Security in Practice
Enterprise Security
Business Continuity
• Ability of an organization to maintain its operations
and services in the face of a disruptive event
– Computer attack
– Natural disaster
• Many organizations are either unprepared or have
not tested their plans
• Common elements
– Redundancy planning
– Disaster recovery procedures
– Incident response procedures
2
Redundancy Planning
• Building excess capacity in order to protect against
failures
• Servers
– Protect against single point of failure
– Redundant servers or parts
• May take too long to get back online
– Server cluster
• Design the network infrastructure so that multiple
servers are incorporated into the network
• Types: asymmetric and symmetric
3
Redundancy Planning (cont’d.)
Server cluster
4
Redundancy Planning (cont’d.)
• Storage
– Hard disk drives often are the first component of a
system to fail
– Implement RAID (Redundant Array of
Independent Drives) technology
• Uses multiple hard disk drives for increased reliability
and performance
5
Redundancy Planning (cont’d.)
• Networks
– Redundant network ensures that network services
are always accessible
– Virtually all network components can also be
duplicated
6
Redundancy Planning (cont’d.)
• Power
– Uninterruptible power supply (UPS)
• Device that maintains power to equipment in the event
of an interruption in the primary electrical power
source
• On-line
• Off-line
– Backup generator
7
Redundancy Planning (cont’d.)
• Sites
– Hot site
• Run by a commercial disaster recovery service
• Allows a business to continue computer and network
operations to maintain business continuity
– Cold site
• Provides office space
• Customer must provide and install all the equipment
needed to continue operations
8
Redundancy Planning (cont’d.)
– Warm site
• All of the equipment installed
• Does not have active Internet or telecommunications
facilities
• Does not have current backups of data
9
Disaster Recovery Procedures
• Procedures and processes for restoring an
organization’s operations following a disaster
• Focuses on restoring computing and technology
resources to their former state
• Planning
– Disaster recovery plan (DRP)
• Written document
• Details the process for restoring computer and
technology resources
10
Disaster Recovery Procedures
(cont’d.)
• Common features of DRP
–
–
–
–
–
Purpose and scope
Recovery team
Preparing for a disaster
Emergency procedures
Restoration procedures
11
Disaster Recovery Procedures
(cont’d.)
Sample from a DRP
12
Disaster Recovery Procedures
(cont’d.)
• Disaster exercises
– Test the effectiveness of the DRP
– Objectives
• Test the efficiency of interdepartmental planning and
coordination in managing a disaster
• Test current procedures of the DRP
• Determine the strengths and weaknesses in disaster
responses
13
Disaster Recovery Procedures
(cont’d.)
• Enterprise data backups
– Significantly different than those for a home user
– Disk to disk (D2D)
– Continuous data protection (CDP)
14
Incident Response Procedures
• What is forensics?
– Forensics
• Application of science to questions that are of interest
to the legal profession
– Computer forensics
• Attempt to retrieve information that can be used in the
pursuit of the attacker or criminal
• Importance of computer forensics is due in part to
– High amount of digital evidence
– Increased scrutiny by the legal profession
– Higher level of computer skill by criminals
15
Incident Response Procedures
(cont’d.)
• Responding to a computer forensics incident
– Secure the crime scene
•
•
•
•
Response team must be contacted immediately
Document physical surroundings
Take custody of computer
Interview users and document information
– Preserve the evidence
• First capture any volatile data
– Random access memory (RAM)
• Mirror image backup or bit-stream backup
16
Incident Response Procedures
(cont’d.)
– Establish the chain of custody
• Documents that the evidence was under strict control
at all times
• No unauthorized person was given the opportunity to
corrupt the evidence
– Examine the evidence
• Mirror image is examined to reveal evidence
• Mine and expose hidden clues
– Windows page file
– Slack
– Metadata
17
Slack
18
Security Policies
• Plans and policies must be established by the
organization
– To ensure that people correctly use the hardware
and software defenses
• Organizational security policy
19
What Is a Security Policy?
• Document that outlines the protections that should
be enacted
• Functions
– Communicates organization’s information security
culture and acceptable information security behavior
– Detail specific risks and how to address them
– Help to create a security-aware organizational
culture
– Ensure that employee behavior is directed and
monitored to ensure compliance with security
requirements
20
Balancing Trust and Control
• Approaches to trust
– Trust everyone all of the time
– Trust no one at any time
– Trust some people some of the time
• Deciding on the level of control for a specific policy
is not always clear
• Not all users have positive attitudes toward security
policies
21
Balancing Trust and Control (cont’d.)
Possible negative attitudes toward security
22
Designing a Security Policy
• Definition of a policy
– Characteristics
•
•
•
•
Communicate a consensus of judgment
Define appropriate behavior for users.
Identify what tools and procedures are needed
Provide directives for Human Resource action in
response to inappropriate behavior
• May be helpful in the event that it is necessary to
prosecute violators
23
Designing a Security Policy (cont’d.)
• Due care
– Obligations imposed on owners and operators of
assets
– Exercise reasonable care of the assets and take
necessary precautions to protect them
– Care that a reasonable person would exercise under
the circumstances
– Examples
24
Designing a Security Policy (cont’d.)
• The security policy cycle
– Three-phase cycle
• Performing a risk management study
– Asset identification
– Threat identification
– Vulnerability appraisal
– Risk assessment
– Risk mitigation
• Creating a security policy based on the information
from the risk management study
• Reviewing the policy for compliance
25
Designing a Security Policy (cont’d.)
Security policy cycle
26
Types of Security Policies
• Acceptable use policy (AUP)
– Defines the actions users may perform while
accessing systems and networking equipment
– Unacceptable use may also be outlined by the AUP
• Security-related human resource policy
– Include statements regarding how an employee’s
information technology resources will be addressed
– Presented at an orientation session when the
employee is hired
– May contain due process statement
27
Types of security policies
28
Types of Security Policies (cont’d.)
• Personally identifiable information (PII) policy
– Outlines how the organization uses personal
information it collects
• Disposal and destruction policy
– Addresses the disposal of resources that are
considered confidential
29
Types of Security Policies (cont’d.)
Sample PII (privacy) policy
30
Types of Security Policies (cont’d.)
• Ethics policy
– Refocus attention on ethics in the enterprise
– Written code of conduct
– Central guide and reference for employees in
support of day-to-day decision making
31
Summary
• Redundancy planning
– Building excess capacity in order to protect against
failures
• Disaster recovery
– Procedures and processes for restoring an
organization’s operations following a disaster
• Forensic science
– Application of science to questions that are of
interest to the legal profession
32
Summary (cont’d.)
• Security policy
– Written document that states how an organization
plans to protect the company’s information
technology assets
33