1. Security Management Models
INFORMATION SECURITY MANAGEMENT
Lecture 6:
Security Management Models
You got to be careful if you don’t know where you’re going,
because you might not get there. – Yogi Berra

2. Access Control Models Access controls Key principles of access control
Regulate the admission of users into trusted areas of the organization
Key principles of access control
Least privilege
Need to Know
Separation of Duties

3. How to measure the value of information - CIA Triangle
The value of information comes from the characteristics it possesses
Expanded to
include
Identification
Authentication
Authorization
Privacy
Accountability

4. Privacy
Information collected, used, and stored by an organization is to be used only for the purposes stated to the data owner at the time it was collected
Privacy as a characteristic of information does not signify freedom from observation
Means that information will be used only in ways known to the person providing it

5. Accountability
Exists when a control provides assurance that every activity undertaken can be attributed to a named person or automated process

6. Identification and Authentication
An information system possesses the characteristic of identification when it is able to recognize individual users
Identification and authentication are essential to establishing the level of access or authorization that an individual is granted
Authentication
Occurs when a control proves that a user possesses the identity that he or she claims

7. Authorization
Assures that the user has been specifically and explicitly authorized by the proper authority to access, update, or delete the contents of an information asset Authorization occurs after authentication

8. Controlling Access

9. Identification and Authentication
Identification: unproven assertion of identity
“My name is…”
Userid
Authentication: proven assertion of identity
Userid and password
Userid and PIN
Biometric

10. Authentication Methods
What the user knows
What the user has
What the user is

11. How Information Systems Authenticate Users
Request userid and password
Hash password
Retrieve stored userid and hashed password
Compare
Make a function call to a network based authentication service

12. How a System Stores Userids and Passwords
Typically stored in a database table
Application database or authentication database
Userid stored in plaintext
Password stored encrypted or hashed

13. Password Hashes LM hash is weak, no longer used in Win 7
NT hash is stronger, but not salted

14. Strong Authentication
Traditional userid + password authentication has known weaknesses
Stronger types of authentication available, usually referred to as “strong authentication”

15. Token: Two Factor Authentication
First factor: what user knows
Second factor: what user has
Without the second factor, user cannot log in

16. Token: Two Factor Authentication

17. Biometric Authentication
Stronger than userid + password
Stronger than two-factor?
Can be hacked

18. Authentication Issues
Password quality
Consistency of user credentials across multiple environments
Too many userids and passwords
Handling password resets
Dealing with compromised passwords
Staff terminations

19. Categories of Access Control

20. Categories of Access Control
Preventative
Deterrent
Detective
Corrective
Recovery
Compensating

21. Preventive Controls Block or control specific events Firewalls
Anti-virus software
Encryption
Key card systems
Bollards stop cars (as shown)

22. Deterrent/Detective Controls
Deterrent Controls
Highly visible
Prevent offenses by influencing choices of would-be intruders
Detective Controls
Monitor and record specific types of events
Does not stop or directly influence events

23. Corrective/Recovery Controls
Corrective Controls
Post-event controls to prevent recurrence
“Corrective” refers to when it is implemented
Examples (if implemented after an incident)
Spam filter
Anti-virus on server
WPA Wi-Fi encryption
Recovery Control
Post-incident controls to recover systems

24. Compensating Controls
Control that is introduced that compensates for the absence or failure of a control
“Compensating” refers to why it is implemented
Examples
Daily monitoring of anti-virus console
Monthly review of administrative logins
Web Application Firewall used to protect buggy application

25. Another Approach: Types of Controls
Technical
Operational (aka Physical)
Management (aka Administrative)

26. Another Approach: Degree of Authority
Mandatory Access Controls
Discretionary Access Controls
Role Based Access Controls

27. Mandatory Access Control (MAC) Security Model
Data classification scheme
Rates collection of info and user with sensitivity levels
When implemented, users and data owners have limited control over access

28. Mandatory Access Control (MAC) Security Model
Data classification scheme/model
Data owners classify the information assets
Reviews periodically
Security clearance structure
Each user assigned an authorization level
Roles and corresponding security clearances

29. Discretionary Access Control (DAC) Security Model
The owner of an object controls who and what may access it.
Access is at the owner’s discretion.
Most personal computer operating systems are designed based on the DAC model

30. Role-based Access Control (RBAC) Security Model
Nondiscretionary Controls
An improvement over the mandatory access control (MAC) security model
Role-based controls
Task-based controls
Simplifies management in a complex system with many users and objects

31. Access Control Technologies

32. Testing Access Controls

33. Testing Access Controls
Access controls are the primary defense that protect assets
Types of tests:
Penetration tests
Application vulnerability tests
Code reviews

34. Penetration Testing Automatic scans to discover vulnerabilities
Example tools: Nessus, Nikto, SAINT, Superscan, Retina, ISS, Microsoft Baseline Security Analyzer

35. Application Vulnerability Testing
Discover vulnerabilities in an application
Automated tools and manual tools
Example vulnerabilities
Cross-site scripting, injection flaws, malicious file execution, broken authentication, broken session management, information leakage, insecure use of encryption, and many more

36. Audit Log Analysis Regular examination of audit and event logs
Detect unwanted events
Audit log protection

37. Access Control Attacks

38. Access Control Attacks
Intruders will try to defeat, bypass, or trick access controls in order to reach their target
Attack objectives
Guess credentials
Malfunction of access controls
Bypass access controls
Replay known good logins
Trick people into giving up credentials

39. Buffer Overflow Cause malfunction in a way that permits illicit access
Send more data than application was designed to handle properly
Countermeasure: “safe” coding that limits length of input data; filter input data to remove unsafe characters

40. Script Injection
Insertion of scripting language characters into application input fields
Execute script on server side
Execute script on client side – trick user or browser
Countermeasures: strip “unsafe” characters from input

41. Data Remanence
Literally: data that remains after it has been “deleted”
Examples
Deleted hard drive files
Erased files
Discarded / lost media: USB keys, backup tapes, CDs
Countermeasures: improve media physical controls (e.g. post Wikileaks controls)

42. Denial of Service (DoS)
Actions that cause target system to fail, thereby denying service to legitimate users
Distributed Denial of Service (DDoS)
Countermeasures: input filters, patches, high capacity

43. Eavesdropping Interception of data transmissions Methods
Countermeasures: encryption, stronger encryption

44. Spoofing and Masquerading
Specially crafted network packets that contain forged address of origin
Countermeasures: router / firewall configuration to drop forged packets, judicious use of for signaling or data transfer

45. Social Engineering
Tricking people into giving out sensitive information by making them think they are helping someone
Methods
Schemes
Countermeasures: security awareness training

46. Phishing
Incoming, fraudulent messages designed to give the appearance of origin from a legitimate institution
Tricks user into providing sensitive data via a forged web site (common) or return (less common)
Countermeasure: security awareness training

47. Pharming Redirection of traffic to a forged website
Countermeasures: user awareness training, patches, better controls

48. Malicious Code Viruses, worms, Trojan horses, spyware, key logger
Harvest data or cause system malfunction
Countermeasures: anti-virus, anti-spyware, security awareness training

49. Security Architecture Models

50. Security Architecture Models
Can help organizations quickly make improvements through adaptation
Can focus on:
computer hardware and software
policies and practices
the confidentiality of information
the integrity of the information
Pick one and go with it

51. Bell-LaPadula Confidentiality Model
A state machine model that helps ensure the confidentiality of an information system
Using mandatory access controls (MACs), data classification, and security clearances

52. Biba Integrity Model
Provides access controls to ensure that objects or subjects cannot have less integrity as a result of read/write operations
Ensures no information from a subject can be passed on to an object in a higher security level
This prevents contaminating data of higher integrity with data of lower integrity

53. Clark-Wilson Integrity Model
Built upon principles of change control rather than integrity levels
Its change control principles
No changes by unauthorized subjects
No unauthorized changes by authorized subjects
The maintenance of internal and external consistency

54. Graham-Denning Access Control Model
Composed of three parts
A set of objects
A set of subjects (a process and a domain)
A set of rights
Primitive protection rights
Create or delete object, create or delete subject
Read, grant, transfer and delete access rights

55. Harrison-Ruzzo-Ullman Model
Defines a method to allow changes to access rights and the addition and removal of subjects and objects
Since systems change over time, their protective states need to change
Built on an access control matrix
Includes a set of generic rights and a specific set of commands

56. Brewer-Nash Model (aka Chinese Wall)
Designed to prevent a conflict of interest between two parties
Requires users to select one of two conflicting sets of data, after which they cannot access the conflicting data

57. The ISO Series
Information Technology – Code of Practice for Information Security Management
One of the most widely referenced and discussed security models
Originally published as British Standard 7799 and then later as ISO/IEC 17799
Since been renamed ISO/IEC 27002
Establishes guidelines for initiating, implementing, maintaining, and improving information security management

58. The ISO 27000 Series (cont’d.)

59. Control Objectives for Information and Related Technology (COBIT)
Provides advice about the implementation of sound controls and control objectives for InfoSec
Created by the Information Systems Audit and Control Association (ISACA) and the IT Governance Institute (ITGI) in 1992

60. COSO A U.S. private-sector initiative
Major Objective: identify factors that cause fraudulent financial reporting and to make recommendations to reduce its incidence
Has established a common definition of internal controls, standards and criteria
Helps organizations comply with critical regulations like Sarbanes-Oxley

61. COSO (cont’d.) Built on five interrelated components:
Control environment
Risk assessment
Control activities
Information and communication
Monitoring