1 / 62

Personnel and Security

Personnel and Security. EECS 711 Philip Mein "Prakash" Pallavur Sankaranaraynan Annette Tetmeyer. Outline. Introduction Staffing the Security Function Information Security Professional Credentials Employment Policies and Practices Conclusion Questions. 2.

jbond
Download Presentation

Personnel and Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Personnel and Security EECS 711 Philip Mein "Prakash" Pallavur Sankaranaraynan Annette Tetmeyer

  2. Outline • Introduction • Staffing the Security Function • Information Security Professional Credentials • Employment Policies and Practices • Conclusion • Questions 2 EECS 711 Spring 2008 Chapter 10

  3. Introduction • InfoSec department must be carefully structured and staffed with appropriately skilled and screened personnel • Requires Human Resources to have the proper policies integrated into its procedures (hiring, training, promotion, and termination)‏ • What to look for in personnel (certifications)‏ • IT security job descriptions • How to integrate InfoSec policies into an organizations hiring practices 3 EECS 711 Spring 2008 Chapter 10

  4. Staffing the Security Function • Supply and Demand of qualified staff • many economic forecasters expect the deferred demand to become active in the InfoSec field 4 EECS 711 Spring 2008 Chapter 10

  5. Qualifications and Requirements • General management community of interest should learn more about the requirements and qualifications for both IT and InfoSec positions • Upper management should learn more about InfoSec budgetary and personnel needs • The IT and general management communities of interest must grant the InfoSec function an appropriate level of influence and prestige 5 EECS 711 Spring 2008 Chapter 10

  6. Hiring InfoSec Professionals • Understand how organizations are structured and operated • Recognize the InfoSec is a management task that cannot be handled with technology alone • Work well with people in general (written and verbal)‏ • Acknowledge the role of policy in guiding security efforts • Understand the essential role of InfoSec education and training • Perceive the threats facing an organization, understand how these threats can be transformed into attacks, and safeguard the organization from these attacks • Understand how technical controls can be applied to solve specific information security problems • Demonstrate familiarity with mainstream information technologies • Understand IT and InfoSec terminology and concepts 6 EECS 711 Spring 2008 Chapter 10

  7. Entering the InfoSec Profession • Traditional Career Path to InfoSec was from Technology or Military/Law enforcement • Modern Path to InfoSec is from a security education background EECS 711 Spring 2008 Chapter 10

  8. Information Security Positions • Complete job descriptions for InfoSec positions can be found in Charles Cresson Wood's book Information Security Roles and Responisibilities Made Easy • Definers • Provide the policies, guidelines and standards • Do the consulting and risk assessment • Develop the product and technical architectures • Builders • Techies who create and install security solutions • Administrators • Operate and administer the security tools • Security monitoring function • Continuously improve the process 8 EECS 711 Spring 2008 Chapter 10

  9. InfoSec Positions • CISO • Top InfoSec officer • Must be conversant in all areas (technology, planning, and policy)‏ • Responsible for the overall InfoSec program • Security Manager • Responsible for policy development, risk assessment, contingency planning, and operational and tatical planning • Understanding of technology administered but not necessarily proficiency in its configuration or operation • Security Technician • Technically qualified individuals who configure and maintain security technology • Are likely to be IT technicians who have adopted a different career path 9 EECS 711 Spring 2008 Chapter 10

  10. Other Position Titles • Many noninformation security job descriptions must define information security roles and responsibilities • Community of interest with security roles and responsibilites • Information Security Community • IT Community • General Business Community • Building and Facilities Guard • Office Maintenance Worker • Human Resources Dept manager • CFO • CEO 10 EECS 711 Spring 2008 Chapter 10

  11. Social Engineering • An attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems • Top 4 hacking moments on film • Independence Day: Using an old space ship as cover for two humans to infiltrate the alien mother ship and upload a virus to destroy it. • Hackers: Dumpster diving in the target company's trash in order to obtain financial data from printouts. • War Games: Password cracking the military computer system by studying its creator. • Ferris Bueller's Day Off: Faking a grandmother's death to get Ferris's girlfriend excused from school through multiple phone calls and answering machine recordings. • Sneakers: Intercepting the call from the security guard to bypass the alarm and rob the bank. <Sneakers> Question: Which of the above hacks did not employ a social engineering technique? 11 EECS 711 Spring 2008 Chapter 10

  12. Social Engineering • SE Attack Detection • Employees need to be trained to detect anomalies in conversation, e-mail, and pop-up windows • SE Attack Prevention • Preparation (SETA)‏ • Table 10-3 • SE Attack Defense • Organizations should have an established procedure for reporting suspected SE attacks • IR team should log attacks and treat them no differently than other attacks 12 EECS 711 Spring 2008 Chapter 10

  13. Information Security Professional Credentials Professional certifications ascertain the level of proficiency possessed by different candidates. Employers struggle to match certifications to position requirements. Potential infosec workers try to determine which certificates will help them in the job market EECS 711 Spring 2008 Chapter 10

  14. Information Security Professional Credentials The widely recognized certification programs are: Certified Information Systems Security Professional (CISSP) Systems Security Certified Practitioner (SSCP) Certified Information Systems Auditor (CISA) Certified Information Security Manager (CISM) Global Information Assurance Certification (GIAC) Security Certified Program (SCP) Security+ Certified Computer Examiner (CCE) Certified Forensics Investigator (CIFI) EECS 711 Spring 2008 Chapter 10

  15. Certified Information Systems Security Professional (CISSP) Considered the most prestigious certification for Security Managers and CISO’s. Offered by the International Information Systems Security Certification Consortium (ISC)2. Recognizes mastery of an internationally identified common body of knowledge (CBK) in information security. Candidates must have at least 3 years of direct, full-time security professional work experience. The test covers 10 domains of information security and consists of 250 multiple choice questions to be completed in 6 hours. EECS 711 Spring 2008 Chapter 10

  16. Certified Information Systems Security Professional (CISSP) • The 10 domains of information security knowledge are: • Access control systems and methodology • Applications and systems development • Business continuity planning • Cryptography • Law, investigation and ethics • Operations security • Physical security • Security architecture and models • Security management practices • Telecommunications, network and Internet security EECS 711 Spring 2008 Chapter 10

  17. Certified Information Systems Security Professional (CISSP) CISSP certification requires the successful completion of the exam and an endorsement by a qualified 3rd party to ensure that the applicant meets the experience requirement. It is the most challenging of information security certifications. Holders of the CISSP must earn a specific number of continuing education credits every 3 years to retain their certification. EECS 711 Spring 2008 Chapter 10

  18. Systems Security Certified Practitioner (SSCP) Also offered by the (ISC)2. Less rigorous than the CISSP. More applicable to security managers than the technicians. Most of the questions focus on the operational nature of information security. Focuses on practices, roles and responsibilities as defined by experts from major IS industries. The SSCP exam consists of 125 multiple-choice questions covering 7 domains on information security to be completed in 3 hours. Spring 2008 EECS 711: Security Management and Audit EECS 711 Spring 2008 Chapter 10 18

  19. Systems Security Certified Practitioner (SSCP) • The 7 domains are: • Access controls • Administration • Audit and monitoring • Risk, response and recovery • Cryptography • Data communications • Malicious code/malware EECS 711 Spring 2008 Chapter 10

  20. Systems Security Certified Practitioner (SSCP) Like the CISSP, a SCCP holder must earn continuing credits to retain certification, or else retake the exam. Slightly more technical than the CISSP. EECS 711 Spring 2008 Chapter 10

  21. CISSP Concentrations ISSAP: Information Systems Security Architecture Professional ISSEP: Information Systems Security Engineering Professional ISSMP: Information Systems Security Management Professional EECS 711 Spring 2008 Chapter 10

  22. Certified Information Systems Auditor (CISA) Not specifically a security certification but includes many information security components. Sponsored by the Information Systems Audit and Control Association (ISACA). Certification appropriate for auditing, networking and security professionals. Requires experience as an information systems auditor, with a minimum of 5 years professional experience. Requires agreement to the Code of Professional Ethics. Requires a minimum of 20 hours of continuing education annually and 120 hours during a fixed 3 year period. Adherence to the Information Systems Auditing Standards. EECS 711 Spring 2008 Chapter 10

  23. Certified Information Systems Auditor (CISA) • The exam covers the following areas: • IS audit process (10%) • IT governance (15%) • Systems and infrastructure lifecycle management (16%) • IT service delivery and support (14%) • Protection of information assets (31%) • Business continuity and disaster recovery (14 %) EECS 711 Spring 2008 Chapter 10

  24. Certified Information Security Manager (CISM) Also offered by the ISACA. Geared towards the experienced information security manager and other with information security management responsibilities. This certification assures executive management that the candidate has the required background knowledge needed for effective security management and consulting. The exam is offered annually. Requires the applicant to adhere to ISACA code of ethics. Requires pursuing continuing education. Applicants must have at least 5 years of information security experience with at least 3 years in information security management. EECS 711 Spring 2008 Chapter 10

  25. Certified Information Security Manager (CISM) • The CISM exam covers: • Information security governance (21%) • Risk management (21%) • Information security program management (24%) • Response management (13%) EECS 711 Spring 2008 Chapter 10

  26. Global Information Assurance Certification (GIAC) Developed by Systems Administration, Networking and Security (SANS) organization. Tests both for knowledge and applicants ability to demonstrate application of that knowledge. Offers the only advanced technical certifications. The GIAC family of certifications can be pursued independently or combined to earn a comprehensive certification called GIAC Security Engineer (GSE). Only when practical assignment is complete is the candidate allowed to take the online exam. GIAC now offers two types of certifications: Silver and Gold. EECS 711 Spring 2008 Chapter 10

  27. Global Information Assurance Certification (GIAC) • Requirements for Silver certification: • Completion of exams • Full certifications require 2 exams; certificates require a single exam • Requirements for Gold certification: • Complete Silver certification • Passing a technical paper review, the paper demonstrates real world, hands on mastery of security skills EECS 711 Spring 2008 Chapter 10

  28. Global Information Assurance Certification (GIAC) • The individual GIAC certifications are as follows: • GIAC Information Security Fundamentals (GISF) • GIAC Security Essentials Certification (GSEC) • GIAC Certified Firewall Analyst (GCFW) • GIAC Certified Intrusion Analyst (GCIA) • GIAC Certified Incident Handler (GCIH) • GIAC Certified Windows Security Administrator (GCWN) • GIAC Certified UNIX Security Administrator (GCUX) • GIAC Certified Forensics Analyst (GCFW) • GIAC Securing Oracle Certification (GSOC) • GIAC Intrusion Prevention (GIPS) • GIAC Cutting Edge Hacking Techniques (GHTQ) EECS 711 Spring 2008 Chapter 10 EECS 711 Spring 2008 Chapter 10 28

  29. Security Certified Program (SCP) • SCP offers two tracks: Security Certified Network Professional (SCNP) and the Security Certified Network Architect (SCNA). • Both designed for the security technician. • While not as detailed as the GIAC certifications, these programs provide the knowledge needed to work in new areas of security, while developing a vendor neutral core of practitioner knowledge evaluation. • The SCNP track targets firewalls & intrusion detection, and requires 2 exams: • Hardening The Infrastructure (HTI) • Network Defense & Countermeasures (NDC) • The SCNA program includes the following: • Enterprise Security Implementation (ESI) which covers: • Advanced Security Implementation (ASI) • Enterprise Security Solutions (ESS) • The Solution Exam (TSE) covering all facets of the SCP courses EECS 711 Spring 2008 Chapter 10

  30. Security+ • Offered by CompTIA a vendor neutral certification program. • Tests for security knowledge mastery of an individual with 2 years on the job networking experience. • CompTIA Security+ curricula is being taught at colleges, universities and commercial training centers. • Exam covers industry-wide topics including: • General Security Concepts • Communication Security • Infrastructure Security • Basics of Cryptography • Operational/Organizational Security EECS 711 Spring 2008 Chapter 10

  31. Certified Computer Examiner (CCE) • Is a computer forensics certification provided by the International Society of Forensic Computer Examiners • To complete the certification the applicant must: • Have no criminal record • Meet minimum experience, training or self-training requirements • Abide by certification’s code of ethical standards • Pass an online exam • Successfully perform actual forensic exams on 3 test media EECS 711 Spring 2008 Chapter 10

  32. Certified Computer Examiner (CCE) • The CCE certification process covers the following areas: • Acquisition, marking, handling, and storage of evidence procedures • Chain of custody • Essential “core” forensic computer examination procedures • The “rules of evidence” as they relate to computer examinations • Basic PC hardware construction and theory • Very basic networking theory • Basic data recovery techniques • Authenticating MS word documents and accessing and interpreting metadata • Basic optical recording processes and accessing data on optical media • Basic password recovery techniques • Basic internet issues EECS 711 Spring 2008 Chapter 10

  33. Certified Information Forensics Investigator (CIFI) The Information Security Forensics Association (ISFA) is developing an examination for a Certified Information Forensics Investigator (CIFI). This program will evaluate expertise in tasks and responsibilities of a security administrator or security manager, including incident response, working with law enforcement, and auditing. EECS 711 Spring 2008 Chapter 10

  34. Certified Information Forensics Investigator (CIFI) • Although the certification exam has not been finalized, the body of knowledge has been tentatively defined to include the following aspects of information security: • Countermeasures • Auditing • Incident response teams • Law enforcement and investigation • Traceback • Tools and techniques EECS 711 Spring 2008 Chapter 10

  35. Certification Costs Certifications can be expensive. The high costs deter those who might take the exam just to see if they can pass. Most experienced professionals find it difficult to do well on them without at least some review. Most programs require between 2 & 3 years of work experience. Often structured to reward candidates who have significant hands-on experience. EECS 711 Spring 2008 Chapter 10

  36. Approaches to prepare for security certification EECS 711 Spring 2008 Chapter 10

  37. Employment Policies and Practices EECS 711 Spring 2008 Chapter 10

  38. Employment Policies and Practices • Hiring and Firing • Contracts • Personnel Security Practices • Security Considerations for Nonemployees EECS 711 Spring 2008 Chapter 10

  39. Hiring • Job Descriptions • Interviews • New Hire Orientation • On-the-Job Security Training • Security Checks EECS 711 Spring 2008 Chapter 10

  40. Security Checks • Identity checks • Education and credentials • Previous employment • Reference checks EECS 711 Spring 2008 Chapter 10

  41. Security Checks • Worker’s compensation history • Motor vehicle records Drug history • Medical • Credit • Civil Court • Criminal Court Make sure to comply with regulations EECS 711 Spring 2008 Chapter 10

  42. Contracts and Employment • Require employees to agree in writing by signing monitoring and nondisclosure agreements • Sign before other employment contracts are made • Existing employees may not be compelled to sign EECS 711 Spring 2008 Chapter 10

  43. Security as Part of Performance Evaluations • How can performance evaluations be used to motivate employees concerning security practices? EECS 711 Spring 2008 Chapter 10

  44. Termination Issues Need to protect information to which an employee had access • Disable system access • Retrieve removable media • Secure hard drives (network drives?) • Change locks: file cabinets, offices, etc. • Revoke keycard access • Remove personal items • Finally, escort from premises EECS 711 Spring 2008 Chapter 10

  45. Termination Issues • Conducting Exit Interviews • Remind of contractual obligations • Discuss consequences if failure to comply with contractual obligations • Gather feedback from employee • Termination brings a level of risk exposure to the organization, regardless of level of trust in employee EECS 711 Spring 2008 Chapter 10

  46. Immediate Severance • Forgo the customary two-week notice • Sensitive areas or positions of trust may require this • Do you have any experience with this? EECS 711 Spring 2008 Chapter 10

  47. Outprocessing Hostile or friendly departure? • Hostile – termination, downsizing, lay-off, quitting • Revoke system access first, then notify employee • Collect sensitive items • Escort from facility EECS 711 Spring 2008 Chapter 10

  48. Outprocessing Hostile or friendly departure? • Friendly – retirement, promotion, relocation • May be a bit tricky to manage • Set expirations dates for system access or phase out access • Collect company assets • Employees typically have more latitude in removing personal items EECS 711 Spring 2008 Chapter 10

  49. Outprocessing Hostile or friendly departure? • For both scenarios complete the following: • Inventory offices and info • Archive, return to stores or destroy • Review logs for possible system misuse (and follow-up as an incident if warranted) • What do you do about materials at the employees home? EECS 711 Spring 2008 Chapter 10

  50. Personnel Security Practices Monitor and control employees to minimize opportunities for misuse of info • Separation of duties • Checks and balances mitigates collusion • Two-person control • Job and task rotation • Mandatory vacations • Least privilege EECS 711 Spring 2008 Chapter 10

More Related