Operations Security “Controls over the hardware in a computing facility, over the data media used,...
-
Upload
silvia-montgomery -
Category
Documents
-
view
212 -
download
0
Transcript of Operations Security “Controls over the hardware in a computing facility, over the data media used,...
![Page 1: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/1.jpg)
Operations Security
“Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”
![Page 2: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/2.jpg)
C.I.A. as affected by Operations Controls
Confidentiality: affect sensitivity & secrecy
Integrity: how well implementation directly affects
accuracy & authenticity Availability:
affect system’s level of fault tolerance and recovery capability
![Page 3: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/3.jpg)
Controls & Protections
Controls used to protect hardware, software, & media from
Threats in environment Internal or External Intruders Operators inappropriately accessing
resources
![Page 4: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/4.jpg)
Categories of Controls Preventative Controls are designed to
lower amount & impact of unintentional errors Prevent unauthorized intruders from entering EX: prenumbered forms & data validation
Detective Controls To detect an error once it has occurred After the fact
Corrective (or Recovery) Controls Implemented to mitigate the loss Restoring data
![Page 5: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/5.jpg)
Categories of Controls (conti) Deterrent Controls
Encourage compliance, complement other controls
Application Controls Designed into software to minimize & detect
irregularities Transaction Controls
Input Controls Processing Controls Output Controls Change Controls Test Controls
![Page 6: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/6.jpg)
TCSEC “Orange Book” Controls
D: Minimal ProtectionC: Discretionary ProtectionC1: Discretionary Security ProtectionC2: Controlled Access ProtectionB: Mandatory ProtectionB1:Labeled Security ProtectionB2: Structured ProtectionB3: Security DomainsA1: Verified Protection
![Page 7: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/7.jpg)
Orange Book Defines assurance requirements for secure
computer operations Assurance: level of confidence that security
policy has been correctly implemented
Two types: Operational: basic features & architecture Life cycle: controls & standards used in
operations & maintenance
![Page 8: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/8.jpg)
Orange Book: Covert Channel Analysis
Channel: info transfer path Covert channel: path that violates security
policy Covert storage channel Covert timing channel TCSEC B2: must protect against, must
perform analysis for all storage channels TCSEC B3 & A1: must protect against both
types of convert channels
![Page 9: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/9.jpg)
Orange Book:Trusted Facility Management Assignment of a specific individual to
administer secruity related system functions
Must take auditable action before being able to assume admin role
B2: System must support separate operator & system admin roles
B3: Must clearly identify functions of security admin
![Page 10: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/10.jpg)
Orange Book:Separation of Duties Assignment of parts of task to different
personnel No one person with total control == no one
person that can completely compromise system
“Two man control” Three distinct system admin roles
System admin Security admin Enhanced operator
![Page 11: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/11.jpg)
Orange Book:Rotation of Duties
Limit amount of time any individual performs the same security related duties
![Page 12: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/12.jpg)
Orange Book:Trusted Recovery
Required only in B3 & A1 level systems System failure == serious security risk
Security bypassed while not fully functional Ex: System crash while sensitive data
written to disk before ACL changed Hierarchical Recovery Types
Manual Recovery Automated Recovery of single failure Automated Recovery without undue loss
![Page 13: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/13.jpg)
Modes of Operation Dedicated Mode
Each user with any access has a valid personnel clearance, formal access approval (with signed non disclosure), & a valid “need to know” all info
System-High Mode All above except need to know some info
Compartmental Mode Need to know only info they have direct access to
Multilevel Mode Some do not have valid clearance for all info but have
clearance & need to know for info they will have access to
![Page 14: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/14.jpg)
Change Control Manages process of tracking & approving
changes Identify, control, audit Insure changes not diminish sys sec Document all changes Primary functions of change control
Change implemented in orderly manner -- test Inform user base of change Analyze effect of the change Reduce negative impact of change
![Page 15: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/15.jpg)
Procedures for Change Control
1. Applying to introduce change2. Approval of change3. Cataloging intended change4. Testing change5. Scheduling & implementing change6. Reporting change to management
![Page 16: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/16.jpg)
Configuration Management More formalized for highly sec system Configuration Managers
Identify & document each functional & physical config item
Personally assure approval for and manage all config changes
Record & report status of changes Audit system config for unknown changes
Configuration Control Board
![Page 17: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/17.jpg)
Administrative Controls More to do with human than hardware or
software Personnel Security
Employment screening / background chk Mandatory vacations Job action warnings & terminations
Separation of duties & responsibilities Least Privilege Need to know Change control Record retention & documentation control
![Page 18: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/18.jpg)
Least Privilege
Separate levels of access based on job function
Three basic levels Read Only Read/Write: only to data copied from
original location Access Change: original location
![Page 19: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/19.jpg)
Operations Job Functions
Computer Operator Operations analyst Job control analyst Production Scheduler Production Control Analyst Tape Librarian
![Page 20: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/20.jpg)
Others Record Retention concerns
Data remanence Info on media after it has been erased
Due care & Due Diligence Legal, governmental, & simple good business
practices
Documentation Control Security plans, risk analysis, security policy, etc
![Page 21: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/21.jpg)
Operations Controls
Day-to-day procedures to protect Most important aspects of (details follow):
Resource protection Hardware controls Software controls Privileged-entity controls Media controls Physical access controls
![Page 22: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/22.jpg)
Resource Protection Protect from loss or compromise Hardware
Lan Hardware, Storage Media, Processing Systems, Standalone Computers, Printers, etc
Software Program Libraries & Source, Vendor Software,
O/S & Utilities Data
Backup Data, User Data Files, Password Files, Operating data directories, Sys logs
![Page 23: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/23.jpg)
Hardware Controls
Hardware maintenance Maintenance accounts
Disabled until needed Preset, widely known ids & passwords
Diagnostic port controls Ports for trouble shooting
Hardware physical controls
![Page 24: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/24.jpg)
Software Controls
What software used on system Licensed software only
Anti-virus management Software testing Software utilities Safe software storage Backup controls
![Page 25: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/25.jpg)
Privileged-Entity Controls
Oversight of personnel with “special” access to systems
Examples of special access Lower level system commands Special operational parameters System control programs
![Page 26: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/26.jpg)
Media Controls Media Security
Logging, Access Control, & Proper Disposal Overwriting: a pattern, its compliment, then
another pattern (0011, 1100, 1010) Degaussing & Destruction
Media Viability Controls Protect viability of media used Marking, Handling, Storage, Orig. Quality
Media Librarian
![Page 27: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/27.jpg)
Physical Access Controls Hardware
Control of comm. Equip, storage media, printed logs & reports
Software Control of backup files, system logs, production apps,
sensitive/critical data Some personnel need special physical access
It department personnel, Cleaning Staff, Maintenance personnel, third-party contractors, consultants, temp staff
Supervision Physical piggybacking – 2nd person follows 1st through
door (man trap)
![Page 28: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/28.jpg)
Monitoring & Auditing “Reviewing an operational system to see
that controls, both manual & automated, are functioning effectively & correctly”
Are technical features being bypassed Are required procedures being followed Is there evidence of abnormal computer
usage
![Page 29: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/29.jpg)
Monitoring
Looking for: Illegal software installing Hardware faults & error states Operational events for abnormalities
Techniques Intrusion detection Penetration testing Violation analysis
![Page 30: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/30.jpg)
Intrusion Detection & Violation Analysis Sampling traffic patterns Look for activities above clipping level Clipping Level & Profile based anomaly detection
Baseline of user activity considered “normal” Enables ignoring normal user errors When exceeded violation report filed Also used for variance detection
Looking for Repetitive mistakes, individuals exceeding their
authority, too many people with restricted access, patterns showing serious intrusion attempts
![Page 31: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/31.jpg)
Penetration Testing Attempting to access a system from
outside normal Technology based
Scanning & probing Demon Dialing / War Driving Sniffing
Personnel Oriented Dumpster Diving Social Engineering
![Page 32: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/32.jpg)
Auditing Checking for internal & external
compliance Patterns of abnormal use Audit these functions
Backup controls System & transaction controls Data library procedures & center security Systems development standards Contingency plans
![Page 33: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/33.jpg)
Audit Trails Enables tracing a transaction’s history Enforcement of accountability Audit Logs should record
Transaction date & time, who processed it, & where Any security events relating to transaction Any commands (with options) executed by user All identification & authorization attempts Any files or other resources accessed
Auditor should look for Amendments to production jobs Production job returns Computer operator practices
![Page 34: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/34.jpg)
Security Goals of Audit Mechanism
Allow review of patterns of access to individual objects
Allow discovery of repeated attempts to bypass security mechanisms
Find use of privileges by user greater than they should have
An additional form of user assurance that attempt to bypass security will be caught
![Page 35: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/35.jpg)
Audit Logs
Prevent log file from being altered
Protect availability of log during event
Protect logging media from destruction or damage
![Page 36: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/36.jpg)
Benefits of Auditing & Problem Management
Enhancement of risk assessment program
Enhancement of internal readiness & communications
Personnel Security Training Reduced failures to manageable level Prevent (re)occurrence of problem Mitigate impact of violation
![Page 37: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/37.jpg)
Threats Event that if realized can cause damage to system Accidental Loss
Operator errors Transaction processing errors
Inappropriate activities Inappropriate content Waste of corporate resources Sexual or racial harassment Abuse of privileges
Illegal Computer Operations Eavesdropping Fraud, Theft, Sabotage External Attack
![Page 38: Operations Security “Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”](https://reader036.fdocuments.in/reader036/viewer/2022081603/56649e755503460f94b76830/html5/thumbnails/38.jpg)
Vulnerabilities & Attacks Traffic / Trend analysis
Analyze data characteristics & pattern rather than content
Stop by: padding message, sending noise, covert channel analysis
Maintenance Accounts Data-Scavenging Attacks
Keyboard attacks & Laboratory Attacks Initial Program Load vulnerabilities
Single user mode, boot sequence, bios, CD Social Engineering Network Address Hijacking