Need of Enterprise-Wide Information Assurance Planning

1. Need of Enterprise-Wide Information Assurance Planning COEN 250 Fall 2007 T. Schwarz, S.J.

2. First Perspective:Reactive / Intruder Based • Long term attack trends: • Amount of time for new attacks to emerge is declining • Melissa (1999) took days to spread • Love letter (2000), Code Red (2001), Nimda (2001), hours • Slammer (2003), Blaster (2003), minutes

3. First Perspective:Reactive / Intruder Based CERT Cataloged Vulnerabilities

4. First Perspective:Reactive / Intruder Based

5. First Perspective:Reactive / Intruder Based • Long term attack trends: • Increase in the number of detected vulnerabilities • Increased sophistication of attackers

6. First Perspective:Reactive / Intruder Based • Reactive Security • Patch systems after vulnerability arises • Only feasible if • attacks would be rare • ample warning be given • patches can be simply installed

7. Second Perspective:Holistic Security • Security is hard to measure • Absence of incidents can be • result of good security • inability to see incidents • No accepted metrics for characterizing security

8. Second Perspective:Holistic Security • Security is expensive • Added costs • Diminished performance • Inconvenience • Benefits of security are cost avoidance • Question: Was Y2K just hype or did the effort pay off?

9. Second Perspective:Holistic Security • Security Incidents are not the main cause of system unavailability • “Who Needs Hackers?” NY Times 9/12/07 • Complex systems break causing spectacular failures • Customs computer failure LAX, August 2007 • Skype restart login deluge on MS patch day August 16, 2007 • IDC 2001Downtime Analysis • Malicious Events 3% • Environmental Issues 19% • Operator and application errors 78%

10. Second Perspective:Holistic Security • Organizations need • framework, model, yardstick, roadmap … • to place and measure themselves (current state) • compare with others (future state) • to decide their desired security state or condition • improvement approaches and a path to reach their desired state • coherent, organized community of practitioners and artifacts to help guide their work

11. Second Perspective:Holistic Security • Current / pending legislation affecting organizatorial infrastructure management and protection of information • Family Educational Rights Privacy Amendment • Federal Information Systems Management Act • Health Insurance Portability and Accountability Act • Gramm-Leach-Bliley Act (financial institutions) • Sarbanes Oxley (publicly traded institutions) • Child Online Privacy Protection Act • Basel II Capital Accord (financial institutions) • California’s Database Security Breach Notification Act

12. Second Perspective:Holistic Security Desired State Security • Vulnerability Management • Reactive • Tool driven • Focused on Technology • Localized decision making, unconnected to business drivers • Vulnerabilities change daily • Risk Management • A link to business drivers • Focus on critical assets and threats to assets • Risk identification and prioritization based on threats to assets, vulnerabilities, and impacts • Enterprise Security Management • Select, execute, improve activities to reliably achieve and sustain a desired security state • NOT focused on symptoms instead of root causes • encompasses all organizational practices relevant to security Vul Man Risk Man ESM Time / Complexity

13. Second Perspective:Holistic Security • www.cert.org/octave • Operationally Critical Threat, Asset, and Vulnerability Evaluation • focuses on organizational risks and strategy • Federal Agencies

14. Information Security Governance • Federal Information Security Practices are governed by laws, regulations, and directives • U.S. Congress • Office of Management and Budget (OMB) • Standards and Implementation Guidelines through • National Institute of Standards and Technology • Government Accountability Office (GAO)

15. Information Security Governance • Federal Agency Governance Requirements • Government Performance and Results Act (GPRA), 1993 • Paperwork Reduction Act (PRA) of 1995 • Federal Financial Management Improvement Act (FFMIA) of 1996 • Federal Managers Financial Integrity Act (FMFIA) of 1982 • Clinger-Cohen Act of 1996 • Disciplined capital planning and investment control to acquire, use, maintain, and dispose of IT resources • Establishes role of Chief Information Officer (CIO) • E-Government Act of 2002 • Federal Information Security Management (FISMA) Act • OMB Circular A-130, Management of Federal Information Resources, Appendix III, Security of Federal Automated Information Resources • Homeland Security Presidential Directive 12 (HSPD-12)

16. Information Security Governance Key Legislative, Regulatory, and Oversight Roles

17. Information Security Governance Components • Agencies need to integrate INFOSEC with overall agency structure and activities • Strategic planning • organization design and development • establishment of roles and responsibilities • integration with enterprise architecture • documentation of security objectives in policies and guidance

18. Information Security Governance Components

19. INFO SEC Strategic Planning • GPRA (Government Performance and Results Act) requires federal agencies to • strategic plan for program activities • prepare an annual performance plan covering each program activity set forth in the budget of such agency • INFO SEC strategy should be integrated and provide • Clear and comprehensive mission, vision, goals, and objectives and how they relate to agency mission; • High-level plan for achieving information security goals and objectives • short- and mid-term objectives and performance targets • specific for each goal and objective • used throughout the life of this plan to manage progress toward successfully fulfilling the identified objectives; and • Performance measures to continuously monitor accomplishment of identified goals and objectives and their progress toward stated targets.

20. Information Security Governance Structures • Centralized • Decentralized

21. Security Activities within the Systems Design Life Cycle • Initiation Phase • Needs Determination • Security Categorization • NIST SP 800-60, FIPS 199 • Initial description of basic security needs of the system • Threat environment determination

22. Security Activities within the Systems Design Life Cycle • Development / Acquisition Phase • In-depth study of need • Develop / incorporate security requirements into specifications • Analyze functional requirements including security functional requirements • Conduct formal risk assessment

23. Security Activities within the Systems Design Life Cycle • Development / Acquisition Phase • Determine costs of information security over life cycle of the system • Security Planning • Document agreed-upon security controls • Develop system security plan • Develop necessary documentation • Develop awareness and training requirements • Security Control Development • Security Tests and Evaluation

24. Security Activities within the Systems Design Life Cycle • Implementation Phase • Security Test and Evaluation • Develop test data • Test unit, subsystem, and entire system • Ensure system undergoes technical evaluation • Inspection and Acceptance • System Integration / Installation • Security Certification

25. Security Activities within the Systems Design Life Cycle • System Implementation • Security Accreditation • Authorization granted by senior organization official • Based on verified effectiveness of security control

26. Security Activities within the Systems Design Life Cycle • Operations / Maintenance Phase • Configuration Management and Control • Adequate consideration of potential security impacts due to changes to system or environment • Develop Configuration Management Plan • Establish baselines • Identify configuration • Describe configuration control process • Identify schedule for configuration audits

27. Security Activities within the Systems Design Life Cycle • Continuous Monitoring • Monitor security controls • Perform security audits or other assessments • automated tools • internal control audits • security checklists • penetration testing • Monitor system and/or users • review system logs • review change management • monitor external sources • perform periodic reaccreditation

28. Security Activities within the Systems Design Life Cycle • Disposal Phase • Information Preservation • Determine archive, discard, or destroy information • Based on legal requirements / federal records requ. • Beware of obsolete technology • Ensure long-term storage of cryptographic keys for encrypted data • Media Sanitization • Hardware and Software Disposal