week 13 – advanced topics on security

Week13–AdvancedTopicsonSecurity

26/11/2015 1COPYRIGHT©RICCIIEONGFORUSTTRAINING2015

ITServiceDelivery


ITILProcess

26/11/2015 3

http://www.mitsm.de/itil-wiki/process-descriptions-english/main-page

COPYRIGHT©RICCIIEONGFORUSTTRAINING2015

SecurityOperations


OperationsSecurityOperationsSecurityisusedtoidentifythecontrolsoverhardware,media,andtheoperatorswithaccessprivilegestoanyoftheseresources.

Auditandmonitoringisthemechanisms,tools andfacilitiesthatpermitstheidentificationofsecurityeventsforreportingtoappropriateparties. (ISC2 StudyGuide)


ITDepartmentOrganization


ITDepartmentOrganization

Programmer

Analyst/Programmer

System Analyst

IT Development Manager

Systems Programmer

Technical Manager

Operator

Shift Supervisor Production Support

IT Operations Manager

Chief Information Officer


OrganizationofComputerOperations1. ITOperationsManagement

2. Input/outputcontrol

3. Dataentry

4. Computeroperations

5. Productioncontrolandscheduling

6. Librarymanagementandchangemanagement


1.ITOperationsManagementITOperationsManagementhastheoverallresponsibilityfordevelopingcomputeroperationsstandardsandprocedures forefficientandeffective operations

ITManagementisalsoresponsible forensuringthattherearesufficientITresources tomeetthecurrentandfuturebusinessneeds


1.ITOperationsManagementMeanstomanageandcontrolIToperations◦ Recruitsufficientcomputeroperators◦ Organizecommunicationbetweenshifts◦ Provideoperationsdocumentationtosupportcomputeroperations◦ Setupprocessingchecklistsandpriorities


1.ITOperationsManagement◦ Obtainandreview:◦ Hardwareandsoftwareproblemreport◦ Statisticsofscheduledandunscheduledsystemdowntime

◦ Re-runjobsandthereasons◦ CPUutilization◦ Computerstorageutilization◦ SLAachievement


2.Input/Output ControlDataInputControl◦ Receivesourcedocumentsforbatchdataentry◦ Authenticatethesourcedocuments◦ Usebatchandcontroltotalstoensureallsourcedocumentsareprocessed◦ Inputthedatainatimelymanner


2.Input/Output ControlDataOutputControl◦ Outputisproducedintheproperformatanddistributedtotheappropriateusersinasecuremanner

◦ Controlofproductionreportdistribution◦ Predefinedreportrecipients◦ Checkcompletenessbeforedistribution◦ Recipientcheckallreportsreceived


2.Input/Output Control◦ Restrictaccesstospooledreportstoprevent

◦ Compromiseconfidentiality◦ Unauthorizedreportdeletion

◦ Computergenerationofnegotiableinstruments◦ Sequencecontrol◦ Detectionofmissingofnegotiableinstruments

◦ Inventoryofsensitive andcriticalstationaries◦ Keepinasecurelocation◦ Properlyrecorded◦ Stocktakingonaregularbasis


3.DataEntryEnterdatabyusingdataentrydevicetocreatedatafileforsubsequentprocessing

Keyverificationisacommoncontroltechniqueforverifyingtheaccuracyofinputteddata

Sufficientaudittrailforcheckingwhenrequired


4.ComputerOperationsCarryoutad-hocandscheduledcomputerjobs

Guidedbyoperationprocedurestoensurecomputeroperationsarecarriedinaefficientandeffectivemanner

Exampleofoperationprocedures◦ Systemstartupandshutdownprocedures◦ Errorhandlingprocedures◦ Databackupandrestoreprocedures


4.ComputerOperationsOperationtasks◦ Restartandshutdowncomputers◦ Runningandmonitoringcomputerjobs◦ Reportprinting◦ Backup/restoreofsystemanddatafiles◦ Housekeeping◦ Controlaccesstothedataprocessingcentreandcomputingfacilities◦ Participateindisasterrecoverytesting


4.ComputerOperations◦ Maintainregistersandoperationalstatistics formeasuringSLAachievement◦ Reportequipmentfailuresandoperatingerrors◦ Ensureanadequatesupplyofcomputerconsumables


5.ProductionControlandSchedulingSchedulecomputerjobsprocessingsequence, forbothad-hocandroutinejobs

Definetheconditionsforstarting/re-startingajob

Definejobdependencies

Ensurealljobsarecompletelyprocessed

Manualprocessingofscheduled joborusingjobschedulingsoftware


5.ProductionControlandSchedulingManual◦ Relyonoperatortorunajob◦ Usejobprocessingchecklistforcontrollingjobprocessing◦ Manualjobmonitoringandlogging◦ Jobprocessingrecordsreviewbysupervisortoensurecomputerjobsareaccuratelyandcompletelyprocess

◦ Effectiveforsimplebatchjobs


5.ProductionControlandScheduling◦ Automatic(JobScheduling Software)◦ Automaticprocessingofbatchjobs◦ Setuponce◦ Controljobdependence◦ Errordetectionandlogging


6.LibraryManagementandChangeManagementManagecomputertapes/cartridgesmovement◦ Recordingofreceiving,lending,removingofcomputertapes/cartridges◦ Regularstocktakingtodetectmissingofcomputertapes/cartridges◦ Properaudittrailofcomputertapes/cartridgesmovement


6.LibraryManagementandChangeManagementManageproductionsoftwareinventory◦ Softwareversioncontrol◦ Jobcontrollanguageandprocessingparametercontrol◦ Computersourceandobjectcontrol(e.g.synchronization)◦ Loggingofaddition,deletion andupdatingofsoftwareinventory


OperationsAdministration


OperationsAdministration1. Backgroundchecking

2. Segregationofduties

3. JobRotation

4. Leastprivilege

5. Needtoknow


1.BackgroundCheckVerificationchecksbeforeemployinganoperationsstafffor◦ HKID◦ Availabilityofsatisfactorycharacterreferences◦ Checkingoftheapplicant’scurriculumvitae◦ Confirmationofclaimedacademicandprofessionalqualifications


2.SegregationofDutiesEnsurecriticalstagesofaprocessarenotunderthecontrolofasingleindividual

Errorsandirregularitiesperformedbyoneusercanbedetectedbyanotheruser

Potentialdamagecanbeminimized


2.SegregationofDutiesAppropriatesegregationofdutiesbetween◦ Users◦ ITdevelopers◦ Datacenterstaff

Achievedby◦ Policies◦ Procedures◦ Organizationstructure

Sothatnooneindividualcanperformunauthorizedactivities


2.SegregationofDutiesIncomputeroperations,thefollowingdutiescanbedefined◦ ProductionControl◦ DataEntry◦ Librarian◦ Operator◦ SystemProgrammer


2.SegregationofDutiesInsoftwareprogramming,thefollowingfunctiongroupscanbedefined◦ SystemAnalyst◦ Programmer◦ DatabaseAdministrator◦ SecurityOfficer◦ QualityAssurance


2.SegregationofDuties

System Analyst IT Developer Data Entry Computer Operator LibrarianSystem Analyst X XIT Developer X X XData Entry X XComputer Operator X X XLibrarian X X

X means imcompatible duties


3.JobRotationAdetectivecontrol

Requireoperationsstafftorotatetheirjobdutiesonaregularbasisforallowinganotherstafftodetectanomalies

Havinghumanresourcespolicytorequireoperationsstafftotakeannualleaveforatleast2consecutiveweeks


4.LeastPrivilegePreventivecontrol

Onlytheminimumaccessprivilegeisgrantedtoperformatask

Purposeofleastprivilegeistoensurethatataskcanonlybeperformedbyauthorizeduser

Forexample◦ “SuperUser”privilegeisnotgrantedtoOperationsstaff


5.NeedToKnowPreventivecontrol

Onlythoseuserswhoneedtoperformataskisprovidedwiththeinformationandknowledgeforprocessingthetask

Thiscanbeachievedbyrestrictinguserstoaccessoperationsmanual,systemdocuments,etc.

Reducetheriskofunauthorisedsystemaccess


OperationsControlsChangecontrols

Problemmanagement

Capacitymanagement

Documentcontrols

Mediahandling

Operationsacceptancetest

Audittrails

Viruscontrols


Physical(Environmental)Security


PhysicalSecurityPhysicalfacilityisthebuildingorvehiclehousingthesystemandnetworkcomponents

Thephysicalcharacteristicsofthesestructuresandvehiclesdeterminethelevelofphysicalthreatssuchasfireandunauthorisedaccess

Thefacility’sgeographiclocationdeterminethecharacteristicsofnaturalthreatssuchasearthquakes andflooding


PhysicalSecurity

26/11/2015 117

NaturalEnvironmental

Threats

Floods,fire,earthquake…

SupplySystemThreats

Poweroutages,communicationinterruptions,…

ManmadeThreats

Explosions,disgruntledemployees,fraud,…

PoliticallyMotivatedThreats

Strikes,riots,civildisobedience,…


PhysicalSecurityElementforPhysicalSecurityMeasures

Determent◦ Convincepeoplenottoattack

Detection◦ Alarms,guards,andothermeansofdetectingattacks

Delay◦ Elementsthatslowdownanattacker,e.g. locks&safes

Response◦ Guardsoracalltothepolice


PhysicalSecurity- ControlsAdministrativecontrols◦ facilityselection,facilityconstructionandmanagement,personnelcontrol,evacuationprocedure,systemshutdownprocedure, firesuppressionprocedure,handlingproceduresforotherexceptionssuchashardwarefailure,bombthreats,etc.

Physicalcontrols◦ facilityconstructionmaterial,keyandlock,accesscardandreader,fence,lighting,etc.

Technicalcontrols◦ physicalaccesscontrolandmonitoring system,intrusiondetectionandalarmsystem,firedetectionandsuppressionsystem,uninterruptedpowersupply,heating/ventilation/airconditioningsystem(HVAC),diskmirroring,databackup,etc.


SecurityConsiderations0fPhysicalSecurity◦ Whatarethesecurityconsiderationsinprotecting theequipmentwhentheygointothecloud?

◦ AccessControl◦ Whohaveaccesstotheserversandstoragedevices?

◦ AgainstHazards◦ Fireandsmokesensors◦ Fireextinguishers◦ Watersensorandraisedfloors◦ UPS

◦ AgainstAttacks◦ Fastrecoveryatabackupsite

◦ RetiringDevices◦ Defineretirementprocessoffailedorusedstoragedevices


SecurityConsiderations0fPhysicalSecurity - AccessControlAccessControlandAuditing◦ Lockandkey◦ Accesscardandreader◦ Fence◦ Lighting◦ DoorwayandMan-trap

AccessMonitoringandIntrusionDetection◦ Patrolforce/securityguard◦ Technicalaccessmonitoringcontrols◦ AlarmSystem


PhysicalAccessSecurityAccesscontrolfacility◦ Fence,GateandTurnstile◦ Mantrap◦ Lighting◦ CCTV◦ Guards


Fence,GateandTurnstileFenceandgate◦ Marktheboundaryofafacilityfordeterringunauthorizedaccess◦ Mustbetallenoughforstoppingadetermined intruder

Turnstileisarevolvinggatethatrestrictthenumberofuserstoenterorleaveafacilityatatimeforpedestrian trafficcontrol


MantrapMantrapconsistsofasetofdoubledoorswhereoneofthedoorscanbeopenedatatimeforaccesscontrol

Foradditionalsecurity,personenteringandleavingafacilitycanbemonitoredandcontrolledbyaguard


LightingOneofthemostbasic(andcheapest) componentsofasecuritysystem

Carefullydesignedandcoordinatedinteriorandexteriorlightingsystemscanexertasignificantdeterrenteffect


ClosedCircuitTelevision(CCTV)

Forpreventinganddetectingofabnormalevents

LocateCCTVinstrategicpointssuchas:◦ EntriestoDataCentre◦ Unmannedmachinerooms

Liveevents shouldberecordedandretainedforfutureanalysisand/orprosecution


GuardsGoodforcontrollingphysicalaccessandperimeter security,e.g.registervisitors,escortingvisitors

Willbemoreeffective ifsupplementedbylockeddoorsandCCTV

Goodforsituation(e.g.duringemergency)whichrequiremakingimmediatelyjudgmentsanddecisions

Guardsmustbetrainedsothattheycanperformtheirworkeffectively


AccessControlSystemTherearethreetypesofuserauthenticationmethodsforcontrollinguseraccess:◦ Somethinganindividualknows(e.g.password)◦ somethinganindividualpossesses (e.g.smartcard)◦ somethinganindividualhas(e.g.fingerprint)

Thesemethodscanbeusedaloneorincombination


ProgrammableLockProgrammablelockrequireusertoenterapatternofdigits(lockcombination)onthenumerickeypadfordeterminingwhetheraccessisallowed

Programmablelockcanbemechanicallyorelectronicallybased

Suitableforareaswithlowaccesssecuritycontrolsaspasswordcanbeobtainedbyobservinganauthorised userenteringthelockcombination


MemoryCardMemorycardstore,butnotprocessinformation

Memorycardissignificantlymoresecurethanpassword,especiallyifmemorycardmustbepresented forenteringandleavingthecontrolledareas

Moreadministrativeoverhead formanagingthememorycards,e.g.lostcardshandling


BiometricsSystemsBiometricssystemidentifypeoplebyauniquehumancharacteristicssuchassizeandshapeofahand,fingerprint,voice,iris,etc.

BenefitsofBiometrics foraccesscontrol◦ Moresecureassharing/stealing ofaccesscardiseliminated◦ Administrativetimeforhandlinglostcardisreduce◦ Convenience


SecurityAccessControlHandGeometryReader


NetworkOperationCentreClosed-circuitTVSurveillanceSystem(CCTV)


SecurityOperationCenter


ComputerRoomAirConditioningCRAC

26/11/2015 154

Configuredwithafail-safeback-upsystemandwithtemperatureandhumiditycontrol


UninterruptiblePowerSupply(UPS)


FM200FireSuppressionSystemandPre-ActionSprinklerSystem


Cages,RacksandCabinets


CloudComputing


GridComputingGridcomputingisthefederationofcomputerresources frommultiplelocationstoreachacommongoal.

Thegridcanbethoughtofasadistributedsystemwithnon-interactiveworkloadsthatinvolvealargenumberoffiles.

USThastwosupercomputerduring1994- 1996


Top500Supercomputersites


WhatisCloudComputing?


LargeScaleCloudComputing


3ServiceModelsofCloudComputing

SaaS (Software-as-a-Service)◦ Theconsumerusestheprovider’sapplicationsonacloudinfrastructure◦ E.g.GoogleApps,Salesforce

PaaS(Platform-as-a-Service)◦ Theconsumerdeployconsumer-createdoracquiredapplicationsontothecloudinfrastructure◦ E.g.WindowsAzure,GoogleAppEngine

IaaS (Infrastructure-as-a-Service)◦ Theconsumerprovisionprocessing,storage,networks,andotherfundamentalcomputingresources◦ E.g.AmazonEC2,GoGrid


5EssentialCharacteristicsofCloudComputing

Broadnetworkaccess◦ Ubiquitous– canbeaccessedeverywhere

Rapidelasticity◦ Highlyscalable,evenappearedas“unlimited”totheusers

Measuredservice◦ Payperuse(“Taxi”metaphor)

On-demandself-services◦ Userscanrequest theserviceautomaticallywithouthumaninteractionwiththeserviceprovider

Resourcespooling◦ Sharedresourcepool,userhasnocontrolovertheexactlocationoftheprovidedresources


TerminologyofcloudcomputingPublicCloud◦ Thecloudinfrastructureisownedbyanorganizationsellingcloudservices

PrivateCloud◦ Thecloudinfrastructureisoperatedsolelyforasingleorganization

CommunityCloud◦ Thecloudinfrastructureissharedbyseveralorganizationshavingsimilarrequirements

HybridCloud◦ Thecloudinfrastructureisacompositionoftwoormoreclouds(private,community,orpublic)


Amazon


WindowsAzure


De-perimeterizationForresterResearchproposedZero-Trustarchitecture◦ Nodefaulttrustforanyentityincludingusers,devices,applicationsandpackets

◦ Keeptheconceptofprotectingcompartmentalizedifferentsegments tothenetwork

VLAN(VirtualLocalAreaNetwork)canbeusedforsegmentthenetworkbutcannotenforcethecontrolbasedonthreatsordetectedprivilegedinformation


CloudSecurity


Finalwords


WhatelseyouhavetolearnITILProcess◦ OperationSecurity◦ ChangeManagement◦ ProblemManagement◦ CapacityManagement◦ …

SecureApplicationProgrammingPractices

ITSecurityPoliciesandSecurityManagement

PhysicalSecurity


Whatyoucanlearnfromexam?…


PrepareforFutureHottopicsinITSecurityField◦ IdentityManagement◦ OnlineFraudDetection◦ MobileandCloudSecurityArchitectureDesign◦ CloudSecurityimplementation◦ SoftwareDefinedNetwork◦ ApplicationSecurity◦ IoT Security


PrepareforCertificateISC2◦ CISSP◦ SSCP◦ CSSLP◦ CCSP◦ CCFP

CSA◦ CCSK

ISACA◦ CISA◦ CSX

EC-Council◦ CEH

SANS◦ GCFA◦ GCFE◦ GREM◦ GWAPT◦ …


SecurityrelatedworkinHKindustry

• Security Administrator

• Security Assessor/ Security Auditor

• Security Applications Developer

• Security Architect

Design Implementation

OperationsReview


week 13 – advanced topics on security

Documents