Security Risk Management

1. Security Risk Management Eduardo Rivadeneira IT pro Microsoft Mexico

2. Session Prerequisites • Hands-on experience installing, configuring, administering, and planning the deployment of Windows 2000 Server or Windows Server 2003 • Knowledge of Active Directory and Group Policy concepts Level 200

3. Agenda • Dia 1 • Comunidades Technet Mexico • Entrenamiento Comunidades Mexico • Essentials of Security Parte 1 • Dia 2 • Essentials of Security Parte 2 • Security Risk Management Parte 1 • Dia 3 • Security Risk Managemnt Parte 2 • Peguntas y Respuestas

4. Comunidades Technet Mexico Dia 1

5. Comunidades en Mexico On Line • http://groups.msn.com/itpromexico Presénciales • Comunidad DF • IT Pro Mexico • Aida Lara • alora@hubbell.com.mx • Victor Guadarrama Olivares • vmgo@mvps.org • http://itpromexico.com.mx

6. Comunidades • Comunidad Monterrey • Carlos Alberto Morales cmorales@madisa.com • Astrid Rodríguez Garza Vrodriguez@mail.risoul.com.mx http://groups.msn.com/itpromonterrey • Comunidad San Quintín Baja California • Genaro N. Lopez Norori gnlopez@hotmail.com • http://groups.msn.com/ITproSanQuintin

7. Comunidades • Comunidad Guadalajara • Oscar T. Aceves Dávalos • itan040@hotmail.com • http://groups.msn.com/itprogdl • Comunidad Coatzacoalcos • Gabriel Castillo • jcastillo@celanese.com.mx • http://groups.msn.com/ITcoatzacoalcos

8. Comunidades • Tijuana • Andree Ochoa • andreeochoa@netscape.net • http://groups.msn.com/itprotijuana • Puebla • Jorge Garcia • MasterFx@masterfx.net • http://groups.msn.com/ITICOPuebla

9. Procedimientos Comunidades • Evento presencial • Enviar la información de las reuniones del siguiente mes Lugar, fecha, hora, descripción del evento, lugar del evento • Confirmar que el evento este dado de alta en http://wwww.microsoft.com/mexico/eventos • Todos los participantes deberán registrarse vía Web en el evento y entregar su registro con el código de barra el dia del evento • El instructor deberá recolectar las evaluaciones y hojas de registro para entregárselas al director del área

10. Essentials of Security Dia 1

11. Business Case • Business Case • Security Risk Management Discipline • Defense in Depth • Security Incident Response • Best Practices • 10 Immutable Laws of Security

12. Loss of Revenue Damage to Reputation Damage to Investor Confidence Loss or Compromise of Data Damage to Customer Confidence Interruption of Business Processes Legal Consequences Impact of Security Breaches

13. 2003 CSI/FBI Survey The cost of implementing security measures is not trivial; however, it is a fraction of the cost of mitigating security compromises

14. Benefits of Investing in Security Reduced downtime and costs associated with non-availability of systems and applications Reduced labor costs associated with inefficient security update deployment Reduced data loss due to viruses or information security breaches Increased protection of intellectual property

15. Security Risk Management Discipline • Business Case • Security Risk Management Discipline • Defense in Depth • Security Incident Response • Best Practices • 10 Immutable Laws of Security

16. Security Risk Management Discipline (SRMD) Processes • Assessment • Assess and valuate assets • Identify security risks and threats • Analyze and prioritize security risks • Security risk tracking, planning, and scheduling • Development and Implementation • Develop security remediation • Test security remediation • Capture security knowledge • Operation • Reassess assets and security risks • Stabilize and deploy new or changed countermeasures

17. Assessment: Assess and Valuate Assets Asset Priorities (Scale of 1 to 10) – Example * * For example purposes only – not prescriptive guidance

18. Assessment: Identify Security Risks and Threats – STRIDE

19. Assessment: Analyze and Prioritize Security Risks – DREAD Example Worksheet • DREAD • Damage • Reproducibility • Exploitability • Affected Users • Discoverability • Risk Exposure = Asset Priority x Threat Rank

20. Assessment: Security Risk Tracking, Planning, and Scheduling Detailed Security Action Plans Example Worksheets

21. Configuration management Detailed Security Action Plans Patch management System monitoring System auditing Operational policies Operational procedures Development and Implementation Security Remediation Strategy Testing Lab Production Environment Knowledge Documented for Future Use

22. Operation: Reassess Assets and Security Risks • Reassess risks when there is a significant change in assets, operation, or structure • Assess risks continually Production Environment Documented Knowledge New Web Site Internet Services Testing Lab

23. Production Environment Operation: Stabilize and Deploy New or Changed Countermeasures System Administration Team New or Changed Countermeasures Security Administration Team Network Administration Team

24. Defense in Depth • Business Case • Security Risk Management Discipline • Defense in Depth • Security Incident Response • Best Practices • 10 Immutable Laws of Security

25. The Defense-in-Depth Model Using a layered approach: • Increases an attacker’s risk of detection • Reduces an attacker’s chance of success Policies, Procedures, & Awareness Physical Security Data ACLs, encryption, EFS Application Application hardening, antivirus OS hardening, authentication, patch management, HIDS Host Internal Network Network segments, IPSec, NIDS Firewalls, Network Access Quarantine Control Perimeter Guards, locks, tracking devices Security documents, user education

26. I think I will wedge the computer room door open. Much easier. Hey, I need to configure a firewall. Which ports should I block? They have blocked my favorite Web site. Lucky I have a modem. I think I will use my first name as a password. Description of the Policies, Procedures, and Awareness Layer

27. Say, I run a network too. How do you configure your firewalls? Hi, do you know where the computer room is? I can never think of a good password. What do you use? Hey, nice modem. What's the number of that line? Policies, Procedures, and Awareness Layer Compromise

28. Policies, Procedures, and Awareness Layer Protection Employee security training helps users support thesecurity policy Firewall ConfigurationProcedure Physical Access Security Policy Device Request Procedure User Information Secrecy Policy

29. Description of the Physical Security Layer All of the assets within an organization’s IT infrastructure must be physically secured

30. View, Change, or Remove Files Damage Hardware Remove Hardware Install Malicious Code Physical Security Layer Compromise

31. Lock doors and install alarms Employ security personnel Enforce access procedures Monitor access Limit data input devices Use remote access tools to enhance security Physical Security Layer Protection

32. Business Partner Main Office LAN LAN Internet Internet Services Internet Services Network perimeters can include connections to: Branch Office • The Internet • Branch offices • Business partners • Remote users • Wireless networks • Internet applications Remote User Wireless Network LAN Description of the Perimeter Layer

33. Business Partner Main Office LAN LAN Internet Internet Services Internet Services Network perimeter compromise may result in a successful: Branch Office • Attack on corporate network • Attack on remote users • Attack from business partners • Attack from a branch office • Attack on Internet services • Attack from the Internet Remote User Wireless Network LAN Perimeter Layer Compromise

34. Business Partner Main Office LAN LAN Internet Internet Services Internet Services Network perimeter protection includes: Branch Office • Firewalls • Blocking communication ports • Port and IP address translation • Virtual private networks (VPNs) • Tunneling protocols • VPN quarantine Remote User Wireless Network LAN Perimeter Layer Protection

35. Sales Wireless Network Marketing Human Resources Finance Description of the Internal Network Layer

36. Unexpected Communication Ports Unauthorized Access to Systems Unauthorized Access to Wireless Networks Sniff Packets from the Network Access All Network Traffic Internal Network Layer Compromise

37. Internal Network Layer Protection Require mutual authentication Segment the network Encrypt network communications Restrict traffic even when it is segmented Sign network packets Implement IPSec port filters to restrict traffic to servers

38. Demonstration 1: Configuring IPSec Port Filtering Your instructor will demonstrate how to: • Create and configure an IP Security policy that contains IPSec port filters that will be used to lock down unnecessary ports on an IIS server • View IPSec port filter properties

39. Description of the Host Layer • Contains individual computer systems on the network • Often have specific roles or functions • The term “host” is used to refer to both clients and servers

40. Exploit Unsecured Operating System Configuration Unmonitored Access Host Layer Compromise Exploit Operating System Weakness Distribute Viruses

41. Host Layer Protection Harden client and server operating systems Disable unnecessary services Monitor and audit access and attempted access Install and maintain antivirus software Use firewalls Keep security patches and service packs up to date

42. Windows XP SP2 Advanced Security Technologies • Network protection • Memory protection • Safer e-mail handling • More secure browsing • Improved computer maintenance • Get more information on Windows XP Service Pack 2at http://www.microsoft.com/sp2preview

43. Demonstration 2: Overview of Windows XP SP2 Your instructor will demonstrate the new and enhanced security features in Windows XP SP2: • Security Center • Windows Firewall • Internet Explorer

44. Preguntas • http://groups.msn.com/itpromexico • Sección de webcast