Operations Security

1. Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”

2. C.I.A.as affected by Operations Controls • Confidentiality: • affect sensitivity & secrecy • Integrity: • how well implementation directly affects accuracy & authenticity • Availability: • affect system’s level of fault tolerance and recovery capability

3. Controls & Protections • Controls used to protect hardware, software, & media from • Threats in environment • Internal or External Intruders • Operators inappropriately accessing resources

4. Categories of Controls • Preventative Controls are designed to • lower amount & impact of unintentional errors • Prevent unauthorized intruders from entering • EX: prenumbered forms & data validation • Detective Controls • To detect an error once it has occurred • After the fact • Corrective (or Recovery) Controls • Implemented to mitigate the loss • Restoring data

5. Categories of Controls (conti) • Deterrent Controls • Encourage compliance, complement other controls • Application Controls • Designed into software to minimize & detect irregularities • Transaction Controls • Input Controls • Processing Controls • Output Controls • Change Controls • Test Controls

6. TCEC “Orange Book” Controls D: Minimal Protection C: Discretionary Protection C1: Discretionary Security Protection C2: Controlled Access Protection B: Mandatory Protection B1:Labeled Security Protection B2: Structured Protection B3: Security Domains A1: Verified Protection

7. Orange Book • Defines assurance requirements for secure computer operations • Assurance: level of confidence that security policy has been correctly implemented • Two types: • Operational: basic features & architecture • Life cycle: controls & standards used in operations & maintenance

8. Orange Book: Covert Channel Analysis • Channel: info transfer path • Covert channel: path that violates security policy • Covert storage channel • Covert timing channel • TCSEC B2: must protect against, must perform analysis for all storage channels • TCSEC B3 & A1: must protect against both types of convert channels

9. Orange Book:Trusted Facility Management • Assignment of a specific individual to administer secruity related system functions • Must take auditable action before being able to assume admin role • B2: System must support separate operator & system admin roles • B3: Must clearly identify functions of security admin

10. Orange Book:Separation of Duties • Assignment of parts of task to different personnel • No one person with total control == no one person that can completely compromise system • “Two man control” • Three distinct system admin roles • System admin • Security admin • Enhanced operator

11. Orange Book:Rotation of Duties • Limit amount of time any individual performs the same security related duties

12. Orange Book:Trusted Recovery • Required only in B3 & A1 level systems • System failure == serious security risk • Security bypassed while not fully functional • Ex: System crash while sensitive data written to disk before ACL changed • Hierarchical Recovery Types • Manual Recovery • Automated Recovery of single failure • Automated Recovery without undue loss

13. Modes of Operation • Dedicated Mode • Each user with any access has a valid personnel clearance, formal access approval (with signed non disclosure), & a valid “need to know” all info • System-High Mode • All above except need to know some info • Compartmental Mode • Need to know only info they have direct access to • Multilevel Mode • Some do not have valid clearance for all info but have clearance & need to know for info they will have access to

14. Change Control • Manages process of tracking & approving changes • Identify, control, audit • Insure changes not diminish sys sec • Document all changes • Primary functions of change control • Change implemented in orderly manner -- test • Inform user base of change • Analyze effect of the change • Reduce negative impact of change

15. Procedures for Change Control • Applying to introduce change • Approval of change • Cataloging intended change • Testing change • Scheduling & implementing change • Reporting change to management

16. Configuration Management • More formalized for highly sec system • Configuration Managers • Identify & document each functional & physical config item • Personally assure approval for and manage all config changes • Record & report status of changes • Audit system config for unknown changes • Configuration Control Board

17. Administrative Controls • More to do with human than hardware or software • Personnel Security • Employment screening / background chk • Mandatory vacations • Job action warnings & terminations • Separation of duties & responsibilities • Least Privilege • Need to know • Change control • Record retention & documentation control

18. Least Privilege • Separate levels of access based on job function • Three basic levels • Read Only • Read/Write: only to data copied from original location • Access Change: original location

19. Operations Job Functions • Computer Operator • Operations analyst • Job control analyst • Production Scheduler • Production Control Analyst • Tape Librarian

20. Others • Record Retention concerns • Data remanence • Info on media after it has been erased • Due care & Due Diligence • Legal, governmental, & simple good business practices • Documentation Control • Security plans, risk ana, security policy, etc

21. Operations Controls • Day-to-day procedures to protect • Most important aspects of (details follow): • Resource protection • Hardware controls • Software controls • Privileged-entity controls • Media controls • Physical access controls

22. Resource Protection • Protect from loss or compromise • Hardware • Lan Hardware, Storage Media, Processing Systems, Standalone Computers, Printers, etc • Software • Program Libraries & Source, Vendor Software, O/S & Utilities • Data • Backup Data, User Data Files, Password Files, Operating data directories, Sys logs

23. Hardware Controls • Hardware maintenance • Maintenance accounts • Disabled until needed • Preset, widely known ids & passwords • Diagnostic port controls • Ports for trouble shooting • Hardware physical contols

24. Software Controls • What software used on system • Licensed software only • Anti-virus management • Software testing • Software utilities • Safe software storage • Backup controls

25. Privileged-Entity Controls • Oversite of personnel with “special” access to systems • Examples of special access • Lower level system commands • Special operational parameters • System control programs

26. Media Controls • Media Security • Logging, Access Control, & Proper Disposal • Overwriting: a pattern, its compliment, then another pattern (0011, 1100, 1010) • Degaussing & Destruction • Media Viability Controls • Protect viability of media used • Marking, Handling, Storage, Orig. Quality • Media Librarian

27. Physical Access Controls • Hardware • Control of comm. Equip, storage media, printed logs & reports • Software • Control of backup files, system logs, production apps, sensitive/critical data • Some personnel need special physical access • It department personnel, Cleaning Staff, Maintenance personnel, third-party contractors, consultants, temp staff • Supervision • Physical piggybacking – 2nd person follows 1st through door (man trap)

28. Monitoring & Auditing • “Reviewing an operational system to see that controls, both manual & automated, are functioning effectively & correctly” • Are technical features being bypassed • Are required procedures being followed • Is there evidence of abnormal computer usage

29. Monitoring • Looking for: • Illegal software installing • Hardware faults & error states • Operational events for abnormalities • Techniques • Intrusion detection • Penetration testing • Violation analysis

30. Intrusion Detection & Violation Analysis • Sampling traffic patterns • Look for activities above clipping level • Clipping Level & Profile based anomaly detection • Baseline of user activity considered “normal” • Enables ignoring normal user errors • When exceeded violation report filed • Also used for variance detection • Looking for • Repetitive mistakes, individuals exceeding their authority, too many people with restricted access, patterns showing serious intrusion attempts

31. Penetration Testing • Attempting to access a system from outside normal • Technology based • Scanning & probing • Demon Dialing / War Driving • Sniffing • Personnel Oriented • Dumpster Diving • Social Engineering

32. Auditing • Checking for internal & external compliance • Patterns of abnormal use • Audit these functions • Backup controls • System & transaction controls • Data library procedures & center security • Systems development standards • Contingency plans

33. Audit Trails • Enables tracing a transaction’s history • Enforcement of accountability • Audit Logs should record • Transaction date & time, who processed it, & where • Any security events relating to transaction • Any commands (with options) executed by user • All identification & authorization attempts • Any files or other resources accessed • Auditor should look for • Amendments to production jobs • Production job returns • Computer operator practices

34. Security Goals of Audit Mechanism • Allow review of patterns of access to individual objects • Allow discovery of repeated attempts to bypass security mechanisms • Find use of privileges by user greater than they should have • An additional form of user assurance that attempt to bypass security will be caught

35. Audit Logs • Prevent log file from being altered • Protect availability of log during event • Protect logging media from destruction or damage

36. Benefits of Auditing & Problem Management • Enhancement of risk assessment program • Enhancement of internal readiness & communications • Personnel Security Training • Reduced failures to manageable level • Prevent (re)occurrence of problem • Mitigate impact of violation

37. Threats • Event that if realized can cause damage to system • Accidental Loss • Operator errors • Transaction processing errors • Inappropriate activities • Inappropriate content • Waste of corporate resources • Sexual or racial harassment • Abuse of privileges • Illegal Computer Operations • Eavesdropping • Fraud, Theft, Sabotage • External Attack

38. Vulnerabilities & Attacks • Traffic / Trend analysis • Analyze data characteristics & pattern rather than content • Stop by: padding message, sending noise, covert channel analysis • Maintenance Accounts • Data-Scavenging Attacks • Keyboard attacks & Laboratory Attacks • Initial Program Load vulnerabilities • Single user mode, boot sequence, bios, CD • Social Engineering • Network Address Hijacking