Transcript ABOVE SECURITY CANTOE Robert Potvin

Speaker
• Robert Potvin, CISSP & CBCP
• 15 years of IT Security Experience
• Senior Consultant of Above Security
• Operations in Montreal, Ottawa, Toronto and Bahamas working
with 160 customers in 11 countries
Confidential Document
1
ISO-17799 Overview
• BS7799 was created in 1999 as a two part document (standard +
certification scheme) by the British Standards Institution (BSI)
• The standard portion was adopted and converted into an ISO standard in
2000
• The certification scheme portions is still a BSI only standard and it’s latest
revision is dated 2002
• Many worldwide governments policies, standards, guidelines and best
practices are based, inspired or in compliance with ISO17799:2000 &
BS7799-2:2002 and some of them don’t even know it 
• There is a general misconception that it is not a complete standard
because it lacks implementation guidelines
• Since it was built by a standard organization (BSI), the implementation
guidelines where intentionally left out of the document and regroup into
other specific standards and “security techniques” (i.e.: ISO13335,
PAS56…)
Confidential Document
2
ISO-17799:2000 Overview
• 127 controls distributed within 10 categories
-
Information security policy
Organizational security
Asset classification and control
Personnel security
Physical & environmental security
Communication & operations management
Access control
System development & maintenance
Business continuity management
Compliance
• Uses a Plan/Do/Check/Act implementation and operation model that starts
with a risk assessment to established the required security controls
needed to adequately manage information security risks within the
business processes
• Used in conjunction with BS7799, it also establish documentation,
revision, communication, training, auditing and continuous improvement
requirements
Confidential Document
3
ISO-17799 Overview
• Complementary standards and guidelines where inspired by ISO17799,
design to or supports the implementation of ISO17799:
-
AS/NSZ-4360:2004, Risk Management Guidelines
HB-231:2004, Information Security Risk Management Guidelines
ISO-19011:1996, Guidelines for Management System Auditing
PAS56:2003, Guide to Business Continuity Management
ISO/TR-18044:2004, Information Security Incident Management
ISO-GMITS:1996/2001 (Guidelines for the Management of IT Security):
•
•
•
•
•
ISO/TR-13335/1:1996,
ISO/TR-13335/2:1997,
ISO/TR-13335/3:1998,
ISO/TR-13335/4:2000,
ISO/TR-13335/5:2001,
Concepts and Model for IT Security
Planning IT Security
Management of IT Security
Selection of safeguards
Management guidance on network security
• CoBIT control objectives are fully mapped to support ISO17799
• ITIL is especially efficient for ‘Communication & Operations Management’
Confidential Document
4
What’s new in ISO-17799:2005 ?
• Risk management where addressed only in part 2 document, the part 1 now
includes a new chapter on ‘Risk Assessment and Treatment’ requirements
• ‘Asset classification and control’ evolve into a more holistic ‘Asset
management’ approach
• ‘Personnel Security’ evolve into ‘Human resources security’ which now
emphasis on what’s needed before, during and on termination of employment
• ‘Communication and operations management’ now includes service delivery
management of 3rd parties (i.e.: outsourcer performance and security
obligation monitoring)
• Introduction of ‘Technical Vulnerability Management’
• Incident management controls that where spread all around the previous
version of the standard are now consolidated within a new chapter titled
‘Information Security Incident Management’
• In short: 2 new control families, a new total of 135 controls, over 80 changes
within the existing controls (deletion/addition/modification)
Confidential Document
5
Defining Information System
Information System
Applications
(Web, SAP, PeopleSoft…)
Application Servers
(IIS, SQL, WebSphere, Oracle…)
Users
Customers
Operating Systems
(Win2K, XP, Unix, OS/400…)
Networking
(TCP/IP, FW, Router, Switch)
Confidential Document
6
Copyright 2004 - Above Security
Defining Information Security
• Assets oriented Information Security:
-
Protecting Confidentiality
Insuring Integrity
Preserving Availability
Addressing Compliancy
Augmenting Reliability
• Business oriented information security:
-
Managing risk
Insuring business continuity
Protecting corporate image
Protecting shareholders’ value
Confidential Document
7
Copyright 2004 - Above Security
Defining Information Security
• From Technology Protection to People and Process:
• False sense of protection…..
- Firewalls
- VPNs
- IDS
- Applications
- Wireless
Confidential Document
8
Copyright 2004 - Above Security
Problems with Firewalls
•Definition
- A Firewall filters available services from your
company incoming from and outgoing to the
Internet.
•Problems
- Will not prevent hackers from interacting with your
company.
- Often badly configured incoming and outgoing.
- Logging is often poorly configured.
- Who checks the Logs ?
Confidential Document
9
Problems with VPN
•Definition
- Virtual Private Network.
- Remote access system.
- Replacing traditional dial-up modem pools on the
net.
•Problems
- Inexpensive to attack.
- Often available for Whoever, Whenever, Wherever.
- Few companies use strong authentication.
- Once inside, there is no limited field of action to
users.
Confidential Document
10
Problems with IDS
•Definition
- Intrusion Detection System
•Problems
- False positives, false negatives.
- Limited load capacity
- Correlation of event is painful.
- Companies often only use the network IDS.
- 24x7 monitoring is required.
- Incident handling and response procedure often
lacking.
- IDS are only alarm systems – useless without
monitoring and a central police force.
Confidential Document
11
Problems with Applications
Problems:
- Privileges:
• Web server volume and client-server
applications with plenty of privileges.
- Developers Inexperience:
• Often no security training.
• Insufficient controls and logs to protect
systems.
- Validation:
• Insufficient validation in data entry and data
consultation.
– Important information leakages.
Confidential Document
12
Problems with Wireless
•Problem
- Only 25% of companies use the WEP.
- Give an unwatched access to the internal network.
•Bad Architecture (Direct access to internal network)
•Examples:
- Jamaica – New Kingston.
• More than 80 access points were discovered.
• 80% did not use the WEP.
- Montreal (in 2 hours)
• More than 200 access points discovered.
• 85% did not use the WEP.
Confidential Document
13
How to diagnose? Penetration Testing
•Formal and structured attack simulation against your
infrastructure
•An attack that will try to use any privileges and
information available to both legitimate and non
legitimate users to gain access to confidential
information
•An approach that will try to exploit every weaknesses
of your systems both internal, external, application
and physical
•A formalized operation that will outline what are your
exposure to attacks and how complex conducting
those attack might be
Confidential Document
14
Copyright 2004 - Above Security
Penetration testing steps
Five step to successful penetration
1. Gaining knowledge about the victim, it’s
network, services and applications
2. Scanning the overall infrastructure for
potential vulnerabilities that might be present
at the various layers
3. Exploit the security breaches to gain access
to your systems that might enable us to go
further in your network
4. Implement backdoor to preserve the access
5. Erase the traces
Confidential Document
15
Copyright 2004 - Above Security
Example of successful hack
•
Being able to gain access to confidential customer
database
•
Being able to access medical information of
patient on an hospital network
•
Being able to create a bank account and conduct
fraudulent financial transaction
•
Being able to hack the wireless network and gain
full access to the internal network
•
Being able to hack the backup server and access
confidential information that where not under
access control like on the rest of the network
Confidential Document
16
Copyright 2004 - Above Security
Example of successful hack
•
Being able to take control of the corporation
central database server
•
Being able to control the SCADA infrastructure for
lighting, gaz and water treatment facilities
•
Being able to steal intellectual property and
application source code
•
Being able to control the security camera systems
•
And the list can goes on forever…
Confidential Document
17
Copyright 2004 - Above Security
What are we left with ?
•Information Security Challenges:
- Providing universal access to data and systems
- Establishing the right value to assets
- Identifying system weaknesses
- Efficiently monitoring the assets
- Building a corporate culture
- Reaching the right balance between risk,
exposure, usability, protection and investments
But how ?
Confidential Document
18
Copyright 2004 - Above Security
Security Governance
•Governance is: doing things the way they should be
done to protect the business, the employee and
shareholders value
•Risks and threats are real and could have significant
impact on your business
•Information security is the responsibility of the
board; members should sign off the policy
•Information assets possess value; proper protection
should therefore be in place
•Information security is not free; like any investment,
it should be properly managed
Confidential Document
19
Copyright 2004 - Above Security
Security Governance
•Information security governance should deliver:
- Strategic alignment: orientations are driven by business
requirements, not technology, and should impact
productivity as little as possible
- Direction: a standard set of practices coupled with proper
effort distribution, keeping focus on areas with the greatest
impact and business benefits
- Risk management: a list of risks we agree to live with, a
proper understanding of risk exposure and a sufficient
awareness of management priorities
- Measurement: a defines set of metrics to independently
obtain assurance on measurable processes and investment
performance
Confidential Document
20
Copyright 2004 - Above Security
Information security recipe
1.
Implement information security policies
2.
Risk Assessment
3.
Develop a business continuity strategy
4.
Configure proper network and system auditing
5.
Deploy log centralization and analysis
6.
Insure intrusion detection at all layers
7.
Segment your network and reinforce access control
8.
Manage your vulnerabilities
9.
Conduct system security monitoring,
10.
Get independent compliance audit and penetration testing
11.
Security Awareness and Training
Confidential Document
21
Copyright 2004 - Above Security
Ingredient #1
•Information Security Policies:
- It is a management statement that information
security is important
- It provide direction by establishing a set of clearlyarticulated business rules to help people make
decision when using or managing information assets
- It is uniquely tailored to your organization
requirements and business processes
- It is a standard of due care that needs to be
implemented no matter what industry your
organization belongs
Confidential Document
22
Copyright 2004 - Above Security
Information Security Policies
It should minimally contain the following:
1. Organizational security
2. Asset classification and control
3. Users, operators and management roles and
responsibilities
4. System usage guidelines
5. Physical and environmental security
6. Communication and operations management
7. Access control
8. Systems development and maintenance
9. Business continuity
10. Compliance and measurement
Confidential Document
23
Copyright 2004 - Above Security
Ingredient #2
•Risk Management:
- Information security is not about technology, it’s
about managing risk
- A vulnerability is a breach within a system
(reliance on electricity, security hole, lack of
control, physical exposure…)
- A threat is the actual event that can exploit a
vulnerability (virus, electrical storm, hurricane…)
- A risk is the result of the combination of
vulnerability and threat (outage = power failure
cause by storm)
Confidential Document
24
Copyright 2004 - Above Security
Risk Management
Asset Value
Asset Value
Risk =
Volume of cube
Risk
Threat
Threat
Vulnerability
Actual Risk
Confidential Document
Vulnerability
Residual Risk
25
Copyright 2004 - Above Security
Ingredient #3
•Business Continuity:
- BC is the ability to maintain a constant
availability of processes and information
availability
- DR is the immediate and temporary restoration of
computing and network operation within a
defined timeframe after a disaster occurs
- Advanced planning and preparations are
necessary to identify impact and potential losses
and to establish a step by step approach to
business resumption
- A plan is not a static document, it is a living
strategy and an evolving process
Confidential Document
26
Copyright 2004 - Above Security
Cost of Downtimes
Productivity
• Number of
employees affected
x hours out x
burdened hourly rate
Damaged Reputation
• Customers
• Suppliers
• Financial markets
• Banks
• Business partners
• ...
Confidential Document
Know your downtime
costs per hour,
day, two days ...
Other Expenses
• Temporary employees
• Equipment rental
• Overtime costs
• Extra shipping costs
• Travel expenses
• Legal obligations
...
Revenue
• Direct loss
• Compensatory
payments
• Future revenue losses
• Billing losses
• Investment
losses
Financial
Performance
•
•
•
•
•
•
•
Revenue recognition
Cash flow
Lost discounts (A/P)
Payment guarantees
Credit rating
Stock price
…
Source: Gartner Group 2003
27
Copyright 2004 - Above Security
Ingredient #4
•Network Security Monitoring:
- Technical equivalent to security governance
- Corporation tends to neglect an holistic approach
when protecting corporate assets
- Corporation normally focus solely on perimeter
- Defense in depth the best risk mitigation approach
- In brief, it is the combination of hardware,
software, people and processes to monitor and
respond to security incident
Confidential Document
28
Copyright 2004 - Above Security
Components to monitor
Vulnerability
Management
Server logs
Firewall &
VPN Logs
Router &
Switches Log
Network
IDS
Components to
be monitored
Host based
IDS
Application
Based IDS
Application
logs
Policy
Compliance
Anti-Virus
Confidential Document
29
Copyright 2004 - Above Security
Steps for proper monitoring
Information Collection
Centralization and
standardization of the
information
Alert Normalization
Process
Event Correlation
Process
Event Prioritization
Process
Information
Presentation Process
Incident Handling
Intervention
Confidential Document
30
Copyright 2004 - Above Security
The MMI Infrastructure
Confidential Document
31
Copyright 2004 - Above Security
Platforms to support
• Operating Systems: NT, 2000, 2003/XP, AIX, Solaris, HP, Linux,
BSD, OS/400
• Networking: Cisco, Nortel, 3COM
• Firewall/VPN: MS ISA, Checkpoint, Cisco, Netscreen,
Watchguard, Symantec
• IDS: Snort, Cisco, ISS, Enterasys, Tripwire, NFR, NAI, Symantec
• PKI/Strong authentication: RSA, Entrust, Microsoft
• Application servers: MS SQL, IIS, MS Exchange, Lotus Notes,
Websphere, Oracle
• Application: Greatplains, Peoplesoft, SAP, Custom Web Based
Confidential Document
32
Copyright 2004 - Above Security
Solutions
• Attack monitoring at all layers (network, server, application)
• Vulnerability management/change management for complex
infrastructure
• Early warning system for potentially disastrous virus,
vulnerability, worms…
• Pure event correlation (cause to effect analysis)
• Centralization, data reduction and analysis of your server logs
• 24x7 monitoring by highly trained personnel
• Remote real time intervention
• Flexible real time escalation for sensible events
• Forensic
Confidential Document
33
Copyright 2004 - Above Security
Ingredient #5
•Compliance Audit and Testing:
-Last Step (confirm posture)
- First Step (Business Case)
- Solid Methodology (not a sales pitch document !)
- What to look for :
• External infrastructure
• External application interfaces
• Internal Intrusion
• Internal vulnerabilities
• Wireless
• Social engineering
• War Dialing
Confidential Document
34
Copyright 2004 - Above Security
Ingredient #6
•Security Awareness and training:
-Executives
linked to business drivers
Regulations, obligations and risks
- IT
Very technical
Incident analysis
Build a training plan
- End-Users
Real world examples
Link to their daily activities
Confidential Document
35
Copyright 2004 - Above Security
Thanks for attending !
Questions?
Please visit us at our booth !
Web: www.abovesecurity.com
E-mail: [email protected]
HQ Phone: (450) 430-8166
Confidential Document
36