I MPLEMENTING IT S ECURITY FOR S MALL AND M EDIUM E NTERPRISES Short Presentation by Subhash Uppalapati. - Edgar R. Weippl and Markus Klemen

I NTRODUCTION Small and Medium Enterprises(SMEs) < 400 employees Fewer Resources and less expertise in IT security Limited Know-how regarding IT security

F OUR L EVELS OF S ECURITY IN SME S

A P RAGMATIC A PPROACH FOR SME S Aspect 1: Inspection Aspect 2: Protection Aspect 3: Detection Aspect 4: Reaction Aspect 5: Reflection

A SPECT 1: I NSPECTION Inspection: “ To determine which key processes and corporate functions are essential, the capabilities they require and their interaction with one another ”. This aspect consists of five steps: 1.Resource inventory Thorough inventory of company’s resources and assets. 2.Threat assessment Identifies what threatens the identified assets. Threats categories (human error, natural disasters, system failures, malicious acts, and collateral damage)

A SPECT 1: I NSPECTION ( CONTD …) 3.Loss analysis Potential angles to focus are theft of resources, deletion of information, theft of information, disclosure of information, corruption of information etc. 4. Identification of vulnerabilities Where are weaknesses in the company? These might be technical(security design flaws) or organizational weakness(e.g., social engineering). 5. Assignment of safeguards Avoidance, mitigation, transference or acceptance 6. Evaluation of current status After the above five steps, re-assess and test.

A SPECT 2: P ROTECTION Protection: “ The objects that need protection, the required level of protection, and how to reach this level by creating a comprehensive security design ”. This aspect consists of five steps: 1.Awareness Awareness training for 1 or 2 hours once in a year 2. Access Physical + logical

A SPECT 2: P ROTECTION ( CONTD …) 3.Authentication and Authorization Using existing access control technologies like Kerberos, Active directory 4.Availability Lack of redundant server systems lead to developing and updating outage emergency plans. 5.Confidentiality Information is the important asset.

A SPECT 3: D ETECTION Detection: “ Process that intend to minimize the losses from a security incident that could interrupt the core business processes ”. This aspect consists of three steps: 1.Classify intruder types Who is likely to attack from outside? How tough is the competition in the branch? 2.Enumerate intrusion methods Most probable intrusion methods and the corresponding process Requires highly know-how of intrusion detection and recommends consulting specialists.

A SPECT 3: D ETECTION ( CONTD …) 3.Assess intrusion detection methods Logging, Simple Network Management Protocol(SNMP)

A SPECT 4: R EACTION Reaction: “ How to respond to security incidents. It must define the process of reacting to certain threat scenarios ”. This aspect consists of three steps. 1.Develop response plan Guidelines on how to proceed in case of emergency 2.Assessing the damage Administrator should thoroughly assess the damage before starting the recovery procedures.

A SPECT 4: R EACTION ( CONTD …) 3.Incident recovery procedures Recovery procedures should be defined, management- approved, and tested.

A SPECT 5: R EFLECTION Reflection: “ After security incidents are handled, follow- up steps should be taken to put incidents behind and continue normal operations ”. Only one main step 1. Incident documentation and evaluation Incident should be documented properly and discussed with partners and colleagues. Incident response should be evaluated and if improvements are necessary, should be added to the IR plan.

M AIN COMMUNICATION PATH FOR IT SECURITY - RELATED ISSUES IN SME S Stakeholders 1. Decision maker 2. IT administrator 3. User 4. External consultants

IT ADMINISTRATOR Responsibilities like changing printer toner, assigning and modifying user rights in operating systems, setting up and maintaining internet connections etc. Can neglect security with so many responsibilities Recognizes the impact once the company has been hit by a serious incident. Three scenarios of the amount of IT personnel resource 1. No dedicated administrator 2. One dedicated administrator 3. More than one dedicated administrator

IT USER Believe it or not 77% of information theft is caused by company employees(Cox, 2001) Not appropriate – restrictions on web surfing, private ing, or individual desktop settings Apply restrictions with care and communicate the reason Gain the employee understanding and support

W ORKFLOW L EVEL

W ORKFLOW L EVEL ( CONTD …)

I NFORMATION L EVEL

Thank you