Upload
leo-mark-villar
View
90
Download
0
Embed Size (px)
Citation preview
DATA SECURITY
INFORMATION SECURITY
• Protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction• Protecting data from attackers invading networks,
natural disasters, adverse environmental conditions, power failures, theft or vandalism, or other undesirable states
INFORMATION SECURITY
• In any environment, where we plan to put heightened levels of security in place, we also need to take into account the cost of replacing our assets if we do happen to lose them, and make sure we establish reasonable levels of protection for their value.• The cost of security we put in place should never
outstrip the value of what it is protecting.
WHEN ARE WE SECURE ?
Even if our systems are properly patched, there will always be
new attacks to which we are vulnerable.
WHEN ARE WE INSECURE ?
• Not patching our systems• Using weak passwords• Downloading programs from the internet• Opening email attachments from unknown
senders• Using wireless networks without encryption
• The good thing is that once we are able to point out the areas in the environment that can cause it to be insecure, we can take steps to mitigate these issues. • This problem is akin to cutting something in
half over and over; there will always be some small portion left to cut again. • Although we may never get to state that we
can definitively call “secure”, we can take steps in the right direction.
MODELS FOR DISCUSSING SECURITY ISSUES
• The Confidentiality, Integrity and Availability ( CIA ) Triad
Confidentiality
AvailabilityIntegrity
CONFIDENTIALITY
• Refers to the ability to protect data from those who are not authorized to view it.
• Examples of breaches / compromised confidentiality• Loss of laptop containing data• Person looking over our shoulder while typing our
password• Email attachment sent to the wrong person• Attacker penetrating our systems
INTEGRITY
• Refers to the ability to prevent data from being changed in an unauthorized or undesirable manner.
• Means to prevent unauthorized changes to the data• Means to reverse authorized changes that needs
to be undone.
• Example : undo, rollback
AVAILABILITY
• Refers to the ability to access our data when we need it.
• Examples of loss of availability• Power loss• Operating system or application problems• Network attacks• Compromise of a system• Denial of service attack
AVAILABILITY
• Refers to the ability to access our data when we need it.
• Examples of loss of availability• Power loss• Operating system or application problems• Network attacks• Compromise of a system• Denial of service attack
THE PARKERIAN HEXAD
• Named after Donn Parker
Confidentiality Integrity AvailabilityPossession
or Control
Authenticity Utility
CONFIDENTIALITY
• Refers to the ability to protect data from those who are not authorized to view it.
• Examples of breaches / compromised confidentiality• Loss of laptop containing data• Person looking over our shoulder while typing our
password• Email attachment sent to the wrong person• Attacker penetrating our systems
INTEGRITY
• Refers to the state of data itself in the sense of completeness
AVAILABILITY
• Refers to the ability to access our data when we need it.
• Examples of loss of availability• Power loss• Operating system or application problems• Network attacks• Compromise of a system• Denial of service attack
POSSESSION OR CONTROL
• Refers to the physical disposition of the media on which the data is stored
AUTHENTICITY
• Proper attribution as to the owner or creator of the data in question.
UTILITY
• Refers to how useful the data is to us
ATTACKS
• What makes up an attack ?• Type of attack that it represents• The risk the attack represents• Controls to use when mitigating the attack
TYPES ATTACKS
Confidentiality • Interception
Integrity• Interruption• Modification• Fabrication
Availability• Interruption• Modification• Fabrication
INTERCEPTION
• Attacks that allows unauthorized users to access data, applications or environments
• Examples :• Unauthorized file viewing or copying• Eavesdropping on phone conversations• Reading emails not yours
INTERRUPTION
• Attacks that cause our assets to become unusable or unavailable for our use, on a temporary or permanent basis.
• Examples :• Denial of Service attack
MODIFICATION
• Attacks that involves tampering with our assets.
FABRICATION
• Attacks that involves generating data, processes, communications, or other similar activities with a system
THREATS
• Things that have potential to cause harm to our assets• Identify the possibility of something happening
that can cause a security breach or network outage
• example : • Natural threats• Intentional
VULNERABILITIES
• Weakness that can be used to harm the asset.• Holes that can be exploited by threats to cause
harm
• Example• Poor coding in software installed• OS vulnerabilities1. Problems in hardware or physical structure of the
machines
RISK
• The likelihood that something bad will happen
• The best strategy is to spend our time mitigating the most likely attacks.
RISK MANAGEMENT
• Evaluation of threats and the cost of protection
IMPACT
• Effect that an attack can cause harm considering the value of the asset being threatened.
CONTROL
• measures in place to help ensure that a given threat us accounted for.• Categories• Physical• Logical• Administrative
PHYSICAL CONTROL
• Controls to protect the physical environment in which the system sits or where the data is stored
• examples :• Fences, gates, locks, guards, cameras, air conditioning
system, backup power generators
LOGICAL CONTROL
• Also called Technical Controls• Controls that protect the system, network, and
environment that process, transmit, and store data
• examples :• Passwords, encryption, logical access controls, firewalls
ADMINISTRATIVE CONTROL
• Controls based on rules, policies, laws, procedures, guidelines, and other items that are “paper” in nature.• Set out the rules for how users are expected in the
environment to behave• These controls must be totally enforced for
compliance.
• examples :• Change of password every 90 days• Differing levels of authority
DEFENSE IN DEPTH
• Strategy to formulate a multi-layered defense what will allow to still mount a successful defense should one or more defensive measures fail.
Internal networkhostapplicationdata
external network
DEFENSIVE IN DEPTH
EXTERNAL NETWORK
• DMZ• VPN• Logging• Auditing• Penetration
Testing• Vulnerability
Analysis
NETWORKPERIMETER
• Firewalls• Proxy• Logging• Stateful
Packet Inspection
• Auditing• Penetration
Testing• Vulnerability
Analysis
INTERNAL NETWORK
• IDS• IPS• Logging• Auditing• Penetration
Testing• Vulnerability
Analysis
HOST
• Authentication
• Antivirus• IDS• IPS• Password
Hashing• Logging• Auditing• Penetration
Testing• Vulnerability
Analysis
APPLICATION
• SSO• Content
Filtering• Data
Validation• Auditing• Penetration
Testing• Vulnerability
Analysis
DATA
• Encryption• Access
Controls• Backup• Penetration
Testing• Vulnerability
Analysis