chapter7Notes

Key Terms Acceptable Behavior – The level of behavior that an organization will tolerate Access Privileges – They are controls granted to users of the system Accountabilities – Information assurance and security performance for all responsible parties Authorization – When a person is given access to acquire specific items of information Awareness – To make sure that the users are knowledgeable about the policies and procedures of an organization Behavior – Human factor involvement Boundaries – It is the perimeter of a secure space Clearance Level – The specification of trust level that must be given to the position Contractor and Outsourced Work – Work performed by a third party Disciplined Practice – Every organization must monitor to make sure that policies are implemented Documentation Process – It is a process that an organization can establish and execute a repeatable set of actions Friendly Termination – When an employee leaves the organization on mutually agreeable terms Individual Accountability – Everyone should be held responsible for his or her actions Least Privilege - Restricting a user’s access to the minimum level of access needed to perform his or her job Misuse – User takes advantage of the access controls granted by an organization Motivation – Encouraging users to be aware of the information security rules Noncompliance – Users not following acceptable usage policy Personal Screening – It is employed where the information is considered sensitive enough that controls cannot assure security Personal Security – Security process for an individual user Procedure Manual – A manual that documents the actions required for ensuring personnel security Reviews of User Accounts – They are necessary to monitor and manage user accounts Secure Space – It is an area of known control Security Strategy – Plan of action to protect the information Sensitivity – It is the level of trust and access required for every position Separation of Duties – The single task is distributed among number of individuals Software-Enabled Monitoring –It is a countermeasure that monitors activities through software Unauthorized or Illegal Activity – Activity performed by a person who does not have proper authorization Unfriendly Terminations – When an employee leaves an organization under unfavorable terms User Account Management – It establishes the policies and procedures to identify, authenticate, and authorize individual access to the system and information assets   Lecture Outline First Steps First Origination of Threats Outsider – threats posed by attacks from outside the organization Insider – threats posed by attacks by employees within the organization Access and Security Control: Establishing Secure Space Secure space are perimeter boundaries Secure space implies that approved control has been established to ensure the confidentiality, integrity and availability of the information assets In a secure space, privileges should be assigned specifically to ensure appropriate behavior Access to secure physical space is controlled by restriction mechanisms that force all individuals seek­ing access to be cleared at a checkpoint Access to humans also includes cyberspace, thus set of rules must be defined and enforced on people to gain access to secure space Ensuring Continuous Practice The assurance process must ensure continuous and disciplined execution of all security tasks The requirement for disciplined practiceimplies that attention must be paid to motivation Ensuring Personnel Security Behavior Routine Activities They are actions that an individual takes to secure the space that they control from any threats arising during everyday work Operational Functions They are the activities that are performed to ensure the security of the entire system during day-to-day operation Management Responsibilities The security operation must be managed properly to be effective Documenting Security Procedures Documentation ensures that security activities are recorded and properly understood by employees within the organization Personnel security manual specifies the actions required for ensuring personnel security The organization must ensure that all information assurance activities, or security management procedures, are performed satisfactorily in the employees’ daily routine A procedure manual also documents the corrective actions to be taken if a problem occurs Every documented procedure should specify the Required steps to be taken and by whom Expected outcomes and some way to determine that they have been achieved Interfaces with other security procedures Assignment of Individual Responsibility Specific accountability for security duties must be delegated in writing to each individual involved with the cre­ation, handling, or use of information assets It hinges on the development of a set of rules. These are called rules of behavior Rules of Behavior Rules of behavior include all the information assurance and security requirements for individuals who use the system as well as the people it serves The rules have to be rigorous enough to ensure security, while giving each user the flexibility to perform their jobs properly Rules of behavior should define the organizationally sanctioned response to such concerns as: Individual accountability Assignment and limitation of system privileges Networking and use of the Internet Rules should be enforced The Role of Awareness and Training Training is an effective countermeasure, which ensures that users are well versed in the system’s technical and procedural controls The importance of information assurance has to be reinforced Some awareness or training activity for users should be focused on making all employees part of the information assurance solution The goal of an awareness or train­ing program is to ensure an acceptable level of knowledge about information assurance practice for all people who work in the secured space Planning: Ensuring Reliable Control over Personnel Strategies must ensure that all aspects of personnel behavior that threaten security are anticipated and controlled Control Principles Individual Accountability Everyone should be held responsible for his or her actions The process of identifying and authenticating users of the system and subsequently monitoring their activities is the mechanism by which individual accountability is assigned and ensured Least Privilege It describes the principle of restricting a user’s access to the minimum level of access needed to perform his or her job Privileges for each user category are established by the access control policy and controlled by the system The assignment of privileges is contingent on knowing the access requirements for each job type and individual Separation of Duties It entails the distribution of the actions to perform a single function among a number of individuals The separations prevent a single individual from controlling a critical process Personnel Screening They are employed where the information is considered sensitive enough that controls cannot assure security Screening is labor intensive Planning for Personnel Assurance Personnel security planning should be part of the overall strategic planning function The cost of establishing and maintaining control has to be balanced against the risk Security and the Human Resources Function Job Definition It allows the organization to embed a set of information assurance and security requirements into the standard task requirements for the position The degree of authority and responsibility for each position is determined The authority for a position determines the access rights and the level of trust required for every individual holding that position Type of sensitivity and associated level of access required for the work are documented Assignment of Required Trust The specification of trust requirements for each position is determined Specify the sensitivityrequirements for every position The specification of sensitivity levels for each position is based on factors such as the type and criticality of information handled by that position, as well as traditional criteria such as managerial level and fiduciary responsibilities within the organization Information assurance and security controls should be assigned to regulate each position Background Screening and Hiring It helps the organization confirm that prospective employees fit the information assurance criteria for a given position Besides criminal history, background checks can include: Work history Credit history Educational history Interview or psychographic data Any public evidence of addictive behavior, such as hospitalizations The position supervisor should not be involved in the screening process Employee Awareness Training and Education It is important to provide information assurance and security awareness and training to newly hired employee The lack of knowledge of policy and procedure is one of the primary causes of breakdowns in personnel security United States Government Training Standards The PL 100-235 Act required computer security awareness training for all Federal employees PL 107-347 Act established Federal Information Security Management Act (FISMA) National Centers of Academic Excellence in Information Assurance Education (CAE/IAE) fosters the development of academically based education and research based programs for the field of informa­tion assurance FISMA It requires certain government personnel categories to obtain professional qualifications appro­priate to their role or function, including both training and experience NIST Standards The National Institute of Standards and Technology (NIST) has developed several standards to guide personnel training programs, as follows: SP 500-172 Computer Security Training Guidelines, November 1989 — Super­seded by SP 800-16 — These specify a basic set of security principles and topics for federal government applications. SP 800-16 Information Technology Security Training Requirements: A Role and Performance-Based Model (supersedes NIST Spec. Pub. 500-172). This updated SP 500-172 and shares components and a common body of knowledge with CNSS standards. Special Publication 800-53, Recommended Security Controls for Federal Infor­mation Systems. This is still a draft publication but its aim is to specify a mini­mum set of concrete controls for information security applications. Knowledge of the purpose and application of these controls could serve as the basis for additional professional certification. CNSS Training Standards The Committee for National Security System (CNSS) – was established to provide a forum for the discussion of policy issues, set national policy, and promulgate direction, operational procedures, and guidance for the security of national security systems DHS and NSA Academic Certification The Department of Homeland Security (DHS) and National Security Agency (NSA) sponsor a program to certify that the curricula of academic institutions meet required standards The program is called the National Information Assurance Education and Training Program (NIETP) Private Sector Security Certification Standards Certifications such as the Informa­tion Systems Audit and Control Association (ISACA) and the International Informa­tion Systems Security Certification Consortium [(ISC)2] are becoming popular for training professionals Assigning Value to Certification The following are some of the decision criteria that would help provide an accurate picture of the value of a certification: How long has the certification been in existence? Does the certifying organization’s process conform to established standards? Is the organization ISO/IEC 17024 certified? How many people hold the certification? How widely respected is the certification? Does the certificate span industry boundaries? What is the probability that 5 or 10 years from now, the certificate will still be useful? Does the certification span geographic boundaries? Controlling Access of Employees and Contractors to Restricted Information Personnel security process must ensure that user access is properly defined and controlled The following six factors determine the shape and outcome of that process: User account management Audit and management review procedures Detection of and response to unauthorized activities Friendly termination Unfriendly termination Knowing your contractors User Account Management It encompasses the following: Establish, issue, and close the accounts of individual employees Track employee access behavior Track individual employee access authorizations Manage the employee access control operation User Account Audit and Management Review Use of the accounts has to be monitored through review of user accounts These reviews should verify five user characteristics: Level(s) of access for each individual employee are appropriate to assigned level of privilege for each application Level(s) of access assigned conform with the concept of least privilege Accounts assigned to an employee are active and appropriate to the employee’s job function Management authorizations are up to date Required training has been completed Detecting Unauthorized/Illegal Activities Policies must establish a clear understanding of what constitutes an unauthorized or illegal use Countermeasures employed to detect illegal activities are frequently based on software-enabled monitoringfunctions Direct auditing of system logs and procedural analysis using audit trails are utilized to detect fraudulent actions Friendly Termination The only purpose of a friendly termination procedure is to ensure that user account privileges are removed from the system in a timely manner. This includes: Removal of access privileges, computer accounts, authentication tokens Assurance of the continued integrity and availability of data in accounts that each access privilege was granted for Briefing on the continuing responsibility for confidentiality and privacy Securing cryptographic keys Return of organization IS property Unfriendly Termination Due to the number of adverse consequences associated with an unfriendly termination, the organization should at least consider the following steps: When an employee notifies an organization of a resignation and it can be rea­sonably expected that it has occurred on unfriendly terms, system access should be terminated immediately If the organization decides that an employee is to be fired, then system access should be removed immediately after that decision is made In no case should the employee be allowed to have access to the system after they have been notified that they have been dismissed If the employee continues to work for a period after they have been notified they will be terminated, then good practice dictates that they should be assigned duties that do not require system access Where terminations are extremely unfriendly or where the employee has immediate access to critical functions or information, it is advisable to expedite their physical removal from the area Contractor Considerations A commitment to impose the degree of interorganization rigor to ensure security has to be included in the contract from the beginning of the process A thorough job-task analysis of all the outsourced work must be performed Establish incident reporting function