guide to network defense and countermeasures second edition chapter 2 security policy design: risk...
Post on 19-Dec-2015
212 views
TRANSCRIPT
![Page 1: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/1.jpg)
Guide to Network Defense and CountermeasuresSecond Edition
Chapter 2Security Policy Design: Risk Analysis
![Page 2: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/2.jpg)
Guide to Network Defense and Countermeasures, Second Edition 2
Objectives
• Explain the fundamental concepts of risk analysis
• Describe different approaches to risk analysis
• Explain the process of risk analysis
• Describe techniques to minimize risk
![Page 3: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/3.jpg)
Guide to Network Defense and Countermeasures, Second Edition 3
Fundamental Concepts of Risk Analysis
• There is no situation in which security is perfect• Risk analysis
– Determines the threats that face the organization• Security policy
– Statement that spells out• What defenses should be configured
• How the organization will respond to attacks
• How employees should safely handle the organization’s resources
![Page 4: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/4.jpg)
Guide to Network Defense and Countermeasures, Second Edition 4
![Page 5: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/5.jpg)
Guide to Network Defense and Countermeasures, Second Edition 5
Risk Analysis Factors
• Risk is defined as the possibility of damage or loss• Risk analysis
– Study of the likelihood of damage or loss– Should encompass hardware, software, and data
warehouses• Assets
– Physical assets– Data assets– Application software assets– Personnel assets
![Page 6: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/6.jpg)
Guide to Network Defense and Countermeasures, Second Edition 6
Risk Analysis Factors (continued)
• Threats– Events that have not occurred but might occur– Threats increase risks– Can be universal or specific to your systems– Circumstance-specific threat examples
• Power supply• Crime rate• Facility-related• Industry
– The seriousness of a threat depends on the probability that it will occur
![Page 7: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/7.jpg)
Guide to Network Defense and Countermeasures, Second Edition 7
Risk Analysis Factors (continued)
• Probabilities– Factors that affect the probability that a threat will
actually occur• Geographic• Physical location• Habitual
– Exposure• Increases if you have factors that increase threat
probabilities– Make a list and rank your threats probabilities
![Page 8: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/8.jpg)
Guide to Network Defense and Countermeasures, Second Edition 8
![Page 9: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/9.jpg)
Guide to Network Defense and Countermeasures, Second Edition 9
Risk Analysis Factors (continued)
• Vulnerabilities– Situations or conditions that increase a threat
probability• Which in turn increases risk
– Examples• OS flaws• Application software flaws• Poorly configured firewalls or packet filters• Unprotected passwords and log files• Wireless networks
![Page 10: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/10.jpg)
Guide to Network Defense and Countermeasures, Second Edition 10
Risk Analysis Factors (continued)
• Consequences– Significance of an attack impact– Some consequences can be estimated– Some consequences are difficult to anticipate
• Return on investment (ROI)– Helps you calculate your losses after an attack– You can compare your losses with the cost of your
security measures• Security measures costs should always be less than
your losses
![Page 11: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/11.jpg)
Guide to Network Defense and Countermeasures, Second Edition 11
![Page 12: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/12.jpg)
Guide to Network Defense and Countermeasures, Second Edition 12
![Page 13: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/13.jpg)
Guide to Network Defense and Countermeasures, Second Edition 13
Risk Analysis Factors (continued)
• Safeguards– Measures you can take to reduce threats– Examples include
• Firewalls and IDSs• Locking doors• Using passwords and encryption
– Residual risk• What is left over after countermeasures and defenses
are implemented
![Page 14: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/14.jpg)
Guide to Network Defense and Countermeasures, Second Edition 14
![Page 15: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/15.jpg)
Guide to Network Defense and Countermeasures, Second Edition 15
Approaches to Risk Analysis
• Survivable Network Analysis (SNA)• Threat and Risk Assessment (TRA)
![Page 16: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/16.jpg)
Guide to Network Defense and Countermeasures, Second Edition 16
Survivable Network Analysis
• Security process developed by the CERT Coordination Center group
• Assumes that a system will be attacked– Leads you through a four-step process designed to
ensure the survivability of a network• Network key properties
– Resistance– Recognition– Recovery– Adaptation and evolution
![Page 17: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/17.jpg)
Guide to Network Defense and Countermeasures, Second Edition 17
Survivable Network Analysis (continued)
• Fault tolerance– Capability of an object to continue operations despite
a failure• SNA steps
– System definition– Essential capability definition– Compromisable capability definition– Survivability analysis
![Page 18: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/18.jpg)
Guide to Network Defense and Countermeasures, Second Edition 18
Threat and Risk Assessment
• TRA approaches risk analysis from the standpoint of threats and risks to an organization’s assets
• TRA steps– Asset definition– Threat assessment– Risk assessment– Recommendations
• TRA is carried out in different ways by security agencies all over the world
![Page 19: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/19.jpg)
Guide to Network Defense and Countermeasures, Second Edition 19
![Page 20: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/20.jpg)
Guide to Network Defense and Countermeasures, Second Edition 20
![Page 21: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/21.jpg)
Guide to Network Defense and Countermeasures, Second Edition 21
Risk Analysis: An Ongoing Process
• Risk analysis is not a one-time activity– Evolves to take into account an organization’s changing
size and activities
• Initial risk analysis– Used to formulate a security policy
• New threats and intrusions– Create the need for a reassessment of the risk
![Page 22: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/22.jpg)
Guide to Network Defense and Countermeasures, Second Edition 22
Risk Analysis: General Activities to Follow
• Risk analysis– Group of related activities that follow a sequence
• Sequence of activities– Holding initial team sessions– Conduction assets valuation– Evaluating vulnerability– Calculating risk
![Page 23: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/23.jpg)
Guide to Network Defense and Countermeasures, Second Edition 23
Analyzing Economic Impacts
• Estimating financial impact or losses• You can use different statistics models
– Or a software program such as• Project Risk Analysis by Katmar Software
• Basic information to estimate– Likely cost– Low cost– High cost
• Monte Carlo simulation– Analytical method that simulates real-life system by
randomly generating values for variables
![Page 24: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/24.jpg)
Guide to Network Defense and Countermeasures, Second Edition 24
![Page 25: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/25.jpg)
Guide to Network Defense and Countermeasures, Second Edition 25
![Page 26: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/26.jpg)
Guide to Network Defense and Countermeasures, Second Edition 26
![Page 27: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/27.jpg)
Guide to Network Defense and Countermeasures, Second Edition 27
Deciding How to Minimize Risk
• Risk management– Process of identifying, choosing, and setting up
countermeasures justified by the risk you identify– Countermeasures go into your security policy
![Page 28: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/28.jpg)
Guide to Network Defense and Countermeasures, Second Edition 28
Securing Hardware
• Think about obvious kinds of physical protection– Such as environmental conditions
• Lock up your hardware– Decide which devices you want to be locked
• Pay special attention to laptops– Laptops can be lost or stolen easily
• Install startup passwords and screen saver passwords– Experienced thieves can circumvent them though
• Encrypt files with programs such as PGP
![Page 29: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/29.jpg)
Guide to Network Defense and Countermeasures, Second Edition 29
Securing Hardware (continued)
• Conduction a Hardware inventory– Make a list of servers, routers, cables, computers,
printers, and other hardware– Be sure to include your company’s network assets– Make a topology map of your network
![Page 30: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/30.jpg)
Guide to Network Defense and Countermeasures, Second Edition 30
![Page 31: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/31.jpg)
Guide to Network Defense and Countermeasures, Second Edition 31
Ranking Resources To Be Protected
• Rank resources in order of importance– Values can be arbitrary numbers
• Focus your security efforts on most critical resources first
• Work in cooperation with your team and higher management
![Page 32: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/32.jpg)
Guide to Network Defense and Countermeasures, Second Edition 32
Securing Information
• Electronic assets– Word processing, spreadsheet, Web page, and other
documents
• Logical assets– E-mail messages, any records of instant messaging
conversations, and log files
• Data assets– Personnel, customer, and financial information
![Page 33: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/33.jpg)
Guide to Network Defense and Countermeasures, Second Edition 33
Securing Information (continued)
• Maintaining customer and employee privacy– Isolate critical information from the Internet
• Move information from the original directory to a computer that is not connected to the Internet
• Configure backup software to save critical files
– Other measures• Encryption
• Message filtering
• Data encapsulation
• Redundancy
• Backups
![Page 34: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/34.jpg)
Guide to Network Defense and Countermeasures, Second Edition 34
Securing Information (continued)
• Protecting Corporate Information– Measures include
• Never leave company-owned laptops unattended
• Always password-protect information on corporate devices
• Encrypt and financial information
• Password-protect all job records and customer information
• Restrict personnel information to human resources staff and/or upper management
![Page 35: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/35.jpg)
Guide to Network Defense and Countermeasures, Second Edition 35
Conducting Routine Analysis
• Risk analysis is an ongoing process– Company’s situation changes constantly– Risk analysis should be done routinely to include
these changes• Consider the following questions
– How often will a risk analysis be performed?– Who will conduct the risk analysis?– Do all hardware and software resources need to be
reviewed every time?• Human emotions can influence risk evaluations
– Some companies do not allow these calculations to be done manually
![Page 36: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/36.jpg)
Guide to Network Defense and Countermeasures, Second Edition 36
Handling Security Incidents
• Security policy should state how you will respond to break-ins– Fill out a form to record what happened
• Incident-handling procedures– Describe who will respond to security incidents– Describe the kinds of incidents to be addressed
• Alarms sent by intrusion detection systems
• Repeated unsuccessful logon attempts
• Unexplained changes to data or deletion of records
• System crashes
• Poor system performance
![Page 37: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/37.jpg)
Guide to Network Defense and Countermeasures, Second Edition 37
![Page 38: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/38.jpg)
Guide to Network Defense and Countermeasures, Second Edition 38
Handling Security Incidents (continued)
• Assembling a response team– Security policy should state which security staff need
to be notified in case of an incident– Security incident response team (SIRT)
• Staff people designated to take countermeasures when an incident is reported
– SIRT contains• IT operations and technical support staff• IT application staff• Chief security officer• Information security specialists• Others
![Page 39: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/39.jpg)
Guide to Network Defense and Countermeasures, Second Edition 39
Handling Security Incidents (continued)
• Escalation procedure– Set of roles, responsibilities, and measures taken in
response to a security incident
![Page 40: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/40.jpg)
Guide to Network Defense and Countermeasures, Second Edition 40
Handling Security Incidents (continued)
• Including worst-case scenarios– Worst-case scenarios
• Descriptions of the worst consequences to an organization if a threat happens
• Might be unlikely• Can help you determine the value of a resource at risk
![Page 41: Guide to Network Defense and Countermeasures Second Edition Chapter 2 Security Policy Design: Risk Analysis](https://reader037.vdocuments.us/reader037/viewer/2022110322/56649d3a5503460f94a14662/html5/thumbnails/41.jpg)
Guide to Network Defense and Countermeasures, Second Edition 41
Summary
• Risk Analysis plays a central role in defining a security policy
• Risk analysis covers company’s computer hardware, software, and informational assets
• Your first task is to assess the level of risk to your network and its users
• Determine countermeasures for minimizing risk
• Assess threats to your network and the probability that they might happen– Determine safeguards and countermeasures