Chapter 1 Security Governance Through Principles and Policies

Chapter 1: Security Governance Through Principles and Policies

Understand Apply Concepts of Confidentiality, Integrity, and Availability • CIA Triad • AAA services • Protection mechanisms 2

CIA Triad • Confidentiality • Integrity • Availability C I A

Confidentiality • • Sensitivity Discretion Critical Concealment Secrecy Privacy Seclusion Isolation

AAA Services • • • Identification Authentication Authorization Auditing Accountability Nonrepudiation

Protection Mechanisms • Layering • Abstraction • Data hiding • Encryption

Apply Security Governance Principles • Alignment of security function to strategy, goals, mission, and objectives • Organizational processes • Security roles and responsibilities • Control frameworks • Due care and due diligence 7

Alignment of Security Function • Alignment to strategy, goals, mission, and objectives • Security policy • Top-down approach • Senior management approval • Plans: strategic, tactical, operational

Organizational Processes • • Security governance Acquisitions and divestitures Change control/management Data classification – Government/military vs. commercial/private sector

Security Roles and Responsibilities • • • Senior manager Security professional Data owner Data custodian User Auditor

Control Frameworks • • • COBIT ISACA OSSTMM ISO/IEC 27002 ITIL NIST

Develop and Implement Documented Security Policy, Standards, Procedures, and Guidelines • Security policies • Security standards, baselines, and guidelines • Security procedures 12

Understand Apply Threat Modeling • Identifying threats • Determining and diagramming potential attacks • Performing reduction analysis • Prioritization and response 13

Identifying Threats • • Focused on assets Focused on attackers Focused on software STRIDE – Spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege

Determining and Diagramming Potential Attacks • • Diagram the infrastructure Identify data flow Identify privilege boundaries Identify attacks for each diagrammed element

Performing Reduction Analysis • • • Trust boundaries Data flow paths Input points Privileged operations Details about security stance and approach

Prioritization and Response • Probability × damage potential ranking • High/medium/low rating • DREAD system – Damage potential – Reproducibility – Exploitability – Affected users – Discoverability

Integrate Security Risk Considerations into Acquisition Strategy and Practice • • • Resilient integrated security Cost of ownership Outsourcing Integrated security assessments Monitoring and management – Onsite assessment – Document exchange and review – Process/policy review