Module 4

Policy

Your rules and requirements for operations, and your contingency plans

Standards

The particulars of the systems, including specific security technologies and methods for protecting information

Guidelines

Written recommendations and best practices

Procedures

They detail how to implement the security policy, standards, and guidelines

Policies

must both protect and support an organization

You can’t write if you don’t understand your organization does

Management Support

What level?

What do they really care about?

Do they care about security?

Identify The Senior Management Champion for Information Assurance

Risk

is the likelihood of a given threat source exercising a particular potential vulnerability and the resulting impact of that adverse event on the organization.

Risk Management

The technique whereby an organization identifies, analyzes, controls, and monitors risks to its assets or objectives

A formal process, taking into account threats to your organization’s situation and lets you tailor your security program to its needs.

Someone must be designated to be in charge of risk management

–Uncertain outcome

–Possibility of loss

Key elements of risk

Public

Sensitive

Private

Confidential

Corporate Classification Levels

Public

information explicitly approved for release to the public

Sensitive

unauthorized disclosure is against the policy, but won’t impact the company

Private

intended for use within the company, could impact the company

Confidential

unauthorized disclosure could seriously and adversely impact the company

Privacy

Business Sensitive

Legal

What Do You Have To Protect?

Specific Competitors

General Public

Insiders (Need to know)

Who Are You Protecting It From?

Backups

How often do you backup?

How many hours of work can you afford to lose? For each group of data you have?

How long does it take to recover?

Backup Security?

Anti-Virus/Anti-Spyware Software

How will you update workstations?

Do you trust your users to keep the software/signature files updated?

How are you going to handle teleworkers (including travelers)?

How about mobile devices?

Firewall

Is there a Firewall? If not, who made that decision, and what was the justification?

If you use them, have a policy (What is allowed, everything else is forbidden)

Consider Host Firewalls if you use windows, especially for mobile workers/travelers

Passwords

How many User IDs and Passwords can you remember?

Let's write them down in a little book you always carry!

Physical device

Warning Banner

So users/employees know they are subject to be monitored

Why Monitor?

–Bandwidth

–Embarrassment

–Secrets

Continuity Of Operations Plan (COOP)

Backup – Frequency

What to do in case of an incident (natural or manmade)

Any Alternate Site’s security should be the same as a normal computer center

E-Mail

Usage policies, monitoring

OOPs – Procedures

Use of Messages Policy

Web

–Are there separate public and private sites and servers?

–Warning Banner, Consent to Monitor

–Public release of information policies

–Usage policies for surfing

–Monitoring

Web Application Security

SSL only protects data during transmission

Protect your information and data (in or connected to your web application)

Setting up a web application is an invitation to someone to try and get your information and data

Web application security should depend on a positive security model that allows input that is expected and is within expected boun

Security Awareness Training

Initial Security Training

Annual Security Refresher Training

–Social engineering

–Passwords

–Insider threats

–Ethical computing (Performing inappropriate computer tasks and accessing inappropriate sites)

To be most effective, a security-awareness program should address the following risk areas:

Turn off unneeded services in boxes attached to the Internet.

Never use a Web server for anything else.

Regularly apply security patches to critical machines.

Block all executable attachments at the gateway.

Use screen saver lockouts.

Five Easy Security Fixes