Planning and Managing Information Security Randall Sutton, President Elytra Enterprises Inc. April 4, 2006

Presented at the “Privacy & Security in Government Information” Seminar Ottawa April 4, 2005

w w w. e l y t r a. c o m Prevalent attitude towards Information Security (IS) at Senior Management level:  At best a perceived inconvenience  At worst a compliance nightmare, exacerbated by PRIVACY issues

w w w. e l y t r a. c o m  Reality: IS is just another business element to be factored into the cost of doing business Should be approached from the perspective that, handled properly, IS is a potential enabler for competitive advantage

w w w. e l y t r a. c o m  Intent of this presentation is to provide some guidelines for planning and managing IS

w w w. e l y t r a. c o m Outline  Key elements of the IS Management System  Statement of Sensitivity, or what corporate assets need to be protected?  Building the IS team  Determining the Scope of the Security Management System  Metrics and Objectives for IT Security and Web-based Applications

w w w. e l y t r a. c o m Key Elements for Managing IS  Policy  Planning and Preparation  Protection – Implementation of Safeguards  Contingency Planning: Incident Response Business Continuity  Compliance

w w w. e l y t r a. c o m Statement of Sensitivity (1)  Sensitive assets: Personnel Physical Information Although this presentation focuses on the information aspect, personal security and physical security should be looked at concurrently.

w w w. e l y t r a. c o m Statement of Sensitivity (2)  Degree of sensitivity: Confidentiality Availability Integrity

w w w. e l y t r a. c o m Building the IS Team  Largely dependent on the size of the enterprise  CSO (Corporate Security Officer) should be responsible for all 3 aspects of security, not just IT  CSO should possess the CISSP or CISM professional security qualification

w w w. e l y t r a. c o m Scope of the IS Managing System  Assess current level of risk Establish a baseline  Determine what can impact the risks List the threats  Determine how risk (human, physical plant, IT) can be reduced at acceptable cost ROSI (return on security investment)  Follow-up with: Security awareness training Testing for: incident response, business continuity

w w w. e l y t r a. c o m Risk Reduction – Technical Safeguards  Myth:Often portrayed as a discipline beyond rocket science – something the CEO could never relate to  Reality: Established standards, e.g. –MITS for the Canadian federal government –ISO for industry and much of Europe –NIST in the USA

w w w. e l y t r a. c o m Basic Technical Safeguards  Anti-virus and firewalls (personal + corporate) in place  Patching strategy in place  Router Access Control Lists (ACL’s) enforced  SSL Encryption on VPN’s and wherever else feasible In general, CONFIGURATION CONTROL

w w w. e l y t r a. c o m Further Safeguards  Intrusion detection systems  Intrusion prevention systems  Vulnerability Assessment Software  ESM (Enterprise Security Management) platform to manage all of the above  Third party “Penetration Testing” to probe for weaknesses in the infrastructure and applications

w w w. e l y t r a. c o m Security Metrics  Generally, asset-focused  Measure of: What defenses are in place * How many systems protected against a specific threat * “Defense in depth”, or layers of security, is the key to an effective security architecture.

w w w. e l y t r a. c o m Sources of Information  International Systems Security Engineering Association – Capability Maturity Model (SSE-CMM)  Institute for Security and Open Methodologies (ISECOM) – Security Metrics and RAVs (Risk Assessment Values)  The Open Web Application Security Project (OWASP)   NIST Special Publication (SP) , Security Metrics Guide for Information Technology Systems

w w w. e l y t r a. c o m Popular Metrics Tools  Microsoft Threat Scoring System  CERT Vulnerability Scoring  SANS Critical Vulnerability Analysis Scale Ratings  CVSS (Common Vulnerability Scoring System), an open framework

w w w. e l y t r a. c o m Advanced MetricsTools  Dashboards: Can be customized or configurable Basically a snapshot view of the enterprise’s state of security Includes metrics for monitoring security trends over time across the various applications

w w w. e l y t r a. c o m A practical example of a metric  SPAM Relatively easy to establish baseline on % of messaging traffic that is unwanted Many SPAM filters to choose from After filter application, remeasure Continue to fine-tune filter, reapply and remeasure Some slight risk that you will stop legitimate traffic – so reducing SPAM to zero is not necessarily the goal

Thank You Questions?