A password-cracking program is unethical; therefore it should not be used.
  • 28. Question… What setup should an administrator use for regularly testing the strength of user passwords? A. A networked workstation so that the live password database can easily be accessed by the cracking program. B. A networked workstation so the password database can easily be copied locally and processed by the cracking program. C. A standalone workstation on which the password database is copied and processed by the cracking program. D. A password-cracking program is unethical; therefore it should not be used.
  • 30. Introduction • Resource protection includes… – Facilities – Hardware – Software – Documentation – Threats to Operations – Control Methods – Data and Media Control – Disposal Control
  • 31. Facilities • Use systems and controls to sustain the IT operation environment – Fire detection and suppression systems – HVAC – Water and sewage systems – Reliable power supply and distribution system – Power line conditioners – Telecommunication systems – Access control and intrusion detection systems
  • 32. Hardware • Appropriate physical security needed to ensure CIA… – Concept of least privilege – Restricted access – Escorting a visitor – Protecting workstations – Protecting the printing devices – Authorized access to firewalls – Limited access to… • Routers, Switches etc – Periodic inspection of network cables
  • 33. Hardware (2) – Use of strong encryption in wireless communication • WPA over WEP
  • 34. Software • Preventing copyright infringements • Preventing illegal duplication and distribution of software – Periodic inventory scans • Software escrow – Need? • Proper SDLC procedures • Proper testing and version control – Separation of duties • Protecting the Operating System passwords • Protecting the Audit Logs
  • 35. Documentation • Ensuring the protection of documentation related to… – Network design – Vulnerabilities – Proprietary methods • Proprietary information  Trade secrets – Source code • All important documentation should be controlled and catalogued!
  • 36. Threats to Operations • Disclosure of sensitive information – Confidentiality • Corruption/modification of processes – Integrity • Theft / Removal of resources – Confidentiality, Integrity, Availability • Destruction of resources – Availability • Interruption of resources – Availability
  • 38. Control Methods • Input / Output Control • Equipment Control • Support System Control • Personnel Control • Antivirus Management
  • 39. Input / Output Control • Input… – Time-stamping, Authentication, Logging – Audit trails • Record of data entered into the system • Record of the data edited • Output… – Release sensitive data after signing it – Empty report should contain "No Output" – Information storage area must be protected
  • 40. Equipment Control • Regular monitoring, maintenance • Penetration test should be conducted • Use encryption for data communication • Remote maintenance should be restricted • Third party maintenance should be supervised • Data center should have minimal exposure from environmental threats • Restricted access to secure room where operational components are located – Keep log of equipment moving in and out of restricted room!
  • 42. Personnel Control • Security awareness training • Background checks and screening • Separation of duties • Job rotation • Accountability through logging and monitoring – Need to know basis – The principle of least privilege • Mandatory vacation!
  • 43. Antivirus Management • Continuous monitored updates • Automatic scheduled scanning – Issues? • Antivirus software must be present in... – Email servers – File servers – Workstations
  • 44. Data and Media Control • Data – Backup data – Encrypt sensitive data • Media – Use a media library/librarian – Marking – Logging – Integrity verification – Physical Access Protection – Transmittal – Disposition
  • 45. Disposal Control • Initiates at the end of life cycle of a system • Ensure that regulations do not require to keep specific data for a period of time • Prevent dumpster diving • Properly erasing data from media – Degaussing – Zeroization – Physical destruction
  • 46. Degaussing • Data is stored on magnetic media by the representation of the polarization of the atoms • Degaussing changes this polarization (magnetic alignment) by using a type of large magnet to bring it back to its original flux
  • 47. Zeroization • Purging (Overwriting) existing data with '1s' and '0s‘… – Single pass - Data area is overwritten once with '1' or '0' – DoD Method - The data area is overwritten with '0s' then '1s' and then once with pseudo random data – NSA erasure algorithm - Data is overwritten seven times with '0' pattern then with '1' and so on… – Gutmann Method - The data is overwritten 35 times!
  • 48. Physical Destruction • Best method for papers and read only media – There are highly specialized recovery programs to recover data after disk wiping
  • 49. Question What is the main issue with media reuse? A. Degaussing B. Data remanence C. Media destruction D. Purging
  • 50. Question What is the main issue with media reuse? A. Degaussing B. Data remanence C. Media destruction D. Purging
  • 52. Introduction • Backup Types • Backup Methods • Hardware • Communications • Facilities • Operational Controls • Problem Management
  • 53. Backup Types • Full Backup • Incremental Backup • Differential Backup
  • 54. Full Backup • All files are backed up • Fastest restoration process • Takes the longest to perform backup
  • 55. Incremental Backup • Backs up files that have changed since last backup • Backups can be performed quickly • Restoration takes longer
  • 56. Differential Backup • Backs up files that have changed since last full backup • For restoration, full backup is restored and then differential backup is restored
  • 57. Backup Methods • Hierarchical Storage Management • Disk Mirroring • Disk Duplexing • RAID • Storage Area Network
  • 58. Hierarchical Storage Management • Uses hard disk and optical or tape jukebox technology to offer continuous online backup functionality • Files are moved along a hierarchy of storage devices to less expensive form storage based on rules tied to the frequency of data access • Transparent to users
  • 59. Disk Mirroring • Exact same data is written to two or more hard disks • Uses one disk controller – Controller is the single point of failure
  • 60. Disk Duplexing • Exact same data is written to two or more hard disks • Backup device has more than one disk controller
  • 61. RAID • Level 0 – Striping • No fault tolerance – High performance • Level 1 – Mirroring • Level 2 – Data strip over all drives at the bit level – Parity = Yes – Requires 39 disks (Not Practical)
  • 62. RAID (2) • Level 3 – Byte level parity – All parity data is on one disk • Level 4 – Block level parity • Level 5 – Parity = Yes – Parity over all disks!
  • 67. Storage Area Network • Several distinct storage systems that connected together to create a backup network • High speed sub-network of shared storage devices • Transparent to user
  • 68. Hardware • Redundant and backup components – Hot spares / Cold spares • Multiple power supplies • Fail over devices – Router, Firewalls etc • Standby services
  • 69. Communications • Redundant communication links – Multiple lines between distributed resources • Backup communication links include... – Local Phone company – Long distance carriers – Competitive telecommunication carriers – Broadband through telephone lines – Broadband over cable modems – Wireless metropolitan area networks – Satellite links
  • 70. Facilities • Continuous well regulated power – Redundant feeds, Power line regulators – Back up power sources • UPS, Generators • Proper humidity and temperature level – 40% to 60% – 70° to 74° F • Physical Security – Access controls, Intrusion detection systems, Guards etc. • Well documented contingency plans
  • 72. Operational Controls • Development and enforcement of SOPs – System start up – Error conditions and how to handle them? – System shutdown – Restoring the system from backup media • Boot up sequence (C:, A:, D:) should not be available to reconfigure • Writing activities to system logs should not be bypassed
  • 73. Operational Controls (2) • Output should not be able to be rerouted • Fail secure (Fail closed) • Fail safe (Fail open) • Recovery action… – Warm reboot (Controlled, Automatic) – Emergency system restart (Uncontrolled, Automatic) – System cold start (Uncontrolled, Manual)
  • 74. Problem Management • Problem = Unknown cause of one or more incidents • Known error = Successfully diagnosed problem – For which a solution or work around has been identified! • Problem tracking and reporting • Advantages: – Lowering impact – Reducing failures – Preventing from reoccurring
  • 75. Problem Management (2) • Problems to be investigated… – Any incident different from standard procedures – Unexplainable, Randomly occurring process – Any processing anomalies • Examples… – System component failure – Power failure – Telecommunication failure
  • 76. Problem Management (3) • Examples – Tampering – Production delay – Input / Output errors – Spam – Phishing – Malware – Spyware – Denial of service
  • 79. Introduction • Change Control Management – Change Control Process – Configuration Management – Contingency Planning – Intrusion Response – Operations Management
  • 80. Change Control Management • Authorizes changes to production systems, including system and application software • Changes to production system include... – Implementation of new applications – Modifications of existing applications – Removing old applications – Upgrading or patching system software
  • 81. Change Control Process • Request • Impact assessment • Approval/Disapproval • Build – Test • Notification • Implementation • Monitoring • Documentation
  • 82. Configuration Management • Performed after a change has been approved through a change control process • Ensures that the changes to production systems are done properly • Ensures that changes do not take place unintentionally or unknowingly • Documentation and maintenance of documents pertaining to system and software changes
  • 83. Contingency Planning • Allows production environment to continue to operate after disruption • Coordinates backups and recovery plans • Identifies mission critical functions and systems that support them • Identifies critical interdependencies • Generates formal written recovery procedures • Promotes proper training as well as testing of plans
  • 84. Intrusion Response • Audit trail monitoring • Auditing event include… – Monitoring and identifying system resource use – Monitoring and analyzing network traffic and connections – Monitoring and identifying user account and file access – Scanning for malicious code – Verifying file and data integrity – Probing for system and network vulnerabilities
  • 85. Operations Management • Operation Management include reviewing… – Implementation of vendor patches – Operating logs – Inventory – Change control practices – Incident reporting in Problem Management – System/Audit logs – Audits/Security reviews
  • 86. Thank you… • Any Questions…
  • 87. Question 1 Critical data is? A. Subject to classification by regulatory bodies or legislation B. Data of high integrity C. Always protected at the highest level D. Instrumental for business operations
  • 88. Question 1 Critical data is? A. Subject to classification by regulatory bodies or legislation B. Data of high integrity C. Always protected at the highest level D. Instrumental for business operations
  • 89. Question 2 When an organization is determining which data is sensitive, it must consider all of the following EXCEPT: A. Expectations of customers B. Legislation or regulations C. Quantity of data D. Age of the data
  • 90. Question 2 When an organization is determining which data is sensitive, it must consider all of the following EXCEPT: A. Expectations of customers B. Legislation or regulations C. Quantity of data D. Age of the data
  • 91. Question 3 All of the following are examples of Preventative Control EXCEPT? A. Intrusion detection systems B. Human resources policies C. Anti-virus software D. Fences
  • 92. Question 3 All of the following are examples of Preventative Control EXCEPT? A. Intrusion detection systems B. Human resources policies C. Anti-virus software D. Fences
  • 93. Question 4 To speed up RAID disk access, an organization can: A. Use larger hard drives B. Stripe the data across several drives C. Mirror critical drives D. Disallow some queries
  • 94. Question 4 To speed up RAID disk access, an organization can: A. Use larger hard drives B. Stripe the data across several drives C. Mirror critical drives D. Disallow some queries
  • 95. Question 5 A timely review of system access audit records is an example of which type of security function? A. Avoidance B. Deterrence C. Prevention D. Detection
  • 96. Question 5 A timely review of system access audit records is an example of which type of security function? A. Avoidance B. Deterrence C. Prevention D. Detection
  • 97. Question 6 Which of the following is not a technique used for monitoring? A. Penetration testing B. Intrusion detection C. Violation processing (using clipping levels) D. Countermeasures testing
  • 98. Question 6 Which of the following is not a technique used for monitoring? A. Penetration testing B. Intrusion detection C. Violation processing (using clipping levels) D. Countermeasures testing