Security Awareness Chapter 6 Enterprise Security.

Security Awareness

Chapter 6Enterprise Security

Security Awareness, 3rd Edition 2

Objectives

After completing this chapter you should be able to do the following:

•Define business continuity

•Explain how redundancy planning and disaster recovery planning benefit an organization

•Explain what a policy is and how it is used

•List the different types of security policies

Business Continuity

• Ability of an organization to maintain its operations and services in the face of a disruptive event– Computer attack– Natural disaster

• Many organizations are either unprepared or have not tested their plans

• Common elements – Redundancy planning– Disaster recovery procedures– Incident response procedures


Redundancy Planning

• Building excess capacity in order to protect against failures

• Servers– Protect against single point of failure– Redundant servers or parts

• May take too long to get back online

– Server cluster• Design the network infrastructure so that multiple

servers are incorporated into the network

• Types: asymmetric and symmetric


Redundancy Planning (cont’d.)

Figure 6-1 Server cluster


Course Technology/Cengage Learning


• Storage– Hard disk drives often are the first component of a

system to fail– Implement RAID (Redundant Array of

Independent Drives) technology• Uses multiple hard disk drives for increased reliability

and performance



• Networks– Redundant network ensures that network services

are always accessible– Virtually all network components can also be

duplicated



• Power– Uninterruptible power supply (UPS)

• Device that maintains power to equipment in the event of an interruption in the primary electrical power source

• On-line

• Off-line

– Backup generator



• Sites– Hot site

• Run by a commercial disaster recovery service

• Allows a business to continue computer and network operations to maintain business continuity

– Cold site• Provides office space

• Customer must provide and install all the equipment needed to continue operations



– Warm site • All of the equipment installed

• Does not have active Internet or telecommunications facilities

• Does not have current backups of data


Disaster Recovery Procedures

• Procedures and processes for restoring an organization’s operations following a disaster

• Focuses on restoring computing and technology resources to their former state

• Planning – Disaster recovery plan (DRP)

• Written document

• Details the process for restoring computer and technology resources


Disaster Recovery Procedures (cont’d.)

Table 6-1 Sample educational DRP approach




• Common features of DRP– Purpose and scope– Recovery team– Preparing for a disaster– Emergency procedures– Restoration procedures



Figure 6-2 Sample from a DRP




• Disaster exercises– Test the effectiveness of the DRP– Objectives

• Test the efficiency of interdepartmental planning and coordination in managing a disaster

• Test current procedures of the DRP

• Determine the strengths and weaknesses in disaster responses



• Enterprise data backups– Significantly different than those for a home user– Disk to disk (D2D)– Continuous data protection (CDP)


Incident Response Procedures

• What is forensics?– Forensics

• Application of science to questions that are of interest to the legal profession

– Computer forensics • Attempt to retrieve information that can be used in the

pursuit of the attacker or criminal

• Importance of computer forensics is due in part to

– High amount of digital evidence

– Increased scrutiny by the legal profession

– Higher level of computer skill by criminals


Incident Response Procedures (cont’d.)

• Responding to a computer forensics incident– Secure the crime scene

• Response team must be contacted immediately

• Document physical surroundings

• Take custody of computer

• Interview users and document information

– Preserve the evidence• First capture any volatile data

– Random access memory (RAM)

• Mirror image backup or bit-stream backup


Incident Response Procedures (cont’d.)

– Establish the chain of custody• Documents that the evidence was under strict control

at all times

• No unauthorized person was given the opportunity to corrupt the evidence

– Examine the evidence• Mirror image is examined to reveal evidence

• Mine and expose hidden clues

– Windows page file

– Slack

– Metadata


Figure 6-3 Slack



Security Policies

• Plans and policies must be established by the organization – To ensure that people correctly use the hardware

and software defenses

• Organizational security policy


What Is a Security Policy?

• Document that outlines the protections that should be enacted

• Functions– Communicates organization’s information security

culture and acceptable information security behavior– Detail specific risks and how to address them– Help to create a security-aware organizational

culture– Ensure that employee behavior is directed and

monitored to ensure compliance with security requirements


Balancing Trust and Control

• Approaches to trust– Trust everyone all of the time– Trust no one at any time– Trust some people some of the time

• Deciding on the level of control for a specific policy is not always clear

• Not all users have positive attitudes toward security policies


Balancing Trust and Control (cont’d.)

Table 6-2 Possible negative attitudes toward security



Designing a Security Policy

• Definition of a policy– Characteristics

• Communicate a consensus of judgment

• Define appropriate behavior for users.

• Identify what tools and procedures are needed

• Provide directives for Human Resource action in response to inappropriate behavior

• May be helpful in the event that it is necessary to prosecute violators


Designing a Security Policy (cont’d.)

• Due care– Obligations imposed on owners and operators of

assets – Exercise reasonable care of the assets and take

necessary precautions to protect them– Care that a reasonable person would exercise under

the circumstances– Examples



• The security policy cycle– Three-phase cycle

• Performing a risk management study

– Asset identification

– Threat identification

– Vulnerability appraisal

– Risk assessment

– Risk mitigation

• Creating a security policy based on the information from the risk management study

• Reviewing the policy for compliance



Figure 6-4 Security policy cycle



Types of Security Policies

• Acceptable use policy (AUP)– Defines the actions users may perform while

accessing systems and networking equipment– Unacceptable use may also be outlined by the AUP

• Security-related human resource policy– Include statements regarding how an employee’s

information technology resources will be addressed– Presented at an orientation session when the

employee is hired– May contain due process statement


Table 6-3 Types of security policies

Security Awareness, 3rd Edition 30Course Technology/Cengage Learning

Types of Security Policies (cont’d.)

• Personally identifiable information (PII) policy

– Outlines how the organization uses personal information it collects

• Disposal and destruction policy– Addresses the disposal of resources that are

considered confidential



Figure 6-5 Sample PII (privacy) policy




• Ethics policy– Refocus attention on ethics in the enterprise– Written code of conduct – Central guide and reference for employees in

support of day-to-day decision making


Summary

• Redundancy planning– Building excess capacity in order to protect against

failures

• Disaster recovery – Procedures and processes for restoring an

organization’s operations following a disaster

• Forensic science– Application of science to questions that are of

interest to the legal profession


Summary (cont’d.)

• Security policy – Written document that states how an organization

plans to protect the company’s information technology assets


Security Awareness Chapter 6 Enterprise Security.

Documents

rd edition

disaster recovery planning

performancesecurity

duplicatedsecurity awareness

symmetricsecurity awareness

operationssecurity awareness

network operations

network services