is 533 course project

IS 533 Course Project Joseph Perry

of 14

Contents Information Security Policy Document ........................................................................................................ 3

Scope ........................................................................................................................................................ 3

Overall objectives ..................................................................................................................................... 3

Standards ...................................................................................................................................................... 3

Encryption................................................................................................................................................. 4

Patch Management .................................................................................................................................. 5

Vulnerability Scanning .............................................................................................................................. 6

Procedures .................................................................................................................................................... 8

Encryption Procedure ............................................................................................................................... 9

Patch Management Procedure ............................................................................................................... 10

Vulnerability Scanning Procedures ......................................................................................................... 10

Evidence ..................................................................................................................................................... 11

TrueCrypt ................................................................................................................................................ 11

Patch Management ................................................................................................................................ 11

Vulnerability Scanning ............................................................................................................................ 12

Corrected Risk Assessment ........................................................................................................................ 13

of 14

Information Security Policy Document The definition of information security for this policy is the protection and integrity of personal information; whereas, personal information is all data contained within the physical space where the primary computer system resides.

Scope The scope of this policy is the users, hardware, software, computer network, printers and physical space.

Overall objectives Management Intent

The intent of this policy is to ensure continuity of the information contained within the facility by minimizing risk due to a security incident.

Compliance Requirements

This policy is a requirement for the course IS 533 and all standards contained within are to satisfy this requirement. The policy will be reviewed on a yearly basis to ensure additional compliance requirements are being met.

Security Standards

Network Security:

a. The network is protected by a SonicWall firewall which will be properly patched. b. The firewall will be properly configured to not allow suspect traffic. c. Tools such as NESSUS will be used to periodically scan for vulnerabilities.

Patching Policy:

a. All workstations on the network will be properly patched to the latest effective vendor standards. b. Management will provide proper patching tools such as Secunia to ensure proper patching. c. All software which is out of date and cannot be patched will need to be upgraded or removed.

Antivirus Policy:

a. Management has provided a licensed version of AVG which must be installed on all machines. b. AVG is set to auto update on a daily basis, this shall not be altered by the user.

Access:

a. All computers must have a username and password in order to access the device. b. Users must ensure physical access to the location is limited to only known individuals. c. Devices shall be encrypted where necessary to ensure security of confidential data.

of 14

Standards

Encryption Description

Disk encryption is a method of protecting sensitive data stored on hard disk drives from compromise. There are various hardware or software encryption technologies available. Encryption can be done for single files and folders, or entire hard disks as well as removable media depending on the need. Our policy is to encrypt all hard disk drives and removable media (USB flash drives) using TrueCrypt version 7.1a. TrueCrypt achieves disk encryption by encrypting files right before they are saved to the disk. Data stored on an encrypted drive cannot be read without knowing the password. When the user wants to open an encrypted file it is opened into the computer's RAM for use then is removed from RAM when the user is finished.

Implementation TrueCrypt has been downloaded from: http://www.truecrypt.org/ and has been saved to: \\Enterprise\Installs\TrueCrypt Setup 7.1.a.exe

1. Run TrueCrypt Setup 7.1.a.exe 2. Accept all defaults

Configuration Desktop Computer System Configuration

• Authentication: 15 character password • Encryption Method: AES • Hash Algorithm: RIPEMD‐160 • Key Strength: 256 Bits • Encryption Type: Whole Drive • Encrypt Host Protected Area: No • Boot Type: Single Boot

of 14

Patch Management Description Patching is used to fix software bugs and security issues found in operating systems and applications. The standard for our systems is to use a program called Secunia PSI. Secunia verifies the patching level of the operating system and all applications installed on the user's computer then grades the system on a percentage scale from 0 to 100. A Secunia score of 95% has been defined as the minimum standard. Implementation Secunia has been downloaded from: http://www.secunia.com and has been saved to: \\Enterprise\Installs\Secunia\PSISetup.exe

1. Run PSISetup.exe 2. Click next 3. Check "I accept the terms of the License Agreement" and click next 4. Leave "Enable Auto‐Updates" checked and click next 5. Check "Show full change information in tray icon notifications" and click next 6. Click next 7. Click install 8. Click finish 9. Click yes on the next window

Configuration

1. When Secunia opens for the first time click the start scan link on the main screen 2. The initial scan will take several minutes to complete 3. Click configuration then settings 4. Make sure the following items are checked:

a. Start the Secunia PSI on boot b. Enable program monitoring c. Enable automatic program updates d. Show detailed program changes

5. Once all scans are completed install all recommended updates

of 14

Vulnerability Scanning Description Vulnerability scanning is checking a computer and network for security holes that could allow unauthorized access to confidential information. This organization uses a tool called Nessus which resides on the primary server (enterprise) and uses a web interface for scanning and reporting. Nessus has templates and policies defined to scan for vulnerabilities for multiple network ports, operating systems and software. Implementation Nessus has been downloaded from http://www.tenable.com and has been saved to \\enterprise\installs\ Nessus‐5.0.1‐x86_64.msi Nessus can only be installed on a single server and is running off the main file server. See administration for additional information. If Nessus needs re‐installed accept all defaults and create a logon using the credentials stored in password safe. We currently subscribe to the Home Feed which requires an activation code that is located with the install media. Configuration

1. Logon to Nessus by browsing to https://localhost:8834 a. Use the credentials found in the password safe

2. Click the Policies tab a. Click add b. Enter the information needed on the general tab

i. Name = name of computer/device ii. Visibility = shared iii. Check the following under port scanners:

1. TCP scan 2. SNMP scan 3. Ping host 4. Netstat SSH scan 5. Netstat WMI scan 6. SYN Scan

iv. Check the following under scan: 1. Allow post‐scan report editing 2. Safe checks 3. Silent dependencies 4. Log scan details to server

v. Leave everything else as default

of 14

c. Click the credentials tab i. Select Windows credentials from the drop‐down ii. Enter the username under SMB account iii. Enter the SMB password iv. Leave everything else as default

d. Click the plugins tab i. Ensure all plugins are set to green by clicking enable all

e. Click the submit button 3. Click the scans tab

a. Click add b. Enter the name of the device to scan c. Select template from the drop‐down menu d. Select the newly created policy from the drop‐down menu e. Enter the IP address in the scan targets box f. Click save template

of 14

Procedures

Encryption Procedure

1. Open TrueCrypt 2. Click the create volume button 3. Select encrypt the system partition or entire system drive and click next 4. Select normal and click next 5. Select encrypt the whole drive and click next 6. Select no for encryption of host protected area and click next 7. Select single‐boot and click next 8. Select AES encryption and RIPEMD‐160 for the hash algorithm and click next 9. Type the password from the password vault in both boxes and click next 10. On the short password confirmation screen click the yes button 11. On the next screen move the mouse around for 15 seconds 12. On the keys generated screen click next 13. On the rescue disk screen save the image to \\enterprise\public\RescueDisks (Z:)

a. Filename: Computer_Name_TC_Rescue.iso b. Click the next button c. Burn the image to a CD‐R disk d. Label the disk "TrueCrypt ‐ Computer Name Rescue Disk" e. Place the disk back into the drive and click next to verify f. Click next on the rescue disk verified screen

14. Select None (fastest) for wipe mode and click next 15. Click Test on the pretest screen 16. Click yes to reboot the computer 17. On the Pretest Completed screen click the encrypt button 18. Allow the encryption to complete 19. Reboot the computer

of 14

Patch Management Procedure

1. Secunia will handle all application and operating system patching 2. Ensure Secunia is configured according to patch management procedure 3. For updates Secunia is not able to install automatically:

a. Double click the Secunia icon on the taskbar b. Click Scan Results c. Under the Install Solution column click Install Update d. Follow instructions from Secunia to download and install the needed updates

of 14

Vulnerability Scanning Procedures

1. Open the Nessus web interface (https://localhost:8334) 2. Logon with the credentials stored in the password database (see administrator) 3. Click Scans 4. Click the computer name you wish to scan and click launch

a. All computers in the network have been saved as a template 5. Click the reports tab and verify the report is running

a. At the top of the list you will see the computer name with a status of running b. The report will take approximately 5 minutes to run

6. Click the browse button to browse the report a. Items listed as high need to be fixed b. Items listed as medium should be fixed as soon as possible

of 14

Evidence

TrueCrypt The system drive (C:) has been fully encrypted using the standard outlined above. The secondary data drive (D:) has not been encrypted at this time, but plans for encryption are currently being studied. This screenshot shows that the system has been encrypted using the encryption standard.

Patch Management Secunia has identified 70 programs on the primary system. The operating system and all discovered applications has been patched to the latest vendor specification. This has created a score of 100% which is 5% higher than the minimum patching standard required.

of 14

Vulnerability Scanning The following screenshots show the results of a Nessus scan performed on the firewall and the workstation according to the vulnerability scanning policy.

Primary Computer

SonicWall Firewall

of 14

Corrected Risk Assessment Introduction:

The purpose of this risk assessment is to identify risk to the primary system. The scope of the assessment is an evaluation of the hardware, software and firewall

Risk Assessment Approach:

The risk assessment was performed by Joseph Perry. The technique used was a review of firewall logs and a Nessus security scan of the computer and firewall. Risks will be ranked using a scale from low to high.

High It is probable that the vulnerability will be exploited and the impact will result in preventing the organization from functioning

Medium It may be probable that the vulnerability could be exploited and the impact will hinder the organization from functioning.

Low It is not probable that the vulnerability could be exploited and the impact will allow the organization to continue to function.

System Characterization:

• System Make: Custom white box • Operating System: Windows 7 Professional (64‐bit) Service Pack 1 • Hard Drive: Primary ‐ C: 120GB SSD, Secondary ‐ D: 500GB SATA • Memory: 6GB DDR‐3 • Antivirus: AVG 2012.0.1913 full license (DAT 4/14/2012) • Major Applications:

o MS Office Professional 2007 SP3 o Adobe CS3 Design Premium o Internet Explorer 9 o Firefox 11 o Google Chrome o VMware Workstation 8.0.2

The computer has two hard disk drives. The operating system and programs are installed on the primary drive and all user files are saved to the secondary drive. Both hard drives have been encrypted using the standards outlined in the policy. There are additional computers for use by the student if this system is compromised; however, this is the primary system therefore it is considered critical. The computer system is attached to a LAN via SonicWall PRO 1260 firewall / switch combo and is connected to the internet via an AT&T residential gateway.

of 14

Risk Assessment Results:

Physical Space

The physical space is secured with a standard deadbolt lock on the primary entrance. There is D‐Link video surveillance camera at the facility which records data to a secured file server and is remotely viewable via a smart phone application.

Patching Level of Student Workstation

Secunia PSI reports a 100% compliance score as seen in the evidence above.

Network Security

Overall there are no critical (high) security vulnerabilities of the workstation or firewall. There are a total of 6 vulnerabilities ranked as medium which could be exploited. The user is aware of the issues and will work to resolve them with the vendors.

• Workstation o High ‐

None o Medium ‐

SSL certificate cannot be trusted SSL self‐signed certificate SMB signing disabled

o Low ‐ SSL / TLS regeneration DoS

• Firewall o High ‐

None o Medium ‐

SSL certificate signed using weak hashing algorithm SSL certificate cannot be trusted SSL self‐signed certificate

o Low ‐ DHCP server detection IP forwarding enabled

is 533 course project

Documents