CSIT302 Week 6: Security Policy

• Security Policy is covered in Week 6 in CSIT302 Cybersecurity course

What is Security Policy

• Several definitions come from NIST special publications
• It is a set of criteria for the provision of security services
• It is the formal statement of required protection for information objects
• It is a set of rules that governs all aspects of security-relevant system behaviour
• It defines the objectives and constraints for the security program

Outlines

• Reviewing security policy
• Educating end users
• Policy enforcement
• Monitoring for compliance
• Enhancing Security Posture through Security Policies
• Security Governance

Reviewing Security Policy

• Important questions to address
• Do you even have one in place?
• Do you enforce it?
• How often do you review it looking for improvements?
• Security policy is a living document
• It needs to be revised and updated regularly or on-demand
• It should include
• Industry standards, procedures, and guidelines to support information risks in daily operations
• A well-defined scope in the scope section of the policy whether the policy applies to a certain group of people or everyone reading, including contractors.
• Its the foundation of the security policy -It should help protect the security triad (confidentiality, integrity, and availability)
• Requirements from users
• To protect and ensure the applicability of the security triad in the data and system
• To be aware of their responsibilities, and the consequences of violating these policies.
• Various documents are involved in overall security policy
• All users must understand the differences between each document
• Policy
• This is the basis of everything, it sets high-level expectations
• It guides decisions and achieve outcomes
• It is for all participants so it is not too technical
• It must be enforced by a proper authority
• Procedure
• A document that has procedural steps that outlines how something must be done
• Standard
• Establishes technical requirements that must be followed
• Everyone must comply with certain standards that were established
• Must provide enough technical details with accurate explanations to relevant personnel
• All requirements must be covered in associated standard documents with technical specifications
• Guidelines
• Can be optional but can be additonal recommended guidance
• Each company can define whether the guidelines are optional, or recommended
• Must be aligned with the policy and standard documents
• Usually written to give more specific details with practical examples
• Used to guide someone who has substantial knowledge of IT but not cybersecurity
• Best practices
• Implemented by the entire company, or just some departments
• Can be established per role
• Can be a part of the guidelines
• To ensure all documents are synchronized and managed, management sponsorship is needed
• Organization-wide security program

Security through NIST

• Example of an organization-wide security program according to NIST SP 800-53
• Security and Privacy Controls for Information Systems and Organizations
• What is NIST Special Publication (SP 800)?
• Presents information of interest to the computer security community.
• It comprises guidelines, recommendations, technical specifications, and annual reports of NIST's cybersecurity activities."
• NIST SP 800-53
• FIPS Publication 200 is a mandatory federal standard developed in response to FISMA
• Organizations apply the appropriately tailored set of baseline security controls in accordance with FIPS publication 200

UoW Cybersecurity Policy

• UoW defines cybersecurity policy in Cyber Security Policy
• Contents of the Policy include
• Section 1 - Purpose of Policy
• Section 2 – Application and Scope
• Section 3 - Policy Principles
• Section 4 - Roles and Responsibilities
• Section 5 - Definitions
• Section 1 - Purpose of Policy
• This document sets out the University's policy on cyber security
• Cyber security is about defending IT facilities and services and stored data from unauthorized access.
• It ensures integrity, availability, confidentiality and safety of data and services with proportionate controls
• This Policy is supported by a cyber security framework which includes:
• Supplementary policies
• Guidelines on specific topics
• Operational practices
• Action plans
• Technology controls
• Education programs
• Monitoring and assurance activities
• Section 2 - Application and Scope
• Applies to all users and devices of IT facilities and services at the University
• All users should be aware of this Policy, their responsibilities, and legal obligations
• All users and devices are required to comply with this Policy and are bound by law
• Section 4 - Roles and Responsibilities include
• Chief Information Digital Officer
• Cyber Security Team
• Risk, Audit and Compliance Committee
• Staff with responsibility for managing any IT Facility or Service
• Users of IT Facilities and Services which have responsibilities for themselves and their devices:
  • using IT facilities and services according to IT policies at all times;
  • being aware of the security requirements of the IT facilities and services they use
  • taking every precaution to safeguard their access to these systems against unauthorized use
  • Immediately report any known or suspected security incidents and breaches to IMTS
• Section 5 - Definitions
• Cybersecurity - Defending computing devices, networks and stored data from unauthorized access.
• Now take a look at "IT SERVER SECURITY POLICY".
• https://policies.uow.edu.au/document/view-current.php?id=69
• This Policy applies to servers that are connected to a University network
• Servers that are operated for or on behalf of the University regardless of which network they are connected to, and infrastructure as a service and platform as a service.
• Does not apply to services that are procured as the "software as a service"

Educating the End User

• Security awareness training is part of the management control according to NIST SP 800-53
• This is one of the most important pieces of the security program because a user who is uneducated can cause tremendous damage to the organization
• It should be delivered to all employees, and it should be constantly updated
• Many companies are delivering training online via the company intranet
• Contents of the security awareness training
• Real-world examples: Users will remember things if a real scenario is shown
• Practice: Well-written text and rich visual elements plus computer based interaction using spear phishing or a fake social media campaign
• Training outcomes
• All users should acknowledge that they successfully finalized the training
• All users are aware about the security threats and countermeasures covered in the training
• All users are also aware about the consequences of not following the company's security policy
• A case study uses Symantec Internet Security Threat Report Volume 24
• Spam campaigns are the top cause of malware infestation, and the largest malware spamming operations are relying on social engineering techniques.
• In 2016 invoice was the most common word used in major malware campaigns
• The problem of BYOD (Bring Your Own Device)
• Users will access company info using their own device becoming targets for hackers
• Hackers able to compromise the user's system, gaining access to the company's data
• BYOD should not be allowed in some environments where maximum confidentiality is required.
• Social media guidelines for users and HR. -Social media plays an important role in social engineering attacks
  • Should focus on the definition of appropriate business behaviour with disciplinary actions for boundary crossing
• There should be guidelines to deal with defamatory posts, proprietary issues, harassment
• Shows the employer promotes a wealth social environment within the company

Policy Enforcement

• Policy enforcement based on a network architecture diagram to;
• Understand fully what:
• endpoints are
• what servers an organization has
• how the information flows
• where the information is stored
• who has and who should have data access
• Many companies fail because they only enforce at endpoints and servers
• Policy enforcement on network devices
• A holistic approach is needed to tackle every component that is active in the network, including switches, printers, and IoT devices

Preliminary: Active Directory

• Purpose
• Arrange network objects, users, computers, etc, into logical and hierarchical structure
• Provide authentication and authorization for these objects
• OUs (Organizational Units)
• A container for Objects
• Administrator can create hierarchy that reflects the structure of the organization
• Trust relationship
  • The default relationship between the parent domain and the child domain is a transitive two-way trust
  • Other types are possible depending using a one-way or non-transitive two-way trust
• Group Policy is a Microsoft Windows NT family of operating systems feature -Centrally controls the working environment of user accounts and computer accounts.
• It was created to overcome the problem with the Windows registry
• Group policy makes it easy to reverse any previous configuration made for a user.
• Execution of Group Policy
• Group Policy Object(GPO) is a collection of settings that define what a system will look like and how it will behave for a defined group of users

Policy Enforcement Tools

• Group Policy Object (GPO) can be leveraged to deploy security policies.
• If different departments have different needs, the deployment of group policies assigned per OU.
• Application whitelisting means security policy dictates that only licensed software can run in the user's computer
• Running unlicensed software is prevented as IT IT restricts it
• Only authorized applications will run
• NIST guidance on application whitelisting - SP 800-167:
• Download it from http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-167.pdf
• After creating a list of all authorized apps, consider
  • Installation path for each app,
  • Vendor's update policy,
  • Executable files are used by these apps?
• AppLocker: https://docs.microsoft.com/en-us/windows/device-security/applocker/applocker-overview
• Apple OS: Gatekeeper
• Linux OS: SELinux Microsoft AppLocker
• Three types of conditions to evaluate an app
• Publisher - use to create a rule that will evaluate an app that was signed by the software vendor.
• Path - if the application path. (Usually on Windows, C:\Program Files (x86) or C:\Program Files
• File hash: used when an app not signed by the software vendor is used
• Hardening - A consequence of policy deployment addressing which setting to better protect computers.
• Computers are "hardened" to reduce the attack vector.
• Common Configuration Enumeration (CCE) can be applied to the computers, available at https://nvd.nist.gov/config/cce/index.
• Linux hardening security guidance available on each distribution

Monitoring for Compliance

• Monitoring security policies compliance is indispensable
• policies defined based on CCE guidelines can be monitored with Azure Security Center and not confused wwith CVE
• Common Vulnerability and Exposure (CVE) requires deploying a patch
• See more information about CVE at https://cve.mitre.org/.

Continuously Enhancing Security Posture through Security Policies

• Constant environmental changes, demand ongoing policy adaptation
• CSPM (Cloud Security Posture Management) tools provide visibility into new resources
• Identify deviation from policies, and enforce security best practices
• E.g., Azure Security Center for real-time workload assessment.
• Microsoft Defender for Cloud uses Secure Score as a KPI to measure compliance and security posture.
• A score of 100% reflects optimal security and guide improvements

Security Policy vs. Security Governance

• Security governance is the system by which an organizations information security activities are directed and controlled (ISO/ICE 27014) It establishes the high-level objectives and risk appetite for the organization.

• A governance framework might dictate that the organization must comply with GDPR regulations or that risk tolerance for data breaches is minimal.

• Security policy is a core component of security governance, translating governance principles into actionable measures

• If governance mandates GDPR compliance

• Specify e.g., data encryption, user access controls, and incident response protocols related to personal data handling. Three-Tier Security Governance Model

• Tier 1: Executive Leadership who:

• Board, CEO, CISO define security strategy, allocate budgets, set risk appetite

• Tier 2: Security Management who Security Officers, Risk Managers develop security policies, manage risk assessments, oversee compliance

• Tier 3: Security Operations who implement controls, monitor threats, incident response

• Use Case with large enterprise clear hierarchical structure and strong role separation

• Can be rigid and slow to react to evolving threats Four-Tier Security Governance Model

• Tier 1: Executive Leadership who Define security strategy, allocate budgets, set risk appetite.

• Tier 2: Compliance & Legal Oversight responsible for Ensure regulatory compliance

• Tier3: Security responsible for Developing Security protocols and manage risk.

• Tier4: SOC to test Admin and monitor threat Federated Governance Model where:

• Set global complaiances to Central Governance: CISO, Teams

• Local security can adjust for local custom

• Matriix Model security is collaborative

• Cross Functional Teams for security and compliance

• Secuity Committees give oversight

• Devops Model

• Unclear Ownership

• Conflicts can arrise