it-slideshares.blogspot.com

1. Lesson 8-Information Security
Process

2. Overview
Introducing information security process.
Conducting an assessment.
Developing a policy.
Implementing security.
Conducting awareness training.
Conducting audits.

3. Introduction to Information
Security Process
The process of information security

4. Conducting an Assessment
An assessment determines:
The total value of the organization’s information assets.
The size of the threats with respect to confidentiality, integrity,
availability, and accountability.
The vulnerabilities of the information assets and the
organization.
The organization’s overall risk and recommended changes to
current information security policy.

5. Conducting an Assessment
While conducting an assessment of an organization, examine:
Network.
Staff.
Physical security measures.
Workload and employee
Existing policies and
attitude.
procedures.
Adherence.
Precautions.
Business.
Awareness.

6. Network (1/3)
The organization’s network is the easiest access point to
information and systems.
A network diagram helps examine each point of
connectivity.
Query network administrators to know the type of network
management system in use.
Perform a vulnerability scan of all systems.

7. Network (2/3)
The protection mechanism within a network should include:
Router access control lists and firewall rules on all Internet
access points.
Authentication mechanisms used for remote access.
Protection mechanisms on access points to other organizations.
Encryption mechanism used to protect portable computers and
to transmit and store information.

8. Network (3/3)
The protection mechanism within a network should include
(continued):
Anti-virus systems in place on servers, desktops, and e-
mail systems.
Server security configurations.

9. Physical Security Measures (1/2)
Important physical security information includes identifying:
The protection mechanisms to site, buildings, office space,
paper records, and data center.
The personnel responsible for the physical security.
The critical and sensitive areas.
The location of the communication lines within the building.
The types of UPS in place and how long the current UPS will
sustain.

10. Physical Security Measures (2/2)
Important physical security information requires knowing:
How power is supplied to the site and data center.
The systems connected to the UPS.
The environment controls attached to the UPS in the
data center.
The type of suppression system in the data center.
The personnel who need to be notified incase of
power or environment control failure.

11. Policies and Procedures
Policies and procedures must be examined for relevance,
appropriateness, and completeness.
Procedures must define the way tasks are currently
performed.
Map requirements with stated goals.
Update policies and procedures on a regular basis.
Assess the organization’s security awareness program.
Examine the recent incident and audit reports.

12. Precautions
Precautions are used to restore operations when something
goes wrong.
Backup systems and disaster recovery plans are two
components of precautions.
Understand which backup system is used and how often is
it used.
Examine the disaster recovery plan for relevance and
completeness.

13. Awareness
Determine the staff’s level of awareness of security issues
and policies.
Create awareness of security threats, vulnerabilities, and
signs indicating that a system is compromised.
Ensure that the staff knows how to implement a disaster
recovery plan.

14. People
Examine whether the staff members have the necessary
skills to implement a security program.
They must understand policy work and latest security
products.
Administrator’s must be able to administer the
organization’s systems and networks.

15. Workload and Employee
Attitude
Overworked employees do not contribute much to the
security environment.
Determine whether the workload is a temporary problem.
Assess management attitude with regard to security issues.
Identify responsible personnel for security within the
organization.
Employees must be aware of the management’s
commitment to security.

16. Adherence
While determining the intended security environment,
identify the actual security environment.
The intended security environment is defined by policy,
attitudes, and existing mechanisms.
Determine whether adherence to this policy requirement is
lacking.

17. Business (1/2)
Identify the cost if confidentiality, integrity, availability, or
accountability of information is compromised.
Measure vulnerabilities in monetary terms, downtime, lost
reputation, or lost business.
Identify the flow of information across the organization.

18. Business (2/2)
Identify organizational interdependencies.
Identify which systems and networks are important to the
primary function of the organization.
Identify the back-end systems.

19. Assessment Results
Analyze the information.
Assess all security vulnerabilities.
Compile a complete set of risks in the order of high to low.
Include a list of recommendations to manage each risk.
Present potential cost in terms of money, time, resources,
reputation, and lost business.
Develop a security plan.
Allocate and schedule resources to handle security.

20. Developing a Policy (1/2)
Policies and procedures define the expected state of an
organization’s security.
It defines the tasks to be performed during implementation.
Create policies for communication, security, system usage,
backup, account management, incident handling, and disaster
recovery plan.
Choosing the order of policies to develop, depends on:
The criticality of risks.
The time each will take to complete. Ideally, the information policy
should be completed early in the process.

21. Developing a Policy (2/2)
Existing documents require frequent updating.
Use these documents and identify deficiencies.
Involve people who developed the policies.

22. Implementing Security (1/2)
Implementation of organizational policies include:
Identification and implementation of technical tools and
physical controls.
Hiring of security staff.
Examination of each implementation and its interactions with
other controls.

23. Implementing Security (2/2)
Security reporting systems.
Authentication systems.
Internet security.
Intrusion detection systems.
Encryption.
Physical security.
Staff.

24. Security Reporting Systems(1/3)
It is a mechanism to track adherence to policies and
procedures.
It tracks the overall state of vulnerabilities within the
organization.
It can use manual or automated systems.
Enforce computer use policies such as:
Tracking Internet use.
Restricting access while maintaining login attempts.
Removing unwanted applications from the desktop installations.

25. Security Reporting Systems(2/3)
System vulnerability scans include:
Tracking the number of systems on the network.
Tracking the number of vulnerabilities on these systems.
Providing vulnerability reports to system administrators for
correction or explanation.

26. Security Reporting Systems(3/3)
Policy adherence is a time-consuming security task.
It can be automated or manual.
The automated checks require more time to set up and
configure. They provide complete results in a timely
manner.
In manual system, a security personnel examines and
monitors all facets of the security policy.

27. Authentication Systems
Authentication systems are used to prove the identity of
users accessing a network.
These systems identify authorized users and grant them
physical access to a facility.
They should be implemented with proper planning.
Password restrictions, smart cards, and biometrics are few
examples of authenticated systems.

28. Internet Security
The implementation of Internet security includes:
Placing an access control device such as a firewall.
Setting up virtual private networks (VPN).
Changing network architecture.

29. Intrusion Detection Systems
(IDS)
IDS are designed to detect any unwarranted entry into a
protected area.
Choice of IDS depends on overall organization risks and
available resources.
Anti-virus software, manual and automated log examination,
host-based and network-based intrusion detection software
are a few IDS.

30. Encryption
Encryption can be used to protect information in transit or
while residing in storage.
Choose well-known and well-reviewed algorithm. Private
key encryption is faster than public key encryption.
Include an effective key management technique such as
link encryptors. A system must change keys periodically.

31. Physical Security
Ensure that a proper procedure for authenticating users is
in place.
Restrict access to data center.
Protect the data center from fire, high temperature, and
power failure.
Remodel the data center to implement fire suppression and
temperature control.
Plan for disruptions due to implementation of an UPS.

32. Staff
Hire skilled staff:
Who can handle the security implementation.
To conduct awareness training programs.
Who will be responsible for the security of the organization.

33. Conducting Awareness
Training
Conduct awareness training to provide necessary
information to:
Employees.
Administrators.
Developers.
Executives.
Security staff.

34. Employees
Employees should know the importance of security.
They must be trained to identify and protect sensitive
information.
Ensure that the employees are aware of the organization
policy, password selection, and prevention of attacks.

35. Administrators
System administrators must be updated on the latest
hacker techniques, security threats, and security patches.
Include updates in regular administration staff meetings.
Send updates to administrators as and when they are
prepared.

36. Developers
Developers should know proper programming techniques to
reduce security vulnerabilities.
They should have a proper understanding of the security
department’s role during the development process.
Security issues must be addressed in the design phase.

37. Executives
Management must be informed of the state of security and
the progress of the program.
Periodic presentations must include the results of recent
assessments, and the status of various security projects.
Metrics that indicate the risks to the organizations must be
a part of such reports.

38. Security Staff
Security staff must be kept up-to-date to help them provide
appropriate services to the organization.
Conduct both internal and external training programs.
Include security-related topics in the training sessions.

39. Conducting Audits
Audit is the final step in the information security process.
It ensures that controls are configured correctly and map to
the policy.

40. Types/Components of Audits
Policy adherence audits.
Periodic and new project assessments.
Penetration tests.

41. Policy Adherence Audits
The audit policy determines whether or not the system
configurations adhered to the policy.
They are the traditional audit function.
Any variations are recorded as violations.
Conduct periodic audits on implementation of information
policy and storage of sensitive documents.

42. Periodic and New Project
Assessments
Changes in computer and network environments results in
change in risks and assessments.
Full assessment of the organization should be performed
periodically.
Major audits and assessment must be done by an external
firm.

43. Penetration Tests
Penetration test attempts to exploit an identified vulnerability to gain
access to systems and information.
Test effectiveness of controls using penetration tests.
Physical penetration tests include individuals who attempt to gain
unauthorized access to a facility.
Social engineering tests include testing employees to divulge classified
information.
Products
http://www.coresecurity.com/products/coreimpact/index.php
http://www.immunitysec.com/products-canvas.shtml

44. Summary
Conducting an information security assessment involves
determining the value of an organization’s information
assets.
Policies and procedures define the work to be performed
during implementation.
The implementation of policy involves identification and
implementation of tools and controls.

45. Summary
Awareness training provides necessary security information
to employees.
Audits ensure that policies are being implemented and
followed.