Security Management Practices

Security Management

includes risk management, information security policies, procedures, standards, guidelines, baselines, information classification, security organization, and security education.

Security Management Responsibilities: Who is in charge and why?

Analogy: Building a house

The Top-Down Approach to security is ideal. It means that the initiation, support, and direction come from top management and work their way down through middle management ant then to staff members

Bottom-Up Approach to security is the exact opposite. It refers to a situation in which the IT department tries to develop a security program without getting proper management support and direction.

Security Administration and Supporting Controls

• Administrative controls - developing and publishing of policies, standards, procedures, and guidelines; the screening of personnel; training and implementing change control procedures.
• Technical controls (logical controls) - implementing and maintaining access control mechanisms, password and resource management, identification and authentication methods, security devices and configuration of infrastructure.
• Physical controls - controlling individual access into facility, locking systems and removing unnecessary drives from computers, etc...

Fundamental Principles of security

The main three principles in all programs are:

1. Availability - "ensures reliability and timely access to data and resources to authorized individuals"
2. Integrity - "upheld when the assurance of accuracy and reliability of information and systems is provided, and unauthorized modification is prevented."
3. Confidentiality - "ensures that the necessary level of secrecy is enforced at each junction of data processing and prevents unauthorized disclosure.

Terms

Shoulder surfing - when a person looks over another persons shoulder and watches their keystrokes or views data as it appears on the screen

Social engineering - when one person tricks another person into sharing confidential information by posing as someone authorized to have access to that information.

Security Definitions

A big part of this chapter are the words vulnerability, risk, and exposure. They are often used to represent the same thing however, they are all unique and related.

A vulnerability is a software, hardware, or procedural weakness that may provide and attacker the open door into a computer or network.

A threat is any potential danger to information or systems.

A risk is the likelihood of a threat agent taking advantage if a vulnerability and the corresponding business impact.

An exposure is an instance of being exposed to losses from a threat agent.

ISO 17799 Domains

• Information security policy for the organization
• Creation of information security infrastructure
• Asset classification and control
• Personnel security
• Physical and environmental security
• Communications and operations management
• Access control
• System development and maintenance
• Business continuity management
• Compliance

The text goes into further detail about Information Risk Management. Preventing from physical damage, human interaction, equipment malfunction, inside and outside attacks, misuse of data, loss of data, and application error. Risk analysis has four main goals

1. Identify assets and their values
2. Identify vulnerabilities and threats
3. Quantify the probability and business impact of these potential threats
4. Provide an economic balance between the impact of the threat and the cost of the countermeasure

Risk analysis provides a cost/benefit comparison, which compares the annualized cost of safeguards to the potential cost of loss.

Quantitative vs. Qualitative Risk Analysis

Delphi Methods

Defining Policies, Standards, Baselines, Guidelines, and Procedures.

A security policy is an overall general statement produced by senior management that dictates what role security plays within the organization. Standards refer to mandatory activities, actions, rules, or regulations. A baseline can refer to a point in time that is used as a comparison for future changes or it can be defined as the minimum level of protection that is required. Guidelines are recommended actions and operational guides to users, IT staff, operations staff, and others when a specific standard does not apply. Procedures are detailed step-by-step tasks that should be performed to achieve a certain goal.

Private Business vs. Military Classifications

Commercial Business

• Confidential
• Private
• Sensitive
• Public

Military

• Top Secret
• Secret
• Confidential
• Sensitive but unclassified
• Unclassified

Layers of Responsibility

Data Owner

Data Custodian

System Owner

Security Administrator

Security Analyst

Application Owner

Supervisor

Change Control Analyst

Data Analyst

Process Owner

Solution Provider

User

Product Line Manager