Operational/Organizational Security

1. Operational/Organizational Security Chapter 3

2. Chapter Objectives • Security Framework • Operational Security Lifecycle • Security Perimeter • Access Control • Social Engineering • Environmental Issues

3. Operational Security • Protection = Prevention + (Detection + Response). • Prevention techniques are static barriers to the intruders. • Detection and Response technologies are dynamic and an ongoing process.

4. Operational Security • Systems, technologies and network constantly change with time, thus we have to monitor the systems regularly. • Monitoring the security infrastructure in the organization is an essential part of any organization’s security program.

5. Security Framework • An organization’s security framework is very important in implementing the security. • Security framework includes • Policies • Procedures • Standards • Guidelines

6. Policies • Policies are high-level, broad statements of what the organization wants to accomplish. • Policies are formulated by management when laying out organization's position on some issue.

7. Standards • Standards are mandatory elements regarding the implementation of a policy. • They are accepted specifications providing specific details on how a policy is to be enforced. • Standards can be set by the organization or by an external agency.

8. Guidelines • Guidelines are recommendations relating to a policy. • Guidelines are optional.

9. Procedures • Procedures are the steps-by-step instructions on how to implement policies in the organization. • Procedures describe exactly how employees are expected to act in a given situation.

10. Operational Security Lifecycle • The policies, procedures, standards and guidelines are dynamic. • They must be revises periodically. • The operational security lifecycle has 4 phases • Plan (adjust) • Implement • Monitor • Evaluate

11. Operational Security Lifecycle • Planning - In this stage, all the policies, procedures, standards and guidelines for your organization’s security are developed and designed. • Implement - In this stage you implement and enforce the policies, procedures, standards and guidelines. All the employees affected by these new policies, procedures, standards and guidelines will come to know about these changes.

12. Operational Security Lifecycle • Monitoring - In this stage, all the policies, procedures, standards, guidelines, hardware and software are monitored to check the effectiveness of organization’s security. • Evaluate – In this stage, all the policies, procedures, standards and guidelines are again re-evaluated to ensure that the security is adequate.

13. Operational Security Lifecycle

14. The Security Perimeter • The basic idea of a security perimeter is to provide a “complete” security to the corporate network. • Access by external entities to the corporate network (Internal) is controlled and monitored via the security perimeter.

15. The Security Perimeter Internet Telephone Company

16. Access Control • The purpose of access controls is to restrict access to only those who are authorized to have it. • Common forms of physical access controls are the use of security guard and the lock (including many new variations of the combination locks)

17. Physical Security • Physical security consist of all the mechanisms used to ensure that physical access to the computers and the networks is restricted to only authorized users. • Physical security adds an extra layer of security and protects the sensitive data.

18. Physical Barriers • Physical barriers provide the outmost security. • These barriers are highly visible to the public.

19. Physical Barriers

20. Biometrics • Biometrics is a more sophisticated access control approach. • Examples – fingerprint readers, retinal & iris scan, voice samples. • Biometric solutions are very expensive to implement.

21. Biometrics

22. Social Engineering • Social engineering is the process of convincing an authorized individual to provide confidential information or access to an unauthorized individual. • Social engineering exploits the weakest point in the security perimeter – humans. • The ultimate goal of social engineering is to gradually obtain the pieces of information.

23. Social Engineering • The best way to stop social engineering is through training all the employees and instructing not to give out any piece of information. • Data Aggregation - Small and seemingly “unimportant” information may be combined with other pieces of information to potentially divulge sensitive information.

24. Social Engineering

25. Environment • Environmental issues deals with the general operating conditions, within which an organization operates. • Environmental issues include items like heating, ventilation, air conditioning, electrical power and the “natural forces”. • Environmental factors are used to maintain the comfort of an office environment.

26. Environment • In case of electric power outage, UPS can be critical. • If natural disasters are common, having a complete backup plan is must. • In some cases, a separate off-site location can also me used.

27. Fire Suppression • Fire is one of the most common reasons for the loss of data in an organization. • Common ways of fighting the fire are: • Water bases fire suppression systems • Chemical based fire suppression systems • Handheld fire suppression systems • Fire detection systems

28. Water based Fire Suppression System • Very commonly used systems. • Can have adverse effects of computer and electrical systems.

29. Chemical based Fire Suppression Systems. • Clean Agent Fire Suppression Systems. • Uses CO2 • Safe for general usage • Halon Bases Fire Suppression System • Not used anymore • Very dangerous on human health

30. Handheld Fire Extinguisher

31. Fire Detection Devices • Fire detection devices are of several types • Smoke Activated • Temperature Activated • Flame Activated

32. Wireless • Wireless environment provides portability. • Wireless networks are prone to security threats, if not properly secured.