Developing Network Security Strategies Network Security D ESIGN Network Security M ECHANISMS

S ECURITY : DESIGN Factors -Affordances (E-Commerce) -Remote-Access Services -Business partners Top-Down Approach -Customer development

S ECURITY : DESIGN Identify network assets. Analyze security risks. Analyze security requirements and tradeoffs. Develop a security plan. Define a security policy. Develop procedures for applying security policies. Develop a technical implementation strategy. Achieve buy-in from users, managers, and technical staff. Train users, managers, and technical staff. Implement the technical strategy and security procedures. Test the security and update it if any problems are found. Maintain security.

S ECURITY : DESIGN Identify network assets. Analyze security risks. Analyze security requirements and tradeoffs. Develop a security plan. Define a security policy. Develop procedures for applying security policies. Develop a technical implementation strategy. Achieve buy-in from users, managers, and technical staff. Train users, managers, and technical staff. Implement the technical strategy and security procedures. Test the security and update it if any problems are found. Maintain security.

Identify network assets Network Hosts OS Applications Data Internetworking Devices Routers Switches Network Data Other Trade Secrets Company Reputation

S ECURITY : DESIGN Identify network assets. Analyze security risks. Analyze security requirements and tradeoffs. Develop a security plan. Define a security policy. Develop procedures for applying security policies. Develop a technical implementation strategy. Achieve buy-in from users, managers, and technical staff. Train users, managers, and technical staff. Implement the technical strategy and security procedures. Test the security and update it if any problems are found. Maintain security.

Analyze security risks E XPERT I NTRUDERS ANDE ND U SERS

S ECURITY : DESIGN Identify network assets. Analyze security risks. Analyze security requirements and tradeoffs. Develop a security plan. Define a security policy. Develop procedures for applying security policies. Develop a technical implementation strategy. Achieve buy-in from users, managers, and technical staff. Train users, managers, and technical staff. Implement the technical strategy and security procedures. Test the security and update it if any problems are found. Maintain security.

Analyze security requirements and tradeoffs Affordability Usability Performance Availability Manageability Tradeoffs Packet Filters/Data Encryption

S ECURITY : DESIGN Identify network assets. Analyze security risks. Analyze security requirements and tradeoffs. Develop a security plan. Define a security policy. Develop procedures for applying security policies. Develop a technical implementation strategy. Achieve buy-in from users, managers, and technical staff. Train users, managers, and technical staff. Implement the technical strategy and security procedures. Test the security and update it if any problems are found. Maintain security.

Develop a security plan Resources (time/people) How will users/managers be involved? Is there a need for specialized Administrators? Will you be training on Security Policies and Procedures?

S ECURITY : DESIGN Identify network assets. Analyze security risks. Analyze security requirements and tradeoffs. Develop a security plan. Define a security policy. Develop procedures for applying security policies. Develop a technical implementation strategy. Achieve buy-in from users, managers, and technical staff. Train users, managers, and technical staff. Implement the technical strategy and security procedures. Test the security and update it if any problems are found. Maintain security.

Define a security policy According to RFC 2196, "Site Security Handbook:" “A security policy is a formal statement of the rules by which people who are given access to an organization's technology and information assets must abide.” Personnel Components Access Accountability Authentication Computer-technology guidelines

S ECURITY : DESIGN Identify network assets. Analyze security risks. Analyze security requirements and tradeoffs. Develop a security plan. Define a security policy. Develop procedures for applying security policies. Develop a technical implementation strategy. Achieve buy-in from users, managers, and technical staff. Train users, managers, and technical staff. Implement the technical strategy and security procedures. Test the security and update it if any problems are found. Maintain security.

Develop procedures for applying security policies There’s been an attack… OMG!!!!! Separate Procedures Users Network Admin Security Admin Training?

S ECURITY : DESIGN Identify network assets. Analyze security risks. Analyze security requirements and tradeoffs. Develop a security plan. Define a security policy. Develop procedures for applying security policies. Develop a technical implementation strategy. Achieve buy-in from users, managers, and technical staff. Train users, managers, and technical staff. Implement the technical strategy and security procedures. Test the security and update it if any problems are found. Maintain security.

S ECURITY : DESIGN Identify network assets. Analyze security risks. Analyze security requirements and tradeoffs. Develop a security plan. Define a security policy. Develop procedures for applying security policies. Develop a technical implementation strategy. Achieve buy-in from users, managers, and technical staff. Train users, managers, and technical staff. Implement the technical strategy and security procedures. Test the security and update it if any problems are found. Maintain security.

S ECURITY : DESIGN Identify network assets. Analyze security risks. Analyze security requirements and tradeoffs. Develop a security plan. Define a security policy. Develop procedures for applying security policies. Develop a technical implementation strategy. Achieve buy-in from users, managers, and technical staff. Train users, managers, and technical staff. Implement the technical strategy and security procedures. Test the security and update it if any problems are found. Maintain security.

S ECURITY : DESIGN Identify network assets. Analyze security risks. Analyze security requirements and tradeoffs. Develop a security plan. Define a security policy. Develop procedures for applying security policies. Develop a technical implementation strategy. Achieve buy-in from users, managers, and technical staff. Train users, managers, and technical staff. Implement the technical strategy and security procedures. Test the security and update it if any problems are found. Maintain security.

S ECURITY : DESIGN Identify network assets. Analyze security risks. Analyze security requirements and tradeoffs. Develop a security plan. Define a security policy. Develop procedures for applying security policies. Develop a technical implementation strategy. Achieve buy-in from users, managers, and technical staff. Train users, managers, and technical staff. Implement the technical strategy and security procedures. Test the security and update it if any problems are found. Maintain security.

S ECURITY : DESIGN Identify network assets. Analyze security risks. Analyze security requirements and tradeoffs. Develop a security plan. Define a security policy. Develop procedures for applying security policies. Develop a technical implementation strategy. Achieve buy-in from users, managers, and technical staff. Train users, managers, and technical staff. Implement the technical strategy and security procedures. Test the security and update it if any problems are found. Maintain security.

Maintain security Reading Logs Responding to incidents Staying current with security standards (hardware/software) Updating the plan and policy

S ECURITY : M ECHANISMS Physical Security Authentication Authorization Accounting/Auditing Data Encryption Packet Filters Firewalls Intrusion Detection Intrusion Prevention

S ECURITY : M ECHANISMS Physical Security Authentication Authorization Accounting/Auditing Data Encryption Packet Filters Firewalls Intrusion Detection Intrusion Prevention Equipment Natural Disasters

S ECURITY : M ECHANISMS Physical Security Authentication Authorization Accounting/Auditing Data Encryption Packet Filters Firewalls Intrusion Detection Intrusion Prevention Something the user knows Something the user has Something the user is

S ECURITY : M ECHANISMS Physical Security Authentication Authorization Accounting/Auditing Data Encryption Packet Filters Firewalls Intrusion Detection Intrusion Prevention Privileges

S ECURITY : M ECHANISMS Physical Security Authentication Authorization Accounting/Auditing Data Encryption Packet Filters Firewalls Intrusion Detection Intrusion Prevention Logging tasks

S ECURITY : M ECHANISMS Physical Security Authentication Authorization Accounting/Auditing Data Encryption Packet Filters Firewalls Intrusion Detection Intrusion Prevention Yeah yeah yeah…

S ECURITY : M ECHANISMS Physical Security Authentication Authorization Accounting/Auditing Data Encryption Packet Filters Firewalls Intrusion Detection Intrusion Prevention Uses Authentication and Authorization methods

S ECURITY : M ECHANISMS Physical Security Authentication Authorization Accounting/Auditing Data Encryption Packet Filters Firewalls Intrusion Detection Intrusion Prevention Enforce Enterprise to Internet

S ECURITY : M ECHANISMS Physical Security Authentication Authorization Accounting/Auditing Data Encryption Packet Filters Firewalls Intrusion Detection Intrusion Prevention (IDS) Notification (IPS) Traffic Blocker

S WEET A CTING