Download presentation
Presentation is loading. Please wait.
1
CISSP Guide to Security Essentials
Operations Security CISSP Guide to Security Essentials Chapter 7
2
Objectives Applying security concepts to computer and business operations Records management security controls Backups Anti-virus software and other anti-malware controls
3
Objectives (cont.) Remote access
Administrative management and control of information security Resource protection Incident management
4
Objectives (cont.) High availability architectures
Vulnerability management Change management and configuration management Operations attacks and countermeasures
5
Applying Security Operations Concepts
6
Security Operations Concepts
Need to know Least privilege Separation of duties Job rotation Monitoring of special privileges
7
Security Operations Concepts (cont.)
Records management controls Backups Anti-virus and anti-malware Remote access
8
Flow of Control From chapter 1 Policy Guidelines Processes Procedures
Recordkeeping
9
Need to Know Individual personnel should have access to only the information that they require in order to perform their stated duties Independent of security clearance This reduces risk, but can be an administrative burden
10
Least Privilege Users should have the fewest or lowest number of privileges required to accomplish their duties Independent of security clearance
11
Separation of Duties High-value or high-risk tasks require two or more different individuals to complete Examples Open a bank vault Issue an arrest warrant Provision a privileged-access computer account Change a firewall rule
12
Job Rotation Move individual workers through a range of job assignments Reduces monotony, risk Reduces likelihood that employees will perform inappropriate or illegal actions if they fear being caught when next job rotation occurs
13
Monitoring of Special Privileges
Privileged users have more power Mistakes have greater impact Record activities Network administrator System administrator Database administrator Application administrator
14
Records Management Controls
Data classification Access management Records retention Backups Data destruction
15
Data Classification Establish sensitivity levels
Establish handling procedures for each level Creation, storage, transmittal, destruction
16
Access Management Policies, procedures, and controls that determine how information is accessed and by whom User account provisioning Privilege management Password management Review of access rights Secure log on
17
Records Retention Policies that specify how long different types of records must be retained (minimums and maximums) Manage risks related to business records Risk of compromise of sensitive information Risk of loss of important information E-Discovery Regulation
18
Backups Protection against loss due to malfunctions, failures, mistakes, and disasters Activities Data restoration Protection of backup media Off-site storage of backup media
19
Data Restoration Periodic testing to ensure that data that is backed up can be restored Same computer Different computer Best way to prove that backups are being performed properly
20
Protection of Backup Media
Backup media contains sensitive information Requires same level of control as original information Keep in locked cabinets Least privilege and need to know
21
Offsite Storage of Backup Media
Reduce risk of loss of backup media in the event of a disaster that destroys data center Fire, flood, sabotage Factors Distance from business location Security of transportation Security of storage center Resilience of storage center against disasters
22
Data Destruction Purpose: ensure that discarded information is truly destroyed and not salvageable by either employees or outsiders
23
Data Destruction (cont.)
Once information has reached the end of its need, its destruction needs to be carried out in a manner that is proportional to its sensitivity Degaussing Shredding Wiping
24
Anti-virus and Anti-malware
Effects of uncontrolled malware Loss of business information Disclosure or compromise of business information Corruption of business information Disruption of business information processing Inability to access business information Loss of productivity Apply defense in depth to protect assets Central anti-malware management
25
Remote Access Connectivity to a network or system from a location away from the network or system, usually from a location apart from the organization’s premises Usually through a VPN
26
Remote Access (cont.) Improves productivity by permitting employees to access business information from any location Risk mitigation Encryption, strong authentication, anti-malware, firewall
27
iClicker Questions
28
Which security operation concept does "User Account Control" implement?
Need to know Least privilege Separation of duties Anti-virus and anti-malware Remote access
29
What security concept makes confidential information less likely to leak out, but can make normal business slow and complex? Need to know Least privilege Separation of duties Job rotation Monitoring of special privileges
30
Which security concept includes labeling files as "confidential" or "unclassified"?
Need to know Least privilege Monitoring of special privileges Records management controls Backups
31
When an administrator shuts down a server, this box appears, asking why the server is being shut down. Which security principle does this implement? Need to know Least privilege Separation of duties Job rotation Monitoring of special privileges
32
Administrative Management and Control
33
ISO 27001 Widely accepted model for top-down security management
Define scope and boundaries Establish a security policy Risk assessments Establish control objectives and activities Security awareness and training Allocate resources Internal audits Monitor and review the security program Enact continual improvement
34
Types of Controls Technical Physical Administrative
Such as firewalls and antivirus software Physical Locks, guards, etc. Administrative Such as policies and audits See link Ch 7a for a good discussion, and link CISSP 12 for good whitepapers on all ten CISSP domains
35
Categories of Controls
Detective Deterrent Preventive Corrective Recovery Compensating
36
Employing Resource Protection
37
Resource Protection Facilities Water and sewage Electricity
Fire alarms and suppression Environmental controls Communications Security controls
38
Resource Protection (cont.)
Hardware Servers Workstations Network devices Wireless networks Printers, copiers Cabling
39
Resource Protection (cont.)
Software requires control and management Licensing Access control Source code (preventing disclosure) Intellectual property Security Source code control Software development lifecycle
40
Resource Protection (cont.)
Documentation May contain trade secrets and sensitive information Processes, procedures, and instructions Version control Access control
41
Incident Management
42
Incident An Incident is A Security Incident is
An unexpected event that results in an interruption of normal operations A Security Incident is An event in which security policy has been violated OR Unauthorized access to a system or information An event that prevents legitimate access to a system or information
43
Incident Management Incident declaration Triage Investigation Analysis
Containment Recovery Debriefing See chapter 6 for details
44
High Availability Architectures
45
Fault Tolerance Makes devices less prone to failure
Multiple power supplies Multiple network interfaces Multiple processor units RAID (Redundant Array of Inexpensive / Independent Disks)
46
Clustering A group of two or more servers that operate functionally as a single logical server Active-active mode Active-passive mode Failover: when active status is transferred Geo-cluster – servers located at great distances from one another
47
Replication Data changes are transmitted to a counterpart storage system An adjunct to clustering, makes current data available to all cluster nodes
48
Business Continuity Management
A management activity where analysis is performed to better understand the risks associated with potential disaster scenarios, and the steps that can be taken to reduce the impact of a disaster should one occur
49
Vulnerability Management
50
Vulnerability Management
Penetration testing Application scanning Patch management Code reviews
51
Penetration Testing A scan of many or all TCP / IP “ports” on one or more target systems Followed by locating and exploiting vulnerabilities Mimics the actions of a hacker who scans a system or network for active, exploitable ports and services
52
Application Scanning The process of performing security tests on an application (usually, but not always, a web-based application) in order to find vulnerabilities in the application code itself
53
The ‘new’ OWASP Top Ten (2010 rc1)
This is the new proposed Top 10 list. The items in Red are new. Some of the existing items moved around.
54
Code Reviews Manual and automated inspections of software source code
Examine and validate approved changes Detection of inappropriate changes, unsafe code, security issues
55
Patch Management The process – usually assisted with management tools – to manage the installation of patches on target systems Reduces risks associated with malware, hacking attacks that exploit weaknesses Don't just put on all available patches Analyze and test them first and only put on the ones that pass a risk analysis
56
Change Management
57
Change Management Prepare the change Circulate and review the change
Discuss and agree to the change Perform the change Recordkeeping
58
Configuration Management
59
Configuration Management
Configuration of hardware, software components Configuration management database (CMDB) Automated tools
60
Operations Attacks and Countermeasures
61
Attacks on Operations Social engineering Sabotage
Theft and Disappearance Extortion Bypass Circumventing security measures Denial of service
62
iClicker Questions
63
The Army banned all use of USB flash drives
The Army banned all use of USB flash drives. What category of control was this? Technical Physical Administrative Detective Corrective
64
What type of control is a burglar alarm?
Detective Deterrent Preventive Corrective Recovery
65
After a security incident is declared, a security officer interviews employees in the affected department to quickly identify clues that may help understand what happened. Which process is being performed? Triage Investigation Analysis Containment Recovery
66
A data entry worker threatened to post confidential medical records on the Internet and demanded money. What sort of attack was that? Social engineering Sabotage Theft and Disappearance Extortion Bypass
67
This license plate is intended to protect the driver from automated ticketing cameras. What vulnerability would make this possible? Injection XSS CSRF Insecure cryptography Unvalidated redirects
Similar presentations
© 2024 SlidePlayer.com Inc.
All rights reserved.