Three tenets of security Confidentiality Integrity Availability
e-Security –the problem is real 90% of companies surveyed by the FBI have detected cyber attacks recently Disgruntled employees, industrial espionage, and data theft are responsible for 70-80% of security breaches Increase in external threats from hackers, ex-employees, competitors and cyber terrorists The rise of “Script Kiddies” - Hackers who do not target specific organizations, but run scripts scanning the net for ANY vulnerable network
Security Myths Nobody would want our data. Who knows us? We are anonymous There is no danger to my network at all. I am not on the Internet, I am safe. I don’t need any security devices. I have a Firewall I have an antivirus on my server. I am safe All our employees are very committed & reliable!
Know your IT law Cyber crimes – Hacking, damage to computer source code, publishing lascivious information in an electronic form, breach of privacy / confidentiality, publishing digital signature, etc. Interception by Government – intercept any information transmitted through any computer resource if the same is necessary in the interest of the sovereignty or integrity of India, Digital Signatures legally valid and enforceable.
Know your IT law Authentication of electronic records in India shall be effected by the use of asymmetric crypto system and hash function If someone uses your network to attack an external network and the attacked complains, you are liable to be penalized Companies must have a detailed I T Security Policy in tune with the mandatory specific provisions of the IT Act and IT Rules.
Protectable Data assets Business Information – contracts, SLAs, financial data, customer details, etc Intellectual property – source codes, inventions, research papers, etc National secrets E-commerce
Threats to data Accessed by External hackers Divulged by ignorant employees Corrupted by virus attacks Hardware failures Inadequate access controls Badly designed applications Clear transmission over public internet Last but not the least system administrators !!
Types of External Attacks Malicious code attacks Corporate espionage Web graffiti Denial-of-service Database hacks Installing Back doors Identity Theft
Typical Network Attack locate system to attack gain privilege access gain user access Cover tracks Install backdoors attack other hosts engage in other unauthorized activity take or alter Information
Data Lifecycle – Creation – Storage – Movement – Destruction
Key security elements – Security Policy – Identity management – Robust Perimeter Security – Storage Security – Secure Transmission of data – Good Security Practices
Identity Accurate and positive identification of network users, hosts, applications, services, and resources. Standard technologies – Kerberos – one-time password Technologies used – digital certificates – smart cards – directory services (e.g. LDAP, ADS)
Perimeter Security Deals with controlling data that is passed between LAN and public internet Perimeter is controlled by – Routers and switches – Firewalls – IDS / IPS – Antivirus – URL Filters – Network Traffic Analyzers
Secure transmission The ability to provide authenticated, confidential communication between systems Data privacy is achieved by – Layer 2 Tunneling Protocol (L2TP) – IPsec – Data Encryption – PGP
Security Standards / Laws BS7799 / IS17799 Data Protection Act HIPAA SOX IT Act (Indian cyberlaws)
BS7799, ISO 9000 & BS 15000 ISO 9001 (QMS) Standard Process Approach [P-D-C-A] ISO 9001 (QMS) Standard Process Approach [P-D-C-A] BS 15000 BS 7799 BS 7799-certified companies are automatically Compliant with security section of BS 15000 BS 15000 & BS 7799 adopt the P-D-C-A Process Approach of ISO 9001: 2000 QMS Standard
Policy Management Defining a clear security objective Articulating clear policy Implemented by suitable procedures Audited regularly to ensure compliance Training users Improvising the procedures
Best Practices Understanding of the business needs A security mission statement Identification & Risk Analysis on Data A strong commitment from upper management to allocate necessary resources Clearly defined implemented and documented security policies and procedures
Best Practices A suite of host and network based security auditing and improvement tools A security awareness program that reaches everyone in the organization A dedicated team of trained security professionals and consultants to make it all happen
To conclude No technology used to protect your organization is 100% hackerproof Good policies drive good implementation Best policies without necessary awareness among personnel is in vain Security is not a one-size-fits-all solution. Security of organization assets is everyone’s responsibility.