INFORMATION SECURITY MANAGEMENT

1. INFORMATION SECURITY MANAGEMENT Lecture 6: Security Management Models You got to be careful if you don’t know where you’re going, because you might not get there. – Yogi Berra

2. Access Control Models • Access controls • Regulate the admission of users into trusted areas of the organization • Key principles of access control • Least privilege • Need to Know • Separation of Duties

3. How to measure the value of information - CIA Triangle The value of information comes from the characteristics it possesses Expanded to include Identification Authentication Authorization Privacy Accountability

4. Privacy Information collected, used, and stored by an organization is to be used only for the purposes stated to the data owner at the time it was collected Privacy as a characteristic of information does not signify freedom from observation • Means that information will be used only in ways known to the person providing it

5. Accountability Exists when a control provides assurance that every activity undertaken can be attributed to a named person or automated process

6. Identification and Authentication Identification • An information system possesses the characteristic of identification when it is able to recognize individual users • Identification and authentication are essential to establishing the level of access or authorization that an individual is granted Authentication • Occurs when a control proves that a user possesses the identity that he or she claims

7. Authorization Assures that the user has been specifically and explicitly authorized by the proper authority to access, update, or delete the contents of an information asset Authorization occurs after authentication

8. Controlling Access

9. Identification and Authentication • Identification: unproven assertion of identity • “My name is…” • Userid • Authentication: proven assertion of identity • Userid and password • Userid and PIN • Biometric

10. Authentication Methods • What the user knows • What the user has • What the user is

11. How Information Systems Authenticate Users • Request userid and password • Hash password • Retrieve stored userid and hashed password • Compare • Make a function call to a network based authentication service

12. How a System Stores Userids and Passwords • Typically stored in a database table • Application database or authentication database • Userid stored in plaintext • Password stored encrypted or hashed

13. Password Hashes • LM hash is weak, no longer used in Win 7 • NT hash is stronger, but not salted http://www.emc.com/collateral/software/white-papers/h11013-rsa-dcp-0812-wp.pdf

14. Strong Authentication • Traditional userid + password authentication has known weaknesses • Stronger types of authentication available, usually referred to as “strong authentication”

15. Token: Two Factor Authentication • First factor: what user knows • Second factor: what user has Without the second factor, user cannot log in

16. Token: Two Factor Authentication

17. Biometric Authentication • Stronger than userid + password • Stronger than two-factor? • Can be hacked

18. Authentication Issues • Password quality • Consistency of user credentials across multiple environments • Too many userids and passwords • Handling password resets • Dealing with compromised passwords • Staff terminations

19. Categories of Access Control

20. Categories of Access Control • Preventative • Deterrent • Detective • Corrective • Recovery • Compensating

21. Preventive Controls • Block or control specific events • Firewalls • Anti-virus software • Encryption • Key card systems • Bollards stop cars (as shown)

22. Deterrent/Detective Controls • Deterrent Controls • Highly visible • Prevent offenses by influencing choices of would-be intruders • Detective Controls • Monitor and record specific types of events • Does not stop or directly influence events

23. Corrective/Recovery Controls • Corrective Controls • Post-event controls to prevent recurrence • “Corrective” refers to when it is implemented • Examples (if implemented after an incident) • Spam filter • Anti-virus on e-mail server • WPA Wi-Fi encryption • Recovery Control • Post-incident controls to recover systems

24. Compensating Controls • Control that is introduced that compensates for the absence or failure of a control • “Compensating” refers to why it is implemented • Examples • Daily monitoring of anti-virus console • Monthly review of administrative logins • Web Application Firewall used to protect buggy application

25. Another Approach:Types of Controls • Technical • Operational (aka Physical) • Management (aka Administrative)

26. Another Approach:Degree of Authority • Mandatory Access Controls • Discretionary Access Controls • Role Based Access Controls

27. Mandatory Access Control (MAC) Security Model • Data classification scheme • Rates collection of info and user with sensitivity levels • When implemented, users and data owners have limited control over access

28. Mandatory Access Control (MAC) Security Model • Data classification scheme/model • Data owners classify the information assets • Reviews periodically • Security clearance structure • Each user assigned an authorization level • Roles and corresponding security clearances

29. Discretionary Access Control (DAC) Security Model • The owner of an object controls who and what may access it. • Access is at the owner’s discretion. • Most personal computer operating systems are designed based on the DAC model

30. Role-based Access Control (RBAC) Security Model • Nondiscretionary Controls • An improvement over the mandatory access control (MAC) security model • Role-based controls • Task-based controls • Simplifies management in a complex system with many users and objects

31. Access Control Technologies

32. Testing Access Controls

33. Testing Access Controls • Access controls are the primary defense that protect assets • Types of tests: • Penetration tests • Application vulnerability tests • Code reviews http://secunia.com/community/

34. Penetration Testing • Automatic scans to discover vulnerabilities • Example tools: Nessus, Nikto, SAINT, Superscan, Retina, ISS, Microsoft Baseline Security Analyzer

35. Application Vulnerability Testing • Discover vulnerabilities in an application • Automated tools and manual tools • Example vulnerabilities • Cross-site scripting, injection flaws, malicious file execution, broken authentication, broken session management, information leakage, insecure use of encryption, and many more

36. Audit Log Analysis • Regular examination of audit and event logs • Detect unwanted events • Audit log protection

37. Access Control Attacks

38. Access Control Attacks • Intruders will try to defeat, bypass, or trick access controls in order to reach their target • Attack objectives • Guess credentials • Malfunction of access controls • Bypass access controls • Replay known good logins • Trick people into giving up credentials

39. Buffer Overflow • Cause malfunction in a way that permits illicit access • Send more data than application was designed to handle properly • Countermeasure: “safe” coding that limits length of input data; filter input data to remove unsafe characters

40. Script Injection • Insertion of scripting language characters into application input fields • Execute script on server side • Execute script on client side – trick user or browser • Countermeasures: strip “unsafe” characters from input

41. Data Remanence • Literally: data that remains after it has been “deleted” • Examples • Deleted hard drive files • Erased files • Discarded / lost media: USB keys, backup tapes, CDs • Countermeasures: improve media physical controls (e.g. post Wikileaks controls)

42. Denial of Service (DoS) • Actions that cause target system to fail, thereby denying service to legitimate users • Distributed Denial of Service (DDoS) • Countermeasures: input filters, patches, high capacity

43. Eavesdropping • Interception of data transmissions • Methods • Countermeasures: encryption, stronger encryption

44. Spoofing and Masquerading • Specially crafted network packets that contain forged address of origin • Countermeasures: router / firewall configuration to drop forged packets, judicious use of e-mail for signaling or data transfer http://www.techrepublic.com/blog/security/how-to-spoof-a-mac-address/395

45. Social Engineering • Tricking people into giving out sensitive information by making them think they are helping someone • Methods • Schemes • Countermeasures: security awareness training

46. Phishing • Incoming, fraudulent e-mail messages designed to give the appearance of origin from a legitimate institution • Tricks user into providing sensitive data via a forged web site (common) or return e-mail (less common) • Countermeasure: security awareness training

47. Pharming • Redirection of traffic to a forged website • Countermeasures: user awareness training, patches, better controls

48. Malicious Code • Viruses, worms, Trojan horses, spyware, key logger • Harvest data or cause system malfunction • Countermeasures: anti-virus, anti-spyware, security awareness training

49. Security Architecture Models

50. Security Architecture Models • Can help organizations quickly make improvements through adaptation • Can focus on: • computer hardware and software • policies and practices • the confidentiality of information • the integrity of the information Pick one and go with it