1 / 12

IT Security Assurance

IT Security Assurance. Management of Network and User Behavior Budi Rahardjo INDOCISC - ID-CERT budi@indocisc.com - budi@cert.or.id http://budi.insan.co.id. Holistic approach. PEOPLE. awareness, skill. PROCESS. security as part of business process. implementation. TECHNOLOGY.

heath
Download Presentation

IT Security Assurance

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. IT Security Assurance Management of Network and User Behavior Budi RahardjoINDOCISC - ID-CERTbudi@indocisc.com - budi@cert.or.idhttp://budi.insan.co.id

  2. Holistic approach PEOPLE • awareness, skill • ... PROCESS • security as part of business process • ... • implementation • ... TECHNOLOGY

  3. Topology of Security Holes ISP Sniffedfloodspoof Security Holes • Network • OS • Apps. / database Internet Sniffedfloodspoof Sniffedfloodspoof user Web Site Virus,Trojan horse • Applications (database,Web server) attacked • OS attacked Userid, Password,PIN, credit card # www.bank.co.id

  4. Why Network Security? • More companies are connected to the Internet • More attacks are peformed over network. No physical boundary • Question: • how to manage network security? • Can it detect anomalous behaviors?

  5. Rule of thumb: layered protectionan example IDSdetectintrusions Customer(with authentication device) corebankingapplications Internet Internetbankinggateway Web server(s) Firewalprotect accessto web server Firewallprotect accessto SQL

  6. Management Tools • There are plethora of security management tools, but are • not integrated • still difficult to use • still at their infancy stage • But it’s better than nothing, so use the tools!

  7. People • Threats are coming from • Outside • Inside 1999 CSI/FBI Computer Crime Survey Disgruntled workers 86%Independent hackers 74%US Competitors 53%Foreign corp 30%Forign gov. 21%

  8. People • There must be a “security culture” from top to bottom • CEO, C* • … • even janitor! • Awareness is important oops, I accidently unplugged the server

  9. Everybody must know the DOs and the DON’Ts • DO • Change password regularly • … • DON’T • Share password • … • This is part of policy and procedures

  10. Incident Response Team • There should be an IRT in the company • Handles incidents • Users know that they are responsible for their behaviors • Provides security trends in the company to executives • Q: Where should IRT report to?

  11. Still missing in this slides ... • Process • Company’s business process? • Policy & procedures?

  12. Security is a continuous process Manageyour networkand users Concluding Remarks SECURITYLIFECYCLE

More Related