Research in: Security Planning and Auditing

1. Research in:Security Planning and Auditing Bel G Raggad Seidenberg School of CS & IS

2. Outline 1. Security Planning2. Security Risk Assessment3. Security Taxonomy4. Security Auditing5. Risk-Driven Security Program6. Security Standards7. Biometrics

3. SecurityPlanning

4. Purpose of Security Plan: · Provide an overview of the security requirements of the system and describe the controls in place or planned for meeting those requirements; and · Delineate responsibilities and expected behavior of all individuals who access the system.

5. (Input) (Process) (Output = a book) Major Application SecurityPlan Security Planning General Support System (Tools) Raggad SP Methodology StrategicSecurityDefinition StrategicSecurityAnalysis StrategicSecurityDesign StrategicSecurityChoice StrategicSecurityReview

6. Chapter 1: Introduction for MA or GSS Chapter 2: System Definition for MA or GSS • 2.1 Plan Control • 2.2 System Identification2.2.1 System Name/Title • 2.2.2 Responsible Organization • 2.2.3 Information Contact(s) • 2.2.4 Assignment of Security Responsibility2.3 System Operational Status • 2.4 General Description/Purpose • 2.5 System Environment • 2.6 System Interconnection/Information Sharing • 2.7 Sensitivity of Information Handled 2.7.1 Laws, Regulations, and Policies Affecting the System • 2.7.2 General Description of Sensitivity 1.1 Background 1.2 Purpose of Security Plan 1.3 System Boundaries 1.4 Multiple Similar Systems 1.5 System Category 1.6 Major Applications 1.7 General Support System

7. Chapter 3: Management Controls for MA or GSS • 3.1 Risk Assessment and Management • 3.2 Review of Security Controls • 3.3 Rules of Behavior • 3.4 Planning for Security in the Life Cycle • 3.4.1 Initiation Phase • 3.4.2 Development/Acquisition Phase • 3.4.3 Implementation Phase • 3.4.4 Operation/Maintenance Phase • 3.4.5 Disposal Phase • 3.5 Authorize Processing

8. Chapter 4 Operational Controls for MA Operational Controls for GSS 4.GSS.1 Personnel Security 4.GSS.2 Physical and Environmental Protection 4.GSS.3 Production, Input/Output Controls 4.GSS.4 Contingency Planning 4.GSS.5 Hardware and System Software Maintenance Controls 4.GSS.6 Integrity Controls 4.GSS.7 Documentation 4.GSS.8 Security Awareness and Training 4.GSS.9 Incident Response Capability 4.MA.1 Personnel Security 4.MA.2 Physical and Environmental Protection 4.MA.3 Production, Input/Output Controls 4.MA.4 Contingency Planning 4.MA.5 Application Software Maintenance Controls 4.MA.6 Data Integrity/Validation Controls 4.MA.7 Documentation 4.MA.8 Security Awareness and Training

9. Chapter 5 Technical Controls for MA Technical Controls for GSS • 5.MA.1 Identification and Authentication • 5.MA.1.1 Identification • 5.MA.1.2 Authentication • 5.MA.2 Logical Access Controls 5.MA.3 Public Access Controls • 5.MA.4 Audit Trails • 5.GSS.1 Identification and Authentication • 5.GSS.1.1 Identification • 5.GSS.1.2 Authentication • 5.GSS.2 Logical Access Controls5.GSS.3 Audit Trails

10. Chapter 6 for MA or GSS 6.1 Periodic Reviews 6.2 Monitoring the SP Progress

11. SP Methodology 1. Strategic Security Definition 2. Strategic Security Analysis 3. Strategic Security Design 4. Strategic Security Choice 5. Strategic Security Review

12. SP is a book of 6 Chapters Chapter 5: TechnicalControls (3/4 sections) Chapter 1: Introduction/Executive Summary (1 section) Chapter 2: System Definition (10 sections) Chapter 3: ManagerialControls (3 sections) Chapter 4: OperationalControls (8 sections) Chapter 6: Conclusions (1 section) 5.StrategicReviewPhase 2.StrategicAnalysisPhase 1.StrategicDefinitionPhase 3.StrategicDesignPhase 4.StrategicChoicePhase

13. Strategic Security Definition -Security plan certification and acceptance page;-Security plan document handling/control;-Date of study;-Responsible organization; -Information contacts.-System name/title;-System category;-General description and purpose;-System environment and special considerations; and-Systems interconnections and information sharing.

14. Strategic Security Design Restructuring -Reorganization -Process reengineering Security control measures -Management controls -Operational controls -Technical controls

15. Management Controls -Administration controls: ■Assignment of Security Responsibility ■Personnel security -Development/Implementation controls: ■ Authorization of Processing ■Security Specifications ■Acquisition Specifications ■Design Review and Testing

16. Operational Controls -Physical and Environmental Protection -Production -Hardware and System Software Maintenance Controls -Security Awareness and Training -Documentation -Contingency Plan -Audit and Variance Detection

17. Technical Controls -User Identification and Authentication --Identification --Authentication -Authorization/Access Controls --Logical access controls --Dial-In Access --Wide Area Networks --Screen Warning Banners (SWB) -Public Access Controls -Data Integrity/Validation Controls --Malicious Programs --Virus Protection --Message Authentication --Integrity Verification --Reconciliation --Digital Signature -Audit Trail Mechanisms -Confidentiality Controls -Incident Response Capability

18. Strategic Security Choice -The security plan phases performed so far may produce different versions of a security plan -SPW meets with system owners and the security admin to review new organizational changes, new security policy additions, new security change requests before presenting the prevailing versions of the completed security plan. -The purpose of the strategic security choice is to make sure that all recommendations included in the final version of the security plan is the most appropriate possible -System owners have to approve all security controls adopted in the security plan

19. Security Strategic Review The purpose of the strategic review is to ensure that the system or application behaves according to the Design Manual containing the security solutions included in the security plan.

20. Strategic Security Review -Life cycle: set arbitrarily to 3 years. -System owners have periodically evaluate risks -System owners have to periodically evaluate the validity of security controls included in the security plan -Any change in the security risks or in the security controls, corrective actions should be applied. -Security controls become invalid or lose efficiency or effectiveness when an organizational change takes place, when a new technology emerges, when security policies change, etc. -Methodology proposes a security deficiency indicator called the security corrective score that should be periodically computed. If the security corrective score goes below a prescribed threshold, for example 0.4, the security plan should be revised.

21. Research in Risk Methodology

22. Security Risk Model

23. Layer T Threat Relative Security Layer S Vulnerabilities Layer V Layer A Affected Asset Damage RS4: unsecured Asset

24. Layer T Threat Relative Security Layer S No Vulnerabilities Layer V Layer A Affected Asset No Damage RS4: Secure Asset

25. Equation (T,S,V,B)? Business value Threat Vulnerability Security Basic Risk (S=0) ? Residual Risk (S>0)

26. t =.5 Layer T Threat T Relative SecurityS=.8 Layer S V =.2 VulnerabilitiesV=.2 Layer V Layer A Damage Risk=$400? A B=$20,000 Risk to loose $400?

27. t =.8 Layer T Threat T Relative SecurityS=.2 Layer S V =.2 VulnerabilitiesV=.9 Layer V Layer A Damage Risk=$11,520 A B=$20,000 Risk to loose $11,520

28. Prob that threat would take place. t =.5 Layer T T Relative Security S=0 V2=.6 V2=.4 Layer S V3=.3 V4=.5 Prob that threat has effect on asset T given threat T has taken place. V1=.2 Layer V V=(v1+v2+v3+v4+v5)//5=.4 Layer A Expected loss of asset A due to threat =4,000 A B=$20,000 Risk to loose $4,000

29. Prob that threat would take place. t =.5 Layer T T Relative Security S=(.8,.6,.0,1.0,.6) S5=.6 S2=.6 Layer S S3=.0 S4=1 Prob that threat has effect on asset T given threat T has taken place. S1=.8 Layer V Layer A Expected loss of asset A due to threat T= $1,480 A B=$20,000 Risk in $: $1,480

30. Mathematical Model

31. Vulnerabilities Assets v11’(1-s11) L11 ζ1 Asset Economic weights A1 T w1 ζn v1n’(1-s1n) L1n All Assets Vj1’(1-sj1) Lj1 ζ1 wj R[Ω] T Aj ζn vjn’(1-sjn) Ljn Enterprise Risk Any exclusive threat T vm1’(1-sm1) Lm1 wm ζ1 Am T Probabilitiesof exclusivethreats ζn vmn’(1-smn) Lmn vij’=Transpose vector of Asset Aj’s vulnerabilities associated with Threat Ti. SecurityControls Business Loss due to Threat*Vulnerability

32. Security Taxonomy & Policy Flow Diagram

33. The Vital Defense Strategy: Raggad’s Taxonomy

34. 3 Discrimination Parameters:-SECURITY DISRUPTION-ACTING ENTITY-ATTACK MODEL

35. 3 SECURITY DISRUPTIONS: (F. COHEN, 1995)-INFORMATION LEAKAGE-INFORMATION CORRUPTION-INFORMATION/SERVICE DENIAL

36. 5 ACTING ENTITIES:(Whitten, Bentley, and Barlow, 1996)-PEOPLE-ACTIVITY-NETWORK-TECHNOLOGY-DATA

37. 4 ATTACK MODELS:-PROBE MODEL-AUTHORIZED ACCESS MODEL-FACTORY MODEL-INFRASTRUCTURE MODEL

38. DISRUPTION * ENTITY * MODEL60 TYPES of SECURITY INFORMATION SYSTEMS

39. Disraption C L D 60 types of SISs A D N P T ENTITY IN, P, D How can People evoke an Infras attack and produce a DoS? AA FA IN PR Attack Model

40. Linking Security Taxonomy to IDS?

41. IDS Response: 1. IDS processing; 2. IDS monitoring; 3. IDS timing; 4. IDS analysis; 5. IDS distribution; 6. IDS embedding What SISs should be invoked? IDS Engine

42. Linking Security Taxonomy to Policy?

43. First-order policy flow context diagram

44. Linking Security Taxonomy to Security Strategy?

45. Phases for a security strategy Phase 1: Define a security strategy Phase 2: Develop security policy and controls

46. Modified Benson’s methodology for defining a security strategy (MBSS) • Objective: help security professionals develop a strategy to protect the availability, integrity, and confidentiality of data in organization's information technology (IT) system. • Players: information resource managers, computer security officials, administrators, and policy staff. • Risks reduced: systematic approach to: • Establish contingency plans in case of a disaster. • Eliminate user errors and malicious and non-malicious attacks. • Detect and prevent from attackers who can gain access to the system and disrupt services, render systems useless, or alter, delete, or steal information.

47. The process of MBSS Security administrators and management: • Decide how much time, money, and effort needs to be spent in order to develop the appropriate security policies and controls. • Analyze company’s specific needs and determine its resource and scheduling requirements and constraints. • Not a one-time activity: a security strategy can save the organization valuable time and provide important reminders of what needs to be done, but it is not a one-time activity. • An integral part of the system lifecycle: periodic updating or appropriate revision are needed, and when changes in configurations and other conditions and circumstances take place. • An iterative process: It is never finished and should be revised and tested periodically.

48. MBSS: steps for a security strategy • Steps in defining a security strategy: • Reviewing current security policies • Identifying Assets and Vulnerabilities to Known Threats • Identifying Likely Attack Methods, Tools, and Techniques • Establishing Proactive and Reactive Strategies • Testing

49. Review of current policies • Need for a strategy: to determine the vulnerabilities current security policies and controls that guard them. • Current status of security policy: Need to identify areas of deficiencies in the policies and examine all existing documents as: • Physical computer security policies such as physical access controls. • Network security policies (for example, e-mail and Internet policies). • Data security policies (access control and integrity controls). • Contingency and disaster recovery plans and tests. • Computer security awareness and training. • Computer security management and coordination policies. • Any other document that contains sensitive info, eg., computer BIOS passwords, router configuration passwords, access control documents, and other device management passwords

50. Identifying Assets and Vulnerabilities to Known Threats • Assessing an organization's security needs: • determining its vulnerabilities to known threats. • recognizing the types of assets that an organization has, which will suggest the types of threats it needs to protect itself against. • Examples of some typical asset/threat situations: • The security admin of a bank knows that the integrity of the bank's information is a critical asset and that fraud, accomplished by compromising this integrity, is a major threat. Fraud can be attempted by inside or outside attackers. • The security admin of a Web site knows that supplying information reliably (data availability) is the site's principal asset. The threat to this information service is a denial of service attack, which is likely to come from an outside attacker.