week 13 – advanced topics on security

Week13–AdvancedTopicsonSecurity

ITServiceDelivery

ITILProcess

26/11/2015 3

http://www.mitsm.de/itil-wiki/process-descriptions-english/main-page

SecurityOperations

OperationsSecurityOperationsSecurityisusedtoidentifythecontrolsoverhardware,media,andtheoperatorswithaccessprivilegestoanyoftheseresources.

Auditandmonitoringisthemechanisms,tools andfacilitiesthatpermitstheidentificationofsecurityeventsforreportingtoappropriateparties. (ISC2 StudyGuide)

ITDepartmentOrganization

Programmer

Analyst/Programmer

System Analyst

IT Development Manager

Systems Programmer

Technical Manager

Operator

Shift Supervisor Production Support

IT Operations Manager

Chief Information Officer

OrganizationofComputerOperations1. ITOperationsManagement

2. Input/outputcontrol

3. Dataentry

4. Computeroperations

5. Productioncontrolandscheduling

6. Librarymanagementandchangemanagement

1.ITOperationsManagementITOperationsManagementhastheoverallresponsibilityfordevelopingcomputeroperationsstandardsandprocedures forefficientandeffective operations

ITManagementisalsoresponsible forensuringthattherearesufficientITresources tomeetthecurrentandfuturebusinessneeds

1.ITOperationsManagementMeanstomanageandcontrolIToperations◦ Recruitsufficientcomputeroperators◦ Organizecommunicationbetweenshifts◦ Provideoperationsdocumentationtosupportcomputeroperations◦ Setupprocessingchecklistsandpriorities

1.ITOperationsManagement◦ Obtainandreview:◦ Hardwareandsoftwareproblemreport◦ Statisticsofscheduledandunscheduledsystemdowntime

◦ Re-runjobsandthereasons◦ CPUutilization◦ Computerstorageutilization◦ SLAachievement

2.Input/Output ControlDataInputControl◦ Receivesourcedocumentsforbatchdataentry◦ Authenticatethesourcedocuments◦ Usebatchandcontroltotalstoensureallsourcedocumentsareprocessed◦ Inputthedatainatimelymanner

2.Input/Output ControlDataOutputControl◦ Outputisproducedintheproperformatanddistributedtotheappropriateusersinasecuremanner

◦ Controlofproductionreportdistribution◦ Predefinedreportrecipients◦ Checkcompletenessbeforedistribution◦ Recipientcheckallreportsreceived

2.Input/Output Control◦ Restrictaccesstospooledreportstoprevent

◦ Compromiseconfidentiality◦ Unauthorizedreportdeletion

◦ Computergenerationofnegotiableinstruments◦ Sequencecontrol◦ Detectionofmissingofnegotiableinstruments

◦ Inventoryofsensitive andcriticalstationaries◦ Keepinasecurelocation◦ Properlyrecorded◦ Stocktakingonaregularbasis

3.DataEntryEnterdatabyusingdataentrydevicetocreatedatafileforsubsequentprocessing

Keyverificationisacommoncontroltechniqueforverifyingtheaccuracyofinputteddata

Sufficientaudittrailforcheckingwhenrequired

4.ComputerOperationsCarryoutad-hocandscheduledcomputerjobs

Guidedbyoperationprocedurestoensurecomputeroperationsarecarriedinaefficientandeffectivemanner

Exampleofoperationprocedures◦ Systemstartupandshutdownprocedures◦ Errorhandlingprocedures◦ Databackupandrestoreprocedures

4.ComputerOperationsOperationtasks◦ Restartandshutdowncomputers◦ Runningandmonitoringcomputerjobs◦ Reportprinting◦ Backup/restoreofsystemanddatafiles◦ Housekeeping◦ Controlaccesstothedataprocessingcentreandcomputingfacilities◦ Participateindisasterrecoverytesting

4.ComputerOperations◦ Maintainregistersandoperationalstatistics formeasuringSLAachievement◦ Reportequipmentfailuresandoperatingerrors◦ Ensureanadequatesupplyofcomputerconsumables

5.ProductionControlandSchedulingSchedulecomputerjobsprocessingsequence, forbothad-hocandroutinejobs

Definetheconditionsforstarting/re-startingajob

Definejobdependencies

Ensurealljobsarecompletelyprocessed

Manualprocessingofscheduled joborusingjobschedulingsoftware

5.ProductionControlandSchedulingManual◦ Relyonoperatortorunajob◦ Usejobprocessingchecklistforcontrollingjobprocessing◦ Manualjobmonitoringandlogging◦ Jobprocessingrecordsreviewbysupervisortoensurecomputerjobsareaccuratelyandcompletelyprocess

◦ Effectiveforsimplebatchjobs

5.ProductionControlandScheduling◦ Automatic(JobScheduling Software)◦ Automaticprocessingofbatchjobs◦ Setuponce◦ Controljobdependence◦ Errordetectionandlogging

6.LibraryManagementandChangeManagementManagecomputertapes/cartridgesmovement◦ Recordingofreceiving,lending,removingofcomputertapes/cartridges◦ Regularstocktakingtodetectmissingofcomputertapes/cartridges◦ Properaudittrailofcomputertapes/cartridgesmovement

6.LibraryManagementandChangeManagementManageproductionsoftwareinventory◦ Softwareversioncontrol◦ Jobcontrollanguageandprocessingparametercontrol◦ Computersourceandobjectcontrol(e.g.synchronization)◦ Loggingofaddition,deletion andupdatingofsoftwareinventory

OperationsAdministration

OperationsAdministration1. Backgroundchecking

2. Segregationofduties

3. JobRotation

4. Leastprivilege

5. Needtoknow

1.BackgroundCheckVerificationchecksbeforeemployinganoperationsstafffor◦ HKID◦ Availabilityofsatisfactorycharacterreferences◦ Checkingoftheapplicant’scurriculumvitae◦ Confirmationofclaimedacademicandprofessionalqualifications

2.SegregationofDutiesEnsurecriticalstagesofaprocessarenotunderthecontrolofasingleindividual

Errorsandirregularitiesperformedbyoneusercanbedetectedbyanotheruser

Potentialdamagecanbeminimized

2.SegregationofDutiesAppropriatesegregationofdutiesbetween◦ Users◦ ITdevelopers◦ Datacenterstaff

Achievedby◦ Policies◦ Procedures◦ Organizationstructure

Sothatnooneindividualcanperformunauthorizedactivities

2.SegregationofDutiesIncomputeroperations,thefollowingdutiescanbedefined◦ ProductionControl◦ DataEntry◦ Librarian◦ Operator◦ SystemProgrammer

2.SegregationofDutiesInsoftwareprogramming,thefollowingfunctiongroupscanbedefined◦ SystemAnalyst◦ Programmer◦ DatabaseAdministrator◦ SecurityOfficer◦ QualityAssurance

2.SegregationofDuties

System Analyst IT Developer Data Entry Computer Operator LibrarianSystem Analyst X XIT Developer X X XData Entry X XComputer Operator X X XLibrarian X X

X means imcompatible duties

3.JobRotationAdetectivecontrol

Requireoperationsstafftorotatetheirjobdutiesonaregularbasisforallowinganotherstafftodetectanomalies

Havinghumanresourcespolicytorequireoperationsstafftotakeannualleaveforatleast2consecutiveweeks

4.LeastPrivilegePreventivecontrol

Onlytheminimumaccessprivilegeisgrantedtoperformatask

Purposeofleastprivilegeistoensurethatataskcanonlybeperformedbyauthorizeduser

Forexample◦ “SuperUser”privilegeisnotgrantedtoOperationsstaff

5.NeedToKnowPreventivecontrol

Onlythoseuserswhoneedtoperformataskisprovidedwiththeinformationandknowledgeforprocessingthetask

Thiscanbeachievedbyrestrictinguserstoaccessoperationsmanual,systemdocuments,etc.

Reducetheriskofunauthorisedsystemaccess

OperationsControlsChangecontrols

Problemmanagement

Capacitymanagement

Documentcontrols

Mediahandling

Operationsacceptancetest

Audittrails

Viruscontrols

Physical(Environmental)Security

PhysicalSecurityPhysicalfacilityisthebuildingorvehiclehousingthesystemandnetworkcomponents

Thephysicalcharacteristicsofthesestructuresandvehiclesdeterminethelevelofphysicalthreatssuchasfireandunauthorisedaccess

Thefacility’sgeographiclocationdeterminethecharacteristicsofnaturalthreatssuchasearthquakes andflooding

PhysicalSecurity

26/11/2015 117

NaturalEnvironmental

Threats

Floods,fire,earthquake…

SupplySystemThreats

Poweroutages,communicationinterruptions,…

ManmadeThreats

Explosions,disgruntledemployees,fraud,…

PoliticallyMotivatedThreats

Strikes,riots,civildisobedience,…

PhysicalSecurityElementforPhysicalSecurityMeasures

Determent◦ Convincepeoplenottoattack

Detection◦ Alarms,guards,andothermeansofdetectingattacks

Delay◦ Elementsthatslowdownanattacker,e.g. locks&safes

Response◦ Guardsoracalltothepolice

PhysicalSecurity- ControlsAdministrativecontrols◦ facilityselection,facilityconstructionandmanagement,personnelcontrol,evacuationprocedure,systemshutdownprocedure, firesuppressionprocedure,handlingproceduresforotherexceptionssuchashardwarefailure,bombthreats,etc.

Physicalcontrols◦ facilityconstructionmaterial,keyandlock,accesscardandreader,fence,lighting,etc.

Technicalcontrols◦ physicalaccesscontrolandmonitoring system,intrusiondetectionandalarmsystem,firedetectionandsuppressionsystem,uninterruptedpowersupply,heating/ventilation/airconditioningsystem(HVAC),diskmirroring,databackup,etc.

SecurityConsiderations0fPhysicalSecurity◦ Whatarethesecurityconsiderationsinprotecting theequipmentwhentheygointothecloud?

◦ AccessControl◦ Whohaveaccesstotheserversandstoragedevices?

◦ AgainstHazards◦ Fireandsmokesensors◦ Fireextinguishers◦ Watersensorandraisedfloors◦ UPS

◦ AgainstAttacks◦ Fastrecoveryatabackupsite

◦ RetiringDevices◦ Defineretirementprocessoffailedorusedstoragedevices

SecurityConsiderations0fPhysicalSecurity - AccessControlAccessControlandAuditing◦ Lockandkey◦ Accesscardandreader◦ Fence◦ Lighting◦ DoorwayandMan-trap

AccessMonitoringandIntrusionDetection◦ Patrolforce/securityguard◦ Technicalaccessmonitoringcontrols◦ AlarmSystem

PhysicalAccessSecurityAccesscontrolfacility◦ Fence,GateandTurnstile◦ Mantrap◦ Lighting◦ CCTV◦ Guards

Fence,GateandTurnstileFenceandgate◦ Marktheboundaryofafacilityfordeterringunauthorizedaccess◦ Mustbetallenoughforstoppingadetermined intruder

Turnstileisarevolvinggatethatrestrictthenumberofuserstoenterorleaveafacilityatatimeforpedestrian trafficcontrol

MantrapMantrapconsistsofasetofdoubledoorswhereoneofthedoorscanbeopenedatatimeforaccesscontrol

Foradditionalsecurity,personenteringandleavingafacilitycanbemonitoredandcontrolledbyaguard

LightingOneofthemostbasic(andcheapest) componentsofasecuritysystem

Carefullydesignedandcoordinatedinteriorandexteriorlightingsystemscanexertasignificantdeterrenteffect

ClosedCircuitTelevision(CCTV)

Forpreventinganddetectingofabnormalevents

LocateCCTVinstrategicpointssuchas:◦ EntriestoDataCentre◦ Unmannedmachinerooms

Liveevents shouldberecordedandretainedforfutureanalysisand/orprosecution

GuardsGoodforcontrollingphysicalaccessandperimeter security,e.g.registervisitors,escortingvisitors

Willbemoreeffective ifsupplementedbylockeddoorsandCCTV

Goodforsituation(e.g.duringemergency)whichrequiremakingimmediatelyjudgmentsanddecisions

Guardsmustbetrainedsothattheycanperformtheirworkeffectively

AccessControlSystemTherearethreetypesofuserauthenticationmethodsforcontrollinguseraccess:◦ Somethinganindividualknows(e.g.password)◦ somethinganindividualpossesses (e.g.smartcard)◦ somethinganindividualhas(e.g.fingerprint)

Thesemethodscanbeusedaloneorincombination

ProgrammableLockProgrammablelockrequireusertoenterapatternofdigits(lockcombination)onthenumerickeypadfordeterminingwhetheraccessisallowed

Programmablelockcanbemechanicallyorelectronicallybased

Suitableforareaswithlowaccesssecuritycontrolsaspasswordcanbeobtainedbyobservinganauthorised userenteringthelockcombination

MemoryCardMemorycardstore,butnotprocessinformation

Memorycardissignificantlymoresecurethanpassword,especiallyifmemorycardmustbepresented forenteringandleavingthecontrolledareas

Moreadministrativeoverhead formanagingthememorycards,e.g.lostcardshandling

BiometricsSystemsBiometricssystemidentifypeoplebyauniquehumancharacteristicssuchassizeandshapeofahand,fingerprint,voice,iris,etc.

BenefitsofBiometrics foraccesscontrol◦ Moresecureassharing/stealing ofaccesscardiseliminated◦ Administrativetimeforhandlinglostcardisreduce◦ Convenience

SecurityAccessControlHandGeometryReader

NetworkOperationCentreClosed-circuitTVSurveillanceSystem(CCTV)

SecurityOperationCenter

ComputerRoomAirConditioningCRAC

26/11/2015 154

Configuredwithafail-safeback-upsystemandwithtemperatureandhumiditycontrol

UninterruptiblePowerSupply(UPS)

FM200FireSuppressionSystemandPre-ActionSprinklerSystem

Cages,RacksandCabinets

CloudComputing

GridComputingGridcomputingisthefederationofcomputerresources frommultiplelocationstoreachacommongoal.

Thegridcanbethoughtofasadistributedsystemwithnon-interactiveworkloadsthatinvolvealargenumberoffiles.

USThastwosupercomputerduring1994- 1996

Top500Supercomputersites

WhatisCloudComputing?

LargeScaleCloudComputing

3ServiceModelsofCloudComputing

SaaS (Software-as-a-Service)◦ Theconsumerusestheprovider’sapplicationsonacloudinfrastructure◦ E.g.GoogleApps,Salesforce

PaaS(Platform-as-a-Service)◦ Theconsumerdeployconsumer-createdoracquiredapplicationsontothecloudinfrastructure◦ E.g.WindowsAzure,GoogleAppEngine

IaaS (Infrastructure-as-a-Service)◦ Theconsumerprovisionprocessing,storage,networks,andotherfundamentalcomputingresources◦ E.g.AmazonEC2,GoGrid

5EssentialCharacteristicsofCloudComputing

Broadnetworkaccess◦ Ubiquitous– canbeaccessedeverywhere

Rapidelasticity◦ Highlyscalable,evenappearedas“unlimited”totheusers

Measuredservice◦ Payperuse(“Taxi”metaphor)

On-demandself-services◦ Userscanrequest theserviceautomaticallywithouthumaninteractionwiththeserviceprovider

Resourcespooling◦ Sharedresourcepool,userhasnocontrolovertheexactlocationoftheprovidedresources

TerminologyofcloudcomputingPublicCloud◦ Thecloudinfrastructureisownedbyanorganizationsellingcloudservices

PrivateCloud◦ Thecloudinfrastructureisoperatedsolelyforasingleorganization

CommunityCloud◦ Thecloudinfrastructureissharedbyseveralorganizationshavingsimilarrequirements

HybridCloud◦ Thecloudinfrastructureisacompositionoftwoormoreclouds(private,community,orpublic)

Amazon

WindowsAzure

CloudrelatedthreatsIsolationrisk

De-perimeterization

Roles&responsibilities issues

De-perimeterizationForresterResearchproposedZero-Trustarchitecture◦ Nodefaulttrustforanyentityincludingusers,devices,applicationsandpackets

◦ Keeptheconceptofprotectingcompartmentalizedifferentsegments tothenetwork

VLAN(VirtualLocalAreaNetwork)canbeusedforsegmentthenetworkbutcannotenforcethecontrolbasedonthreatsordetectedprivilegedinformation

CloudSecurity

Finalwords

WhatelseyouhavetolearnITILProcess◦ OperationSecurity◦ ChangeManagement◦ ProblemManagement◦ CapacityManagement◦ …

SecureApplicationProgrammingPractices

ITSecurityPoliciesandSecurityManagement

PhysicalSecurity

Whatyoucanlearnfromexam?…

PrepareforFutureHottopicsinITSecurityField◦ IdentityManagement◦ OnlineFraudDetection◦ MobileandCloudSecurityArchitectureDesign◦ CloudSecurityimplementation◦ SoftwareDefinedNetwork◦ ApplicationSecurity◦ IoT Security

PrepareforCertificateISC2◦ CISSP◦ SSCP◦ CSSLP◦ CCSP◦ CCFP

CSA◦ CCSK

ISACA◦ CISA◦ CSX

EC-Council◦ CEH

SANS◦ GCFA◦ GCFE◦ GREM◦ GWAPT◦ …

SecurityrelatedworkinHKindustry

• Security Administrator

• Security Assessor/ Security Auditor

• Security Applications Developer

• Security Architect

Design Implementation

OperationsReview

week 13 – advanced topics on security

Documents

week 4 topics

advanced math topics

computer architecture 2010 – advanced topics 1 computer...

dcm: advanced topics

201 advanced topics

advanced topics sorting

techbuy advanced topics

a - advanced topics

hdf5 advanced topics

advanced administration topics

advanced topics manual

seaside advanced topics

arcgis enterprise: advanced topics in …...arcgis...

advanced administrative topics

dcm: advanced topics

computer architecture 2011 – advanced topics 1 computer...

advanced topics 7177

mongodb advanced topics

advanced topics

advanced investing topics