Specify which users can access the system

Specify what resources they can access

Specify whater operations they can perform

Provide individual accountabilty

Facilities

Support Systems

Information Systems

Personnel -

management, users, customers, business partners

Control categories:

Deterrent

Control Categories:

Preventive

Control categories:

Detective

Control categories:

Corrective

Remedy circumstances

mitigate damage

Restore controls

Control Categories:

Compensating

Alternative control

(for example, supervision)

Control Categories:

Recovery

Administrative

Technical (Logical)

Physical

User IDs

Username

Account Number

Personal Identification Number (PIN)

Badge System

Biometric Devices

Unique

Standard naming convention

Non-indicative of job function

Secure and documented process for issuance

Authentication by Knowledge

Authentication by Owernship

Authentication by Characteristic

What a person Knows

Passwords, Passphrases

(Password encryption schemes)

Event, location, or time based.

Authentication server knows the expected value from the token and the user must input it or be in close proximity.

Like WoW Authenticator. 

Identity is confirmed by either:

Physiological Trait (unique, fingerprint, retina, iris)

Behavioral characteristics (keystroke, signature pattern)

Accuracy: Type I, Type II errors

Processing Speed: how fast the accept/reject is made

User acceptability

Protection of Biometric Data

Authentication Methods

Risk Vs. Cost

Password - High Risk, Low Cost

Software Token - High/Medium Risk - Medium Cost

Hardware Token - Medium Risk, Medium/High Cost

Signing Action - High Cost, Medium/High Risk

Biometric - High Cost, Low Risk

Efficient log-on process

Users may create stronger password

No need for multiple passwords

Timeout and attempt thresholds enforced across entire platform

Centralized Administration

• Compromised password allows intruder into all authorized resources
• Inclusion of unique platforms may be challenging

Contains a set of information about resources and services on the network, such as users, workstations, and servers. 

Used to simplify access and administration by providing a unified organization of the network resources.

Domain of trust that shares a single security policy and single management.

Access parameters controlling which sets of objects a subject can access.

Think of a “security domain” as a concept where the principle of separation protects each resource and each domain is encapsulated into distinct address spaces.

Owner and System determine who has access.

Systems decision based on privilege (clearance) of subject (user) & sensitivity (classification) of object (file).

For systems of highly sensitive data

Sensitivity labels to all objects and clearance labels to all subjects.

Objects's sensitivity level and the subjects clearance level determine success.

Permits processing of multiple levels on one system.

Examples of Access Permissions

"No Access/Null"

Example of Access Permissions

Read (R)

Example of Access Permissions

Write (W)

Example of Access Permissions

Execute (X)

Example of Access Permissions

Delete (D)

Example of Access Permissions

Change (C)

Example of Access Permissions

Full Control

Access based on a list of rules that determine authorization.

Owners create or authorize the rules.

Mediation mechanisms enforce the rules to ensure authorized access.

• Access Control decisions are based on job function.
• Each role will have its own access capabilities.
• Determination of role/job function is discretionary and is in compliance with security access control policy.

• Employ a technically knowledgable person to select, install, configure, operate, and maintain the IDS.
• Update the system with new signature attacks and also to evaluate expected behavior profiles.
• Be aware that the IDS itself may be vulnerable to attacks.

• Alert staff to suspicious activity for investigation.
• Provide details on extent of intruder activity
• Provide information for legal proceedings.

• Network connection event data
• System-level event data
• Application-level event data
• User-level event data - keystroke activity

Series of activities undertaken to identify and exploit security vulnerabilities.

Types of Penetration Testing

Zero-Knowledge

Team has no relevant information about target

Typically performed by independent third party

Types of Penetration Testing

Partial Knowledge

Types of Penetration Testing

Full Knowledge

Examples of Pen Test Methods

Discovery

Examples of Pen Test methods

Enumeration

Examples of Pen Test Methods

Vulerability Mapping

Examples of Pen Test Methods

Exploitation

Confidentiality

Integrity

Availability

Tailored requirements meeting the organization's specific requirements.

Influenced by legal, regulatory, business, IT drivers.

Standards

Procedures

Baselines

Guidelines

Organization Roles and Responsibilities

Executive Management

Organizational Roles and Responsibilities

Information Systems Security Professionals

Organizational Roles and Responsibilities

Owners

Responsible for:

• Ensuring that appropriate security, consistent with the organization's security policy, is implemented in their information systems.
• Determining appropriate sensitivity or classification levels
• Determining access privileges

Organizational Roles and Responsibilities

Custodian

Organizational Roles and Responsibilities

Users

Organizational Roles and Responsibilities

IS/IT Function

Organizational Roles and Responsibilities

Information Systems Auditor

Responsible for:

• Providing independent assurance to management on the appropriateness of the security objectives.
• Determing whether the security policy, standards, baselines, procedures, and guidelines are appropriate and effective to comply with the organization's security objectives.
• Identifying whether the objectives and controls are being achieved.

• Ensure all access cards and tools are returned.
• Remove user access immediately upon departure.
• Suspension/disciplinary procedures

• Clearly defined roles, job descriptions, and responsibilities
• Least privilege/need to know basis
• Separation of duties
• Job rotation
• Mandatory Vacations

Awareness - reminder of security responsibilities

Training - provides skills needed for security

Education - decision making and security management skills

1. Deter

2. Delay

3. Detect

4. Assess

5. Respond

1. Territoriality - people protect territory that is their own
2. Surveillance - high degree of visual control
3. Access control - limit access and control the flow of access