ISSeG Integrated Site Security for Grids WP2 - Methodology Methodology for Site Security Assessment JSPG Meeting, 27 June 2007 Lionel Cons, CERN © Members of the ISSeG Collaboration, 27 June 2007

(inputs on the left came initially from ISO-17799:2005) Proposed Methodology (inputs on the left came initially from ISO-17799:2005) © Members of the ISSeG Collaboration, 27 June 2007

Step 1 – Find The Assets Asset = Anything that has value to the organization [ISO 13335-1:2004] Five identified asset categories: Organizational (intellectual property rights, public image…) Human Information / data (administrative, personal, physics…) Service (network, authentication, email, office…) Hardware These are currently merged with “security requirements” © Members of the ISSeG Collaboration, 27 June 2007

Baseline Assets Preliminary list of asset types likely to be present everywhere: Locally managed PC Network Backup Office servers Application servers Centralized authentication © Members of the ISSeG Collaboration, 27 June 2007

Specific Assets Preliminary list of asset types that may be site specific: Expensive and/or dangerous equipment Provide services across Internet Local email service Exchange confidential data Stores confidential information High-availability services Internal resources available to visitors External users Centralized backup service © Members of the ISSeG Collaboration, 27 June 2007

Step 2 – Find The Threats Threat = Potential cause of an incident that may result in harm to a system or organization [ISO 13335-1:2004 section 2.25] A generic list of threats has been compiled Around 50 threats identified Need to set the relevance of each threat for the given site Linked to the role profiles (user / admin / developer / manager) and the asset types © Members of the ISSeG Collaboration, 27 June 2007

Examples of Threats Threat Id Threat description Relevance1 T1 Faulty access rights management 3 T2 Password compromising T3 Intrusion by scanning techniques T4 Intrusion (unauthorized network access) T5 Data interception techniques (sniffing/man in the middle attacks,...) T6 Fraudulent connection (theft of credentials) T7 Exploiting software vulnerabilities T8 Fraudulent use of systems (misappropriation…) T9 Repudiation (system usage) T10 Repudiation (sending/receiving of data) T11 Saturation of resources (accidental) T12 Saturation of resources (intentional - denial of service) T13 Software alteration (time bomb, worm, trojan, virus…) T14 Theft of mobile equipment or media T15 Propagation of false or misleading information T16 Use of insecure/unauthorized software T17 Hardware failure (computer, storage device, network equipment…) T18 Hardware malfunction T19 Software malfunction T20 Network failure (cabling, network device…) © Members of the ISSeG Collaboration, 27 June 2007

Step 3 – Find The Risks Risk = Combination of the probability of an event and its consequence [based on the ISO standards] We focus on threats Threats are linked to asset types Need to know the relative importance of the asset types Threats are linked to controls (aka mitigation techniques) Need to know how well the controls are applied We could look at “best practices” too © Members of the ISSeG Collaboration, 27 June 2007

Examples of Controls (based on ISO 17799) © Members of the ISSeG Collaboration, 27 June 2007

Examples of Controls (based on ISO 17799) © Members of the ISSeG Collaboration, 27 June 2007

Examples of Controls (based on OCTAVE) 1. Security Awareness and Training Step 3a Statement To what extent is this statement reflected in your organization? Staff members understand their security roles and responsibilities. This is documented and verified. Very Much Somewhat Not At All Don’t Know There is adequate in-house expertise for all supported services, mechanisms, and technologies (e.g., logging, monitoring, or encryption), including their secure operation. This is documented and verified. Security awareness, training, and periodic reminders are provided for all personnel. Staff understanding is documented and conformance is periodically verified. Staff members follow good security practice, such as securing information for which they are responsible not divulging sensitive information to others (resistance to social engineering) having adequate ability to use information technology hardware and software using good password practices understanding and following security policies and regulations recognizing and reporting incidents © Members of the ISSeG Collaboration, 27 June 2007

Step 4 – Find The Countermeasures Step 3 gives a prioritized list of threats From threats, we can link to recommendations and best practices Step 3 also gives the list of controls that can be improved and have a high impact on the overall security From controls, we can also link to recommendations and best practices © Members of the ISSeG Collaboration, 27 June 2007