330 likes | 508 Views
Security and Systems. Three tenets of security. Confidentiality Integrity Availability. e-Security –the problem is real. 90% of companies surveyed by the FBI have detected cyber attacks recently
E N D
Three tenets of security • Confidentiality • Integrity • Availability
e-Security –the problem is real • 90% of companies surveyed by the FBI have detected cyber attacks recently • Disgruntled employees, industrial espionage, and data theft are responsible for 70-80% of security breaches • Increase in external threats from hackers, ex-employees, competitors and cyber terrorists • The rise of “Script Kiddies” - Hackers who do not target specific organizations, but run scripts scanning the net for ANY vulnerable network
Security Myths • Nobody would want our data. • Who knows us? We are anonymous • There is no danger to my network at all. • I am not on the Internet, I am safe. • I don’t need any security devices. I have a Firewall • I have an antivirus on my server. I am safe • All our employees are very committed & reliable!
Know your IT law • Cyber crimes • Hacking , damage to computer source code, publishing lascivious information in an electronic form, breach of privacy / confidentiality, publishing digital signature, etc. • Interception by Government • intercept any information transmitted through any computer resource if the same is necessary in the interest of the sovereignty or integrity of India, • Digital Signatures legally valid and enforceable.
Know your IT law • Authentication of electronic records in India shall be effected by the use of asymmetric crypto system and hash function • If someone uses your network to attack an external network and the attacked complains, you are liable to be penalized • Companies must have a detailed I T Security Policy in tune with the mandatory specific provisions of the IT Act and IT Rules.
Protectable Data assets • Business Information – contracts, SLAs, financial data, customer details, etc • Intellectual property – source codes, inventions, research papers, etc • National secrets • E-commerce
Threats to data • Accessed by External hackers • Divulged by ignorant employees • Corrupted by virus attacks • Hardware failures • Inadequate access controls • Badly designed applications • Clear transmission over public internet • Last but not the least system administrators !!
Types of External Attacks • Malicious code attacks • Corporate espionage • Web graffiti • Denial-of-service • Database hacks • Installing Back doors • Identity Theft
Typical Network Attack attack other hosts gain user access take or alter Information locate system to attack Cover tracks Install backdoors gain privilege access engage in other unauthorized activity
Methods adopted in attacks • Pinging • Sniffing • Probing • Flooding • Hacking • Cracking • Scripting • Buffer Overflow • Reverse engineering
Gain user access • Identity theft • Masquerading • Eavesdropping • Spoofing • Piggy backing • Social Engineering
Alter or steal information • Sniffing • Man-in-the middle attacks • Cookies • Sabotage by employees
Common Reasons • Flawed design or implementation of network infrastructure • Rapidly changing technologies • Lack of management understanding • New & mutating attacks • Inherent product weaknesses
Internal Threats • Unrestricted access to internal systems • Bad security practices • Ignorant users • Lack of management understanding • New & mutating attacks • Inherent product weaknesses
Data Lifecycle • Creation • Storage • Movement • Destruction
Key security elements • Security Policy • Identity management • Robust Perimeter Security • Storage Security • Secure Transmission of data • Good Security Practices
Identity • Accurate and positive identification of network users, hosts, applications, services, and resources. • Standard technologies • Kerberos • one-time password • Technologies used • digital certificates • smart cards • directory services (e.g. LDAP, ADS)
Perimeter Security • Deals with controlling data that is passed between LAN and public internet • Perimeter is controlled by • Routers and switches • Firewalls • IDS / IPS • Antivirus • URL Filters • Network Traffic Analyzers
Secure transmission • The ability to provide authenticated, confidential communication between systems • Data privacy is achieved by • Layer 2 Tunneling Protocol (L2TP) • IPsec • Data Encryption • PGP
Security Standards / Laws • BS7799 / IS17799 • Data Protection Act • HIPAA • SOX • IT Act (Indian cyberlaws)
BS 15000 ISO 9001 (QMS) Standard Process Approach [P-D-C-A] BS 7799 BS7799, ISO 9000 & BS 15000 • BS 7799-certified companies are automatically Compliant with security section of BS 15000 • BS 15000 & BS 7799 adopt the P-D-C-A Process Approach of ISO 9001: 2000 QMS Standard
Policy Management • Defining a clear security objective • Articulating clear policy • Implemented by suitable procedures • Audited regularly to ensure compliance • Training users • Improvising the procedures
Testing methods • Vulnerability assessment • Penetration testing • Detection measures • Response measures
Best Practices • Understanding of the business needs • A security mission statement • Identification & Risk Analysis on Data • A strong commitment from upper management to allocate necessary resources • Clearly defined implemented and documented security policies and procedures
Best Practices • A suite of host and network based security auditing and improvement tools • A security awareness program that reaches everyone in the organization • A dedicated team of trained security professionals and consultants to make it all happen
To conclude • No technology used to protect your organization is 100% hackerproof • Good policies drive good implementation • Best policies without necessary awareness among personnel is in vain • Security is not a one-size-fits-all solution. • Security of organization assets is everyone’s responsibility.
Prudenté Solution Pvt LtdPhone: 080 - 30667171email: srimathi@prudente.co.in