Controls for Information Security
Chapter 8
8-1
Copyright © 2015 Pearson Education, Inc.
Copyright © 2015 Pearson Education, Inc.
Trust Services Framework
Security
Access to the system and data is controlled and restricted to legitimate users.
Confidentiality
Sensitive organizational data is protected.
Privacy
Personal information about trading partners, investors, and employees are protected.
Processing integrity
Data are processed accurately, completely, in a timely manner, and only with proper authorization.
Availability
System and information are available.
8-2
Copyright © 2015 Pearson Education, Inc.
The trust services framework is a means to organize IT controls to help ensure systems reliability. At the foundation of this framework is security which is absolutely necessary for success and for achieving the other four principles.
Security procedures:
Restrict access to authorized users only
which protects confidentiality of sensitive organizational data and the privacy of personal
data collected from customers, suppliers, employees, and so on.
Security protects the processing integrity by preventing submission of unauthorized transactions or unauthorized changes to the data.
Security provides protection from unwanted attacks that could bring down the system and make it unavailable.
2
8-3
Copyright © 2015 Pearson Education, Inc.
This is a good visual of the Trust Services Framework
Using an analogy of building a house, you need a good foundation; otherwise the house will fall apart. Then to keep the roof over your head, you need to have wel-constructed walls.
Similarly, for good systems reliability you need a good foundation of Security. The walls are the four pillars focused on maintaining good systems reliability.
3
Security Life Cycle
Security is a management issue
8-4
Copyright © 2015 Pearson Education, Inc.
Although technologies tools are used for security and the security expertise is within an IT department, effective security must have the support of senior management to understand the potential threats to an organizations information systems which would impede the organization from achieving its goals.
As we previously discussed about threats to an AIS, management must assess the threat to an AIS and determine how to respond (reduce, accept, share, avoid). The second step is to develop security policies (e.g., employees should not click on any links embedded into e-mails) and make sure that those policies are communicated (best way is through training).
The third step is to invest in the necessary resources (human and technology) to reduce the security threats. Finally, active monitoring to evaluate the security effectiveness provides a feedback loop as management may need to make updates based upon new threats or techniques that affect security.
Overall, management is responsible for maintaining a “culture of security”. The fourth step requires monitoring of performance because if you do not monitor how well you are doing with your objectives, how do you know if it is achieved?
4
Security Approaches
Defense-in-depth
Multiple layers of control (preventive and detective) to avoid a single point of failure
Time-based model, security is effective if:
P > D + C where
P is time it takes an attacker to break through preventive controls
D is time it takes to detect an attack is in progress
C is time it takes to respond to the attack and take corrective action
8-5
Copyright © 2015 Pearson Education, Inc.
5
How to Mitigate Risk of Attack
Preventive Controls
Detective Controls
People
Process
IT Solutions
Physical security
Change controls and change management
Log analysis
Intrusion detection systems
Penetration testing
Continuous monitoring
8-6
Copyright © 2015 Pearson Education, Inc.
Preventive: People
Culture of security
Tone set at the top with management
Training
Follow safe computing practices
Never open unsolicited e-mail attachments
Use only approved software
Do not share passwords
Physically protect laptops/cellphones
Protect against social engineering
8-7
Copyright © 2015 Pearson Education, Inc.
7
Preventive: Process
Authentication—verifies the person
Something person knows
Something person has
Some biometric characteristic
Combination of all three
Authorization—determines what a person can access
8-8
Copyright © 2015 Pearson Education, Inc.
These two concepts are related, to get into a system, you need to be authenticated, then authorization is where you are allowed to go once you are in the system.
8
Preventive: IT Solutions
Antimalware controls
Network access controls
Device and software hardening controls
Encryption
8-9
Copyright © 2015 Pearson Education, Inc.
Preventive: Other
Physical security access controls
Limit entry to building
Restrict access to network and data
Change controls and change management
Formal processes in place regarding changes made to hardware, software, or processes
8-10
Copyright © 2015 Pearson Education, Inc.
Corrective
Computer Incident Response Team (CIRT)
Chief Information Security Officer (CISO)
Patch management
8-11
Copyright © 2015 Pearson Education, Inc.
Get help from top-rated tutors in any subject.
Efficiently complete your homework and academic assignments by getting help from the experts at homeworkarchive.com