Chapter 3: Information Security Framework

2

Objectives

Plan the protection of the confidentiality, integrity and availability of corporate data—the CIA Triad

Classify data and information Identify information ownership roles Apply the ISO 17799/BS 7799 Code of Practice

for Information Security Management Understand the intent of the 10 security domains

of the ISO 17799:2000 Code of Practice

3

Introduction

The CIA Triad The Triad stands for Confidentiality, Integrity and

Availability An attack against either or several of the elements

of the CIA triad is an attack against the Information Security of the organization

Protecting the CIA triad means protecting the assets of the company

4

C is for Confidentiality

Not all data owned by the company should be made available to the public

Failing to protect data confidentiality can be disastrous for an organization: Dissemination of Protected Health Information (PHI)

between doctors and patients Dissemination of Protected Financial Information (PFI)

between Banks and customers Dissemination of Business-critical information to rival

companies

5

C is for Confidentiality Cont.

Only authorized users should gain access to information

Information must be protected when it is used, shared, transmitted and stored

Information must be protected from unauthorized users both internally and externally

Information must be protected whether it is in digital or paper format

6

C is for Confidentiality Cont.

The threats to confidentiality must be identified. They include: Hackers Shoulder surfing Lack of shredding of paper documents Malicious Code (Virus, worms, Trojans) Unauthorized employee activity Improper access control

7

C is for Confidentiality Cont.

Identifying threats is important, but so is the reason why the company is vulnerable to those threats

A risk assessment should be conducted prior to the creation of the policy

The risk assessment will identify what threats exist, why the organization is vulnerable to them, and what the risk of a threat becoming an actual attack is

8

I is for Integrity

Protecting data integrity means protecting data from being tampered with by an unauthorized source

A business that cannot trust the integrity of its data is a business that cannot operate

An attack against data integrity can mean the end of an organization’s ability to conduct business

9

I is for Integrity Cont.

Threats to data integrity include: Hackers Unauthorized user activity Improper access control Malicious code Interception and alteration of data during

transmission

10

I is for Integrity Cont.

Controls that can be deployed to protect data integrity include: Technical controls:

Digital signatures for email use File Integrity Verifier utilities for operating systems

Behavioral controls: Separation of duties Rotation of duties End user security training

11

A is for Availability

Availability: the assurance that the data is accessible when it is needed by authorized users

What is the cost of the loss of data availability to the organization?

A risk assessment should be conducted to more efficiently protect data availability

12

A is for Availability Cont.

Threats to data availability include:

Loss of processing abilities due to natural disaster Loss of processing abilities due to hardware

failure Loss of processing abilities due to human error Loss of processing abilities due to malicious acts Loss of power Malicious code Temporary or permanent loss of key personnel

13

Planning the Goals of an Information Security Program Which is more important to protect:

Confidentiality, Integrity or Availability?

No fixed answer: it depends on the information / process at hand

Organization needs to define and rate all the business processes on which it relies in order to assign the right order of importance for each one

Resources should be allocated in accordance with the ratings obtained

14

Planning the Goals of an Information Security Program Cont. Impact of an attack on one aspect on the

others: Risk assessment should outline how an attack on

availability impacts the protection of data confidentiality and availability, for example

15

The 5 A’s of Information Security

Accountability Assurance Authentication Authorization Accounting

16

The 5 A’s of Information Security Cont. Accountability

All actions should be traceable to the person who committed them

Logs should be kept, archived and secured Intrusion Detection Systems should be deployed Computer Forensic techniques can be used

retroactively Accountability should be focused on both internal

and external actions

17

The 5 A’s of Information Security Cont. Assurance

Security measures need to be designed and tested to ascertain that they are efficient and appropriate

The knowledge that these measures are indeed efficient is known as Assurance

The activities related to assurance include: Auditing and monitoring Testing Reporting

18

The 5 A’s of Information Security Cont. Authentication

Authentication is the cornerstone of most network security models

It is the positive identification of the person or system seeking access to secured information and/or system

Examples of authentication models: User ID and password combination Tokens Biometric devices

19

The 5 A’s of Information Security Cont. Authorization

Act of granting users or systems actual access to information resources

Note that the level of access may change based on the user’s defined access level

Examples of access level include the following: Read only Read and write Full

20

The 5 A’s of Information Security Cont. Accounting

Defined as the logging of access and usage of resources

Keeps track of who access what resource, when, and for how long

Example of use: Internet Café, where users are charged by the minute of

use of the service

21

Classifying Data and Information

Data Classification Data Classification is required when creating a

risk assessment Not all information features the same security

requirements The level of classification of data has a direct

impact on the security of the server on which it is located

22

Classifying Data and Information Cont.

Each company can customize their own data classification model to better serve their security needs

The most common classification system includes three levels: Confidential Sensitive Public

23

Classifying Data and Information Cont. Confidential Data:

Not to be shared with the public Not to be shared with all employees Only should be made available to a small subset

of authorized employees Unauthorized disclosure of this data would bring

harm to the organization Examples:

Financial information, R&D discoveries, proprietary information

24

Classifying Data and Information Cont. Sensitive Data:

Not to be shared with the public Available on a “need-to-know” basis Usually available to more employees than

confidential information Unauthorized disclosure would harm the

company, especially in terms of reputation, privacy, credibility and regulatory compliance

25

Classifying Data and Information Cont. Public Data:

Can be shared with the public Disclosure of this data would not bring harm to the

organization Examples:

Official price list, published list of service phone numbers

26

Identifying Information Ownership Roles Information Ownership

Many are confused as to who the owner of information is, which can endanger the confidentiality of this information

It is important for the organization to clearly define who the information owners are

Information owners are those originally responsible for the policies and practices of information

IT usually plays the role of data custodian, not data owner

27

The ISO 17799/BS 7799 Code of Practice for Information Security Management

A framework of information security recommendations applicable to public and private organizations of all sizes.

Official definition: “the ISO […] standard gives recommendations for information security management for use by those who are responsible for initiating, implementing or maintaining security in their organization”(From the ISO Web Site)

28

The ISO 17799/BS 7799 Code of Practice for Information Security Management Cont. Quick facts about the ISO 17799/BS 7799

Started as a British document in 1989 Was proposed as an international standard after

two revisions in 1997 and 1999 Adopted by the ISO in August, 2000 There is currently no certification process for the

ISO 17799 Adopted internationally

29

Using the Ten Security Domains of the ISO 17799:2000 The Security Policy domain:

Focuses on providing direction and support for the information security program

Emphasizes the importance of a visible leadership and involvement of senior management

This involvement should impact the following processes: establishing policy the direction of the information security program A commitment to protecting physical & logical resources

30

Using the Ten Security Domains of the ISO 17799:2000 Cont. The Organizational Security domain:

Focuses on establishing & supporting a management framework to implement and manage information security within, across and outside the organization

Inward-facing controls: concentrate on employees’ and stakeholders’ relationships to information systems

Outward-facing controls: concentrate on third-party access to information systems

31

Using the Ten Security Domains of the ISO 17799:2000 Cont. The Asset Classification & Control domain:

An accurate inventory of all information security assets should be maintained

Information assets should be classified to receive the appropriate level of protection

Information assets include: Intellectual property Raw data Mined information Software

32

Using the Ten Security Domains of the ISO 17799:2000 Cont. The Personnel Security domain:

Organizations need controls for security in the hiring, employing and termination of staff

Such controls include: Personnel screening Acceptable use & confidentiality agreements Terms and conditions of employment

Employees should be trained to be: Security conscious Ready to handle incident response situations

33

Using the Ten Security Domains of the ISO 17799:2000 Cont. The Physical & Environmental Security

domain: Focuses on designing & maintaining a secure

physical environment to protect the company from: unauthorized access, damage & interference to business premises

Achieved by: Control of the physical security perimeter & entry Creating secure offices and rooms Deploying physical access controls

Must include several company departments

34

Using the Ten Security Domains of the ISO 17799:2000 Cont. The Communications & Operations

Management domain: Focuses on secure operation of information

processing facilities Includes detailed operating instructions & incident

response procedures Technical controls include IDS, antivirus, backup,

auditing, logging and system monitoring, encryption for transmitted information.

35

Using the Ten Security Domains of the ISO 17799:2000 Cont. The Access Control domain:

Goal: to prevent unauthorized access to information systems

Defines access control policy, user authentication and access management, network access controls, operating system access controls, monitoring and logging

Also applies to mobile computing

36

Using the Ten Security Domains of the ISO 17799:2000 Cont. The System Development & Maintenance

domain: Security should be defined at the genesis of the

product development cycle New product may require encryption Change control policies should be implemented to

ensure the integrity of system and information files

37

Using the Ten Security Domains of the ISO 17799:2000 Cont. The Business Continuity domain:

Business-critical processes must be protected from the effects of disasters

Focuses on data and system availability Identifies the impact of events that cause

interruption of business processes Designs response, recovery & continuity plan Plan should be regularly tested and reassessed

38

Using the Ten Security Domains of the ISO 17799:2000 Cont. The Compliance domain:

All organizations must comply with regulations at different levels, which include: Local, national and international laws Criminal and civil laws Regulatory and/or contractual obligations Intellectual property rights Copyrights

The organization’s legal advisor should be involved in this domain

39

Using the Ten Security Domains of the ISO 17799:2000 Cont. Quick facts:

Based on the size of the company, not all policies related to the ISO 17799 need to be implemented

Too many policies, especially when not all are needed, can become too confusing and result in the rejection of the whole policy

The organization should identify which of the policies are appropriate and should be implemented

40

Summary

The CIA triad is the blue print of what assets needs to be protected in order to protect the organization.

Protecting the organization’s information security can seem vague and too conceptual. Protecting the confidentiality, integrity and availability of the data is a more concrete way of saying the same thing.

Standards such as the ISO 17799 exist to help organizations better define appropriate ways to protect their information assets.