Security

Security

1. Assess and Audit the Network

2. Leverage Established Industry Frameworks

   • ITIL/MOF
   • Payment Card Industry Regulation (PCI)
   • Sarbanes-Oxley Act (SOX)
   • Health Insurance Portability and Accountability Act (HIPAA)

3. Utilize Layered Security

   • DMZ

4. Attacks

   • Distributed Denial of Service (DDoS)
   • Ping of Death (PoD)
     • malformed ICMP
   • Ping Flood

5. Utilize 3rd Party to Audit the Network

6. Harden host and guest computers

   • remove not needed SW
   • maintain patch level
   • control access
   • disable unnecessary ports
   • deploy AV
   • config log files
   • limit physical access
   • scan for vulnerabilities
   • deploy host based firewall

7. Employ penetration testing

   • simulated attack on the network from both external and internal attackers

8. Perform Vulnerability Assessment

   • evaluate

9. Secure Storage Resources

   • Data Classification
   • Data Encryption
   • Granular Storage Resource Controls
     • LUN  masking zoning
   • Protected Backups

10. Data Security

    • PKI
    • Plaintext
      • before encryption
    • Obfuscation
      • pattern to mask sensitive data can be reverse engineered
    • Cipher Text
      • cipher=encryption algorithm
      • block cipher
        • AES
        • DES/3DES
        • DSA
        • RC5
      • stream cipher
        • faster
        • RC4
        • RSA
        • unknown, variable amount of data
    • Symmetric Encryption
      • aka private key encryption same key lock and unlock
    • Asymentric Encryption
      • public and private key keypair is in PKI certificate data confidentiality
    • Digital Signatures
      • data authentication and integrity

11. Encryption protocols

    • data authenticity and verification also known as non-repudiation
    • IPSec
      • secures IP traffic using encryption regardless of application
    • SSL/TLS
      • TLS is SSLs successor secure socket layer, tranport level security typical SSL secured web server, but ssl can secure also SMTP, LDAP

12. Access Control Methods

    • Role-based (RBAC)
      • implicit inheritance OS, app, AD enforce based on role given to the user by the admin larger org many user
    • Mandatory access controls (MAC)
      • let people OS and app enforce policy only admin gives permissions to users
    • Discretionary Access Control (DAC)
      • Access Control List / ACL data owner grant/deny access let people manage the content they own more granular access

13. Multifactor authentication

    • Sth you know
      • username password
    • Sth you have
      • credit card hardware token
    • Sth you are
      • biometric

14. SSO

    • MS ADFS

15. Federation

    • authorize users to many resources B2B federation