Security and Risk Management

Security and Risk Management

1. Confidentiality

   • Acheived when we have high assurance when information is kept form unauthorised parties
   • Attackers circumvent confidentiality by social engineering attacks like shoulder surfing, Brute force and decrypting packets
     • Shoulder Surfing
       • Shoulder surfing is using direct observation techniques, such as looking over someone's shoulder, to get information.
     • Brute force
     • Decrypting packets
   • Enforced by user encrypting data or classifying and restriciting data
     • Encryption at Rest
     • Encryption in transit
     • Access Controls
   • Sensitivity, A Measure of harm or damage if the information were to be disclosed
   • Discrussion, Shown by a person choosing to control information to limit damage
   • Criticality, How Critical to a mission information is
   • Concealment, The act of preventing disclosure
   • Secracy, the act of keeping something secret
   • Privacy, The act of keeping information confidential that is personally identifiable or that can cause damage if discloused
   • Seclusion, The act of storing something in an out of the way manner
   • Isolation, Keeping someting seperate from otheres
   • CAN'T HAVE ONE WITHOUT THE OTHER
   • Priority of Public Sector

2. Integrity

   • Is achieved when information remain unaltered and can be proven to be so, except by authorised parties
     • Preventing unauthorised modifications
     • Preventing accendental modifications
       • Implementing correct input validating can prevent corrupt data from happening
     • Ensuring, External and internal consistancy of the information remains valid
     • Hashing can detect the attack on integrity of data
   • Managing Change Control
   • Digital Signing
   • Cyclic Redundancy Check
   • AVAILABILITY DEPENDS ON CONFIDENTIALITY & INTEGRITY

3. Availability

   • Usable Access to a resource is always provided in a timely and uninterrupted manner
   • Networks must remain up, functional and not susceptible to attacks like DoS
   • Applications must serve fast enough to serve all required users and can recover from problems fast enough so the overall productivity is not affected
   • Protection againest natural disaster or electrical problems
   • Load Balancing
   • Clustering or Web Farms
   • Making Backups
   • Redundent Internet connections
   • Warm or hot backup facilities
   • Priority of Private Sector

4. Autherisation

   • Decision on what the subject can access and how it can be used

5. Authentication

   • Happens when the subject proves they are who they claim to be

6. Auditing

   • Recording of the activities for a given subject in a log
     • When the log is reviewed for compliance
       • Accountability

7. Identification

   • Occurs When a Subject Claims a specific identity

8. Non Repudiation

   • Non-repudiation is the assurance that someone cannot deny the validity of something. Non-repudiation is a legal concept that is widely used in information security and refers to a service, which provides proof of the origin of data and the integrity of the data.
   • Digital signatures can offer non-repudiation when it comes to online transactions

9. Vulnerability to Exposure

   • Threat Agent
     • A Person or a process that exploits a vulnerability is a threat agent
     • Eg: Employees not following proper procedure while shredding documents, Attacker gaining access through network connection , An Automated process that deletes the wrong files
   • Explioit
     • Exploit is when a Vulnerability is taken advantage of by an attacker
   • Risk
     • Risk is the likelihood that a threat agent will exploit a vulnerability combined with damage that would result
     • If an IDS is not implemented in the system , then the risk of an attack being unnoticed will go up
     • Mitigate the risk
       • Control
         • Reduces the likelihood of a vulnerability being exploited
         • Firewalls
         • Encryptions
         • Security Guards
         • Requiring strong passwords
         • Catagories of Control
           • Administrative
             • Includes Training Security policies and documentation and managing risks
           • Technical
             • Software or hardware elements such as hashing or encryption, firewalls and enforcing authentication
           • Physical
             • Security guards, Locks etc
           • Using multiple category of controls in a layered approch.
           • Security Frameworks
             • ISO 27000
               • 1995, BS7799, Published by British Standard Institute, It outlines how an information security system ( ISMS) should be created and maintained.
               • Divided into 2 Parts, part 1 Describes controls and Part 2 describes how and ISMS could be setup/ or complaince can be proved
               • Provides an overview and vocabulary of rest of the 27000 framework
               • ISMS, A set of prolicies , processes and systems to manage risk, Most well known is contained 27001 , provides guidelines on establishing ISMS and is the primary one that comapanies gain certification
               • 27001 is golden standard for implementation, creation , contol and improvement of ISMS
               • ISO 27002 Provided a code of practice / general guidelines for implementing an ISMS
             • tells you how to approach and recogonise on how to deal with weaknesses
           • Enterprise Architectural Framework
             • Guidelines to Build Individual architecture that are mapped to specific needs within a buisness
             • Advantage of using Enterprice framework that architure Will be tailered for each user viewpoint
             • Zachmen Framework
             • TOGAF
         • Functional Areas of Control
           • Preventative
             • In which we avoid an incident
           • Detorrent
             • In which we avoid an attacker
           • Dectective
             • Where we identify an intruder
           • Corrective
             • In which a component or a system is fixed
           • Recovery
             • Where we bring a
           • Compensating
             • Used when 1st choice is expensive / doesn't meet buisness need
   • Threat
     • A threat is a danger that a vulnerability might be explioted
   • Vulnerablity
     • Weakness in a system that allows a threat to compromise security
     • Can Be Software, Hardware, a process or a person
     • A wireless Access point without security enabled
     • too many ports on a firewall being open
     • unneeded service running on a server, such as a FTP server no one uses
     • not keeping sensitive rooms locked
     • Not requiring passwords to be changed periodically
     • No Background checks on new hires
   • Exposure
     • Single real world incident when a vulnerability being exploited by a threat agent