Security Operations and Administration Quiz

Security Operations and Administration

• Fundamentals of Information Systems Security, Fourth Edition, by David Kim and Michael G. Solomon, is the textbook
• Security operations, policies, audits, testing, and monitoring are crucial components in IT infrastructure.
• Security administration encompasses planning, designing, implementing, and monitoring an organization's security plan.
• The security operations center (SOC) is the physical location for security administration
• Information assets must be identified and documented, and assigned to individuals or positions.

Controlling Access

• Identification involves users asserting who they are.
• Authentication verifies these assertions.
• Authorization determines the permissions for legitimate users/processes.
• Accountability tracks the actions of both authenticated and unauthenticated users.

Documentation, Procedures, and Guidelines

• Essential documentation includes sensitive assets, security processes, and the authority of responsible personnel.
• Security policies, procedures, and guidelines need to be in place for compliance purposes.
• Compliance occurs on two levels: regulatory and organizational.

Disaster Assessment and Recovery

• The security administration team handles incidents and disasters.
• An incident response team works to investigate security breaches.
• Emergency operations groups (if necessary) protect sensitive data.

Security Outsourcing

• Advantages include expertise inaccessible in-house.
• Disadvantages encompass the lack of internal knowledge within the outsourcing firm and the ongoing cost to the organization.

Outsourcing Considerations

• Privacy, risk, data security, ownership, and adherence to policy are critical considerations for outsourcing.

Common Outsourcing Agreements

• Service-level agreements (SLAs), blanket purchase agreements (BPAs), memorandums of understanding (MOUs), and interconnection security agreements (ISAs) are common outsourcing agreements.

Compliance

• Event logs record actions from operating systems and applications.
• Compliance liaisons ensure personnel understand and comply with policies.
• Remediation fixes broken or defective systems, including fixing vulnerabilities.

Professional Ethics

• Setting a good example, encouraging ethical behavior, and providing security awareness training are vital for ethical standards.

Common Fallacies About Ethics

• Users sometimes believe their computer usage, security, and information access are justified and excused as expressions of freedom of speech.
• They may think minor damage or abuse of systems is inconsequential.
• Misconceptions about hacking frequently arise.

Codes of Ethics

• A code of ethics promotes professionalism.
• The Internet Architecture Board (IAB) publishes guidelines on acceptable internet practices.
• Organizations should collect only necessary information, and do not share or use information outside of its initial intended purpose.
• Information should be kept up to date.
• Information should be properly destroyed once no longer needed.

Personnel Security Principles

• Access should be limited.
• Separation of duties, job rotation, and mandatory vacations are key security controls.
• Security training, awareness, and social engineering countermeasures must be considered..

The Infrastructure for an IT Security Policy

• It includes policies, standards, procedures, baselines, and guidelines

The Security Policy Environment

• Security policies are influenced by regulations, organizational objectives, laws, and shareholder interests.
• (Figure 9-1) depicts these influences.

The Security Policy Hierarchy

• A hierarchy of policies exists (Figure 9-2).
• Organizational security policy statements direct the entire security structure.
• Functional policies underpin organizational policies. (various examples are provided)
• Supporting mechanisms such as procedures and baselines are included.

Systematic Actions

• (Figure 9-3) depicts intrusion, tampering, and material destruction, all relating to corporate procedures.

Baseline Corporate Configuration

• (Figure 9-4) highlights VPN Setup, IDS Configuration, and Password Rules.

Data Classification Standards

• Data owners and system owners are critical to data classification standards.
• Classifying criteria includes value, sensitivity, and criticality.

Information Classification Objectives

• These objectives include identifying information requirements, valuing data, cost effectiveness and standards, informing all stakeholders, ensuring compliance with regulations and laws

Examples of Classification

• U.S. government classification (e.g., UnClassified, Secret, Top Secret) is highly standardized.
• Private sector classification varies by organization.

Classification Procedures

• Effective data classification depends on clear procedures.
• Determining the scope, process, and conducting a business impact analysis are crucial.
• Data value is assessed based on factors such as possession, utility, cost, liability, convertibility, operational impact and threats.

Assurance

• Internal and external auditors review data classification policies and procedures for compliance.
• Information security personnel need to routinely monitor classified materials. Incident reports are vital if violations occur.

Configuration Management

• This process manages the change process involved with managing computer and device configurations, assessing the impact of changes, and ensuring security professionals manage change.

Hardware Inventory and Configuration Chart

• Procedures exist to ensure configurations are up to date for hardware components for patches, and upgrades.

The Change Management Process

• Processes are in place to manage changes to baseline settings, configuration settings, and the change control process.

Change Control Management

• Procedures for change control include communication, proactive/reactive approaches, documentation in case of a change failure.

Change Control Committees

• Committees ensure changes are properly tested, authorized, scheduled, communicated and documented

Change Control Procedures

• (Figure 9-5) illustrates the steps in change control: Request, Impact Assessment, Approval, Build/Test, Implementation, and Monitoring.

Change Control Issues

• Peer reviews double-check changes.
• Back-out plans exist for restoring systems.
• Comprehensive documentation is vital.

Application Software Security

• Processes for software development include the system life cycle (SLC) and the system development life cycle (SDLC).
• Steps are similar, but SDLC ends with production.

The System Life Cycle

• The system life cycle involves initiation, planning, requirements, design, build, acceptance, implementation, operations, maintenance, and disposal.

Testing Application Software

• Tests encompass expected and unexpected actions, error handling, load testing (transaction volume, memory, bandwidth, and response times).
• Production and sensitive data must be protected during testing.
• New equipment should meet standards established for system security.
• Management must accept the security systems.

Systems Procurement

• Evaluating new solutions, vendors, and common criteria (maintenance, support, and training) are important.
• Installing equipment properly and following procurement process are required.
• Monitor systems and replace them at the end of their useful lifecycle.

Software Development and Security

• Applications must validate user authorization, recover from failure, handle errors, and maintain secure configuration baselines.
• Applications need frequent patches to ensure security.

Software Development Models

• Waterfall model and Agile development method are widely used.

The Waterfall Model

• (Figure 9-6) shows the sequential steps in the waterfall model: Requirements, Design, Construction, Integration, Testing, Installation, and Maintenance.

The Agile Software Development Method

• (Figure 9-7) illustrates the dynamic aspects.

Summary

• Key concepts for security operations and administration are summarized.

Test your knowledge on the fundamentals of security operations and administration with this quiz based on David Kim and Michael G. Solomon's textbook. Explore topics such as security policies, access control, and documentation processes essential for IT infrastructure. Enhance your understanding of how to manage and protect information assets effectively.