Network and Distributed Systems Security

Chapter Outline

• This chapter addresses why administering security is important
• The chapter also covers elements to know as an information security officer

Contributors to Security Problems

• Low awareness of security problems, like underestimating the complexity
• No unique responsibility when users share resources
• No audit trails to track user activities and system events
• Environmental attacks targeting physical infrastructure
• No backups of critical data increases risk of data loss
• Amateur quality software introduces vulnerabilities
• High portability of devices expands attack surface
• Combination of duties increases insider threats

Security Measures

• Three classes of security measures exist, including procedures for use, hardware controls, and software controls

Issues Addressed by Procedures for Use

• Implementing policies for user authentication, access control, data handling, and incident response
• Instructing users not to leave PCs unattended in exposed environments
• Advising users not to leave printers unattended when printing sensitive output
• Securing media containing sensitive information
• Performing regular backups of critical data and system configurations
• Implementing separation of authority

Issues Addressed by Hardware Control

• Securing equipment housing sensitive hardware components to prevent physical access
• Using add-on security boards or modules for protection like hardware-based encryption
• Examples include biometric authentication, smart cards, locks, and surveillance cameras
• Controls safeguard assets, infrastructure, and resources from physical threats

Issues Addressed by Software Control

• Deploying software controls within applications, OS, and network devices
• Using software with full understanding of threats, awareness of vulnerabilities ,and safe usage guidelines
• Avoiding software from dubious resources
• Being cautious of results from software applications
• Maintaining periodic backups of all system resources

Network Security Management

• Securing a Wide Area Network (WAN)
• Distance and Size: Managing infrastructure due to vast geographical spread
• Distance and Size: Distance impacting performance and security
• Distance and Size: Requires planning and coordination to protect entire infrastructure
• Insiders and Outsiders: Distinguishing between legitimate and unauthorized users due to diversity
• Insiders pose potential risks intentionally or unintentionally
• Outsiders include hackers, cybercriminals who probe for vulnerabilities
• Ownership and Responsibility: WANs involve multiple stakeholders with different roles
• The distributed nature of ownership can cause challenges in consistent policy enforcement
• Establishing clear lines of ownership and communication is essential

Elements to consider when administering network security

• Architecture (structure, connectivity, permissions, backups)
• Host (software versions, accounts)

Network Security Management - Incidents

• Each system administrator should develop an incident handling plan
• Users should know what is suspicious behavior and who to report it to
• The administrator should have a management contact list in emergencies.
• Management should have decided on action for an attack like close operations
• Have means to notify users

Network Security Management - Tools:

• CRACK is a collection of password checking tools
• Tripwire is a tool to use after a suspected penetration
• COPS is a set of programs that check important system files, user configurations
• SATAN is a collection of network analysis tools

Network Security Management - CRACK

• CRACK is designed to assess strength and security of user passwords
• Administrators run the tool against a password file or database
• It employs dictionary-based, brute-force, and rule-based attacks
• Analyzing results from crack will let admins identify users with weak passwords

Network Security Management - Tripwire

• Tripwire is an Intrusion Detection System IDS, that monitors and alerts administrators to changes in critical system files, directories, and configurations
• After a suspected penetration or security breach, administrators can conduct a post-incident analysis
• Comparing current system states with baseline configurations stored in a secure database detects unauthorized modifications, file tampering.
• Administrators can use Tripwire's reporting and alerting features to investigate activities, identify security incidents, and take appropriate actions.

Network Security Management - COPS

• COPS (Computer Oracle and Password System) is a set of programs designed to assess and evaluate the security posture of UNIX-based systems.
• COPS checks important system files, user configurations, permissions settings, and other critical parameters to identify potential security flaws or weaknesses that could contribute to undesirable events.
• To use COPS, administrators typically run the tool on target systems to perform security audits and vulnerability assessments.
• COPS generates detailed reports listing security issues, misconfigurations, and vulnerabilities discovered during the assessment, allowing administrators to prioritize remediation efforts and strengthen the overall security of the system.

Network Security Management - SATAN

• SATAN (Security Analysis Tool for Auditing Networks) is a collection of network analyses tools designed to audit and assess the security of networked systems and services
• To use SATAN, administrators deploy the tool to scan networked host, servers, and services for potential security vulnerabilities, misconfigurations, and weaknesses.
• SATAN performs various security test and checks against target systems including port scanning, service enumeration, version detection, and vulnerability identification.
• Administrators can analyze the results generated by SATAN to identify security gaps, prioritize remediation efforts, and implement appropriate security measures to protect against potential threats and attacks.

Computer Emergency Response Team

• CERT was formed because the Internet worm incident exposed no central source of information for security incidents involving Internet hosts.
• The U.S. Department of Defense established CERT at the Software Engineering Institute at Carnegie Mellon University.
• CERT monitors reports of incidents and security flaws, helps manufacturers, develops fixes to security problems and issues notices of problems and solutions

Risk Analysis

• Security planning begins with risk analysis.
• Risk analysis determines the exposures and their potential harm.
• Reasons to perform risk analysis: improve awareness, identify assets and vulnerabilities, improve basis for risk decisions, and justify security expenditure

Risk Analysis - Steps

• Identify assets
• Determine vulnerabilities
• Estimate likelihood of exploitation
• Compute expected annual loss
• Survey applicable controls and their costs
• Project annual savings of control.

Security Planning

• A security plan describes how an organization will address its needs.
• The plan is subject to revision as changes in requirements happen

Six Issues Security Plans must Address

• Policy
• Current state
• Recommendations and requirements
• Accountability
• Timetable
• Continuing attention

Security planning - Policy

• A policy defines the overarching security policies and principles which guide an organization's method to security
• This includes rules, standards, and guidelines for protecting assets as well as managing risks and compliance
• The policy statement addresses who should be allowed access, what resources, and how should access be regulated

Security Planning - Current Security Status

• Risk analysis can form the basis of a description of the current security status.
• The assessment will include existing security measures, controls and practices (listing the assets of the organization, security threats to the assets and the controls in place to protect the assets).

Security Planning - Recommendations and Requirements

• The heart of the security plan is action that will be taken.
• Create recommendations for enhancing security and specify requirements for implementing new security measures, controls, and protocols to address identified risks and vulnerabilities.
• Include requirements are being imposed and over what period they are being instituted.
• Plans must be extensible over time

Security Planning - Responsibility for Implementation

• Define roles, responsibilities, and accountability mechanisms for personnel involved in security management and enforcement
• Assign responsibilities for implementing security measures, monitoring compliance, and responding to security incidents
• All individuals will understand what can be done and who to coordinate with.

Security Planning - Timetable

• Develop a timetable for implementing the recommended security measures, set deadlines and milestones
• If the controls are expensive or complicated, they may be acquired and implemented

Security Planning - Continuing Attention

• Establishing an evaluation and review date of the security situation that includes regular reviews, updates, and revisions to the security plan to adapt to evolving threats, changes in the organization's environment, and emerging security challenges
• The security plan should arrange periodic reviews.

Contingency Planning - Backup

• Includes copying all or part of a file for recovering data loss
• It requires performing periodic backups of the entire system in storage.
• Maintain a rotating set of backups, retaining recent backups
• Save only the files have been modified or created since the last backup

Off- site Backup

• Requires taking completed backups and physically transporting it to designated locations
• Reduces data loss if primary systems are damaged

Networked Storage - Contingency planning

• Services offer storage space data remotely.
• Ideal for backing up critical data, as you can select a storage provider whose physical location is separate from your processing facility.
• Ensures data integrity and availability if backups are separated.

Cold Site - Contingency planning

• Facility with power and cooling infrastructure to install systems for operations
• Some use their facilities while others lease from disaster recovery providers
• Organizations restore operations at a cold site within a week

Hot Site - Contingency Planning

• Facilities are equipped with a fully operational computing system, telecommunications lines, power supplies, trained personnel.
• Utilized for mission-critical applications needing minimal downtime
• Can be owned by leased from the organization or disaster recovery providers
• Activation of a hot site requires loading software and data from offsite backup sources

Good Security Policy - Coverage

• The security policy must be comprehensive
• It should also be sufficiently broad to accommodate new situations as they may arise

Good Security Policy - Durability

• Durability is necessary to adapt policies over time.
• Policies must be flexible to changes over time.
• However, it should be amendable overtime to effectively address new conditions

Good Security Policy - Realism

• The policy must be realistic, stated security requirements have to be feasible to implement with current tech
• The implementation should practically benefit users in terms of saving time ,cost-effectiveness, and convenience.

Good Security Policy - Usefulness

• The usefulness of a security policy hinges on its clarity and comprehensibility.
• Policies are obscure if it is discarded if incorrectly
• Written in a way that can be understood and followed that must be concise and direct.