Week 12

Security Operations Concepts

• Need to know: personnel should have access to only necessary information to perform their duties, independent of security clearance
• Least privilege: personnel should have the minimum level of access required to perform their duties
• Separation of duties: divide tasks and responsibilities to prevent any one person from having too much control
• Job rotation: regularly rotate personnel to different roles to prevent familiarity and reduce risk
• Monitoring of special privileges: regularly monitor and audit access to sensitive information

Records Management Controls

• Data classification: establish sensitivity levels and handling procedures for each level
• Access management: policies, procedures, and controls that determine how information is accessed and by whom
• Records retention: policies that specify how long different types of records must be retained
• Backups: ensuring data is backed up regularly to prevent loss
• Data destruction: ensuring discarded information is truly destroyed and not salvageable by employees or outsiders

Data Classification

• Establish sensitivity levels
• Establish handling procedures for each level
• Train users on classification and handling procedures

Access Management

• Policies, procedures, and controls that determine how information is accessed and by whom
• User account provisioning
• Privilege management
• Password management
• Review of access rights
• Secure logon

Records Retention

• Policies that specify how long different types of records must be retained
• Manage risks related to business records, including:
  • Risk of compromise of sensitive information
  • Risk of loss of important information
  • E-Discovery
  • Regulation

Data Destruction

• Purpose: ensure discarded information is truly destroyed and not salvageable by employees or outsiders
• Methods:
  • Degaussing
  • Shredding
  • Wiping

Anti-Virus and Anti-Malware

• Effects of uncontrolled malware:
  • Loss of business information
  • Disclosure or compromise of business information
  • Corruption of business information
  • Disruption of business information processing
  • Inability to access business information
  • Loss of productivity
• Apply defense in depth to protect assets
• Central anti-malware management

Remote Access

• Connectivity to a network or system from a remote location
• Improves productivity by permitting employees to access business information from any location
• Risk mitigation strategies:
  • Encryption
  • Strong authentication
  • Anti-malware
  • Firewall

Types of Controls

• Technical
• Physical
• Administrative

Resource Protection

• Documentation:
  • May contain trade secrets and sensitive information
  • Processes, procedures, and instructions
  • Version control
  • Access control

Incident Management

• Incident declaration
• Triage
• Investigation
• Analysis
• Containment
• Recovery
• Debriefing

High-Availability Architectures

• Fault tolerance
• Clustering
• Failover
• Replication
• Virtualization

Fault Tolerance

• Makes devices less prone to failure
• Methods:
  • Multiple power supplies
  • Multiple network interfaces
  • Multiple processor units
  • RAID (Redundant Array of Inexpensive / Independent Disks)

Clustering

• A group of two or more servers that operate functionally as a single logical server
• Active-active mode
• Active-passive mode
• Failover: when active status is transferred
• Geo-cluster: servers located at great distances from one another

Replication

• Data changes are transmitted to a counterpart storage system
• An adjunct to clustering, makes current data available to all cluster nodes

Virtualization

• Multiple operating system instances on a single server platform
• Systems can be logically and physically moved from one server platform to another
• Types:
  • Local
  • Long distance

Business Continuity Management

• A management activity where analysis is performed to better understand the risks associated with potential disaster scenarios, and the steps that can be taken to reduce the impact of a disaster should one occur

Vulnerability Management

• Vulnerability scanning
• Application scanning
• Penetration testing
• Source code reviews and scanning
• Threat modeling
• Patch management