Information Security Principles and Practices by Mark Merkow

Information Security Principles and Practices by Mark Merkow and Jim Breithaupt Chapter 2: Information Security Principles of Success

Chapter 2 n Chapter 2: Information Security Principles of Success © Pearson Education Information Security: Principles and Practices 2

Objectives n n Build an awareness of 12 basic principles of information security…to help you to determine how these basic principles are applied to real life situations. Distinguish between the three main security goals Learn how to design and apply the principle of “Defense in Depth” Explain the difference between functional and assurance requirements © Pearson Education Information Security: Principles and Practices 3

Introduction n Many of the topics you study can be implemented at the lab, for example new programming, system analysis and design projects, BUT Security is a little different… The best security specialists combine their: practical knowledge of computers and networks with Theories about security, technology, and human nature. These concepts, some borrowed from other fields like military defense, often take years © Pearson Education Information Security: Principles and Practices 4

Of experience to learn. n n Note that no two systems are identical in solving the security problems, and no books to consult on how to solve security problems, so you have to depend on principle –based analysis and decision making. This chapter introduce these key information principles, concepts… © Pearson Education Information Security: Principles and Practices 5

Information Security Principles: #1 There Is No Such Thing as Absolute Security n n Van Gogh, Picasso, the paintings were protected by closed circuit television, a series of alarm systems. Thieves broke into the museum and made off with three masterpieces. Investigators discovered that there was a note from the thieves saying: “The intention was not to steal, only to high light the woeful security” © Pearson Education Information Security: Principles and Practices 6

So… n Given enough time, tools, skills, a hacker can break through ﻳﺨﺘﺮﻕ any security measure… n This principle applies to the physical world as well and is best illustrated by using the analogy of saves ﺧﺰﺍﺋﻦ which business commonly use to protect their assets ﻣﻤﺘﻠﻜﺎﺕ © Pearson Education Information Security: Principles and Practices 7

Principle 2: The security goals are Confidentiality, Integrity, and Availability (CIA) All the security measures try to address at least one of the three goals: - Protect the Confidentiality of data. - Preserve the Integrity of data. - Promote the Availability of data for authorized use. © Pearson Education Information Security: Principles and Practices 8

n These goals are described by the following figure, where CIA is the basis of all security programs. n IS professionals who create polices and procedures must consider each goal when creating a plan to protect a computer system. © Pearson Education Information Security: Principles and Practices 9

Confidentiality by Another Name Confidentiality is sometimes referred to as the “ principle of least privilege ﻣﺒﺪﺃ ﺍﻻﻣﺘﻴﺎﺯﺍﺕ ﺍﻷﻘﻞ • Meaning that users should only be given enough privilege to perform their duties, and no more. - Some other synonyms for confidentiality you may encounter include Privacy, Secrecy ﺍﻟﺴﺮﻳﺔ , and discretion ﺣﺮﻳﺔ ﺍﻟﺘﺼﺮﻑ n © Pearson Education Information Security: Principles and Practices 10

Ø Protect the confidentiality of data q q Confidentiality are primarily intended to assure that no unauthorized access to information is permitted Common Confidentiality controls are user ID and Password © Pearson Education Information Security: Principles and Practices 11

Principles 2: Three Security Goals cont. Ø n n Preserve the integrity of data Integrity of data should be done to protect data from any accidental changes. Integrity has three goals: 1 - prevent unauthorized users from making modifications to data or programs 2 - prevent authorized users from making improper or unauthorized modifications. 3 - maintain internal and external consistency of data and programs. © Pearson Education Information Security: Principles and Practices 12

n Promote the availability of data for authorized use q q Availability keep data and resources available for authorized use, especially during emergencies or disasters. Information security professionals usually address three common challenges to availability: Denial of Service (Do. S) ﺍﻟﺤﺮﻣﺎﻥ ﻣﻦ ﺍﻟﺨﺪﻣﺔ Due to international attacks Loss of information system capabilities because of natural disasters (e. g. , fires, storms, or earthquakes) © Pearson Education Information Security: Principles and Practices 13

n Equipment failures during normal use. n Note: some of the activities that preserve CIA are: n the granting of access only to authorized personnel, applying encryption to information that will be sent out over the internet. Periodic testing of operating system security. n n © Pearson Education Information Security: Principles and Practices 14

Principles 3: Defense in Depth as Strategy n n n A bank would never leave its assets ﻣﻤﺘﻠﻜﺎﺕ inside an unguarded safe ﺧﺰﻧﺔ alone. Typically, access to the safe requires passing through layers of protection that may include human guards and locked doors with special access control. Furthermore, the room where the safe resides may be monitored by closed circuit television, motion sensors, and alarm systems that can detect quickly unusual activity. (Layers…. ) © Pearson Education Information Security: Principles and Practices 15

n the sound of an alarm may trigger the doors to automatically lock ﺻﻮﺕ ﺍﻧﺬﺍﺭ ﻗﺪ ﺗﺆﺪﻱ ﺍﻟﻰ ﻗﻔﻞ ﺍﻷﺒﻮﺍﺏ ﺗﻠﻘﺎﺋﻴﺎ the police to be notified (Layers…) n Layered security, like the example described above, is called Defense in Depth. n Defense in Depth is security implemented in overlapping layers that provide three elements needed to secure assets: Prevention, Detection, and Response © Pearson Education Information Security: Principles and Practices 16

n Defense in Depth also means that the weaknesses of one security layer are offset ﻳﻌﻮﺽ ﻋﻦ by the strengths of two or more layers. n In the Information security world, defense in depth means you should layer security devices in a series that protects, detects, and responds to attacks on systems. © Pearson Education Information Security: Principles and Practices 17

Principles 4: When Left on Their Own, People Tend to Make the Worst Security Decisions n The primary reason that identify theft, viruses, and stolen passwords are so common is that people are easily duped into giving up ﻳﺘﺨﻠﻲ ﻋﻦ the secrets that technologies use to secure systems. n ﻭﺳﺮﻗﺔ ﻛﻠﻤﺎﺕ ، ﻭﺍﻟﻔﻴﺮﻭﺳﺎﺕ ، ﺍﻟﺴﺒﺐ ﺍﻷﺴﺎﺳﻲ ﺃﻦ ﺳﺮﻗﺔ ﺍﻟﻬﻮﻳﺔ ﺍﻟﺴﺮ ﻫﻲ ﺷﺎﺋﻌﺔ ﺟﺪﺍ ﻫﻮ ﺃﻦ ﺍﻟﻨﺎﺱ ﺑﺴﻬﻮﻟﺔ ﺗﺨﺪﻉ ﻓﻲ ﺍﻟﺘﺨﻠﻲ ﻋﻦ . ﺍﻷﺴﺮﺍﺭ ﺍﻟﺘﻲ ﺗﺴﺘﺨﺪﻡ ﺍﻟﺘﻜﻨﻮﻟﻮﺟﻴﺎﺕ ﻟﺘﺄﻤﻴﻦ ﺍﻟﻨﻈﻢ © Pearson Education Information Security: Principles and Practices 18

n n n Virus writers know all too well how easy it is to fool ﻳﺨﺪﻉ people into spreading their viruses for them ﻛﺎﺗﺒﻲ ﺍﻟﻔﻴﺮﻭﺳﺎﺕ ﺗﻌﻠﻢ ﺟﻴﺪﺍ ﻛﻢ ﻫﻮ ﺳﻬﻞ ﻟﺨﺪﺍﻉ ﺍﻟﻨﺎﺱ ﻓﻲ ﻧﺸﺮ ﻫﺬﻩ ﺍﻟﻔﻴﺮﻭﺳﺎﺕ ﻟﻬﺎ When the file was opened, the virus can copy itself to the Windows directory and then send the file as an attachment to all the addresses listed in the victim’s Microsoft Outlook email address book © Pearson Education Information Security: Principles and Practices 19

Practice Pages 24 -25 ……. Lab…ID theft © Pearson Education Information Security: Principles and Practices 20

Note on: When Left on Their Own, People Tend to Make the Worst Security Decisions n Many people are easily convinced to doubleclick on the attachment Subject: Here you have, ; o) Message body: Hi: Check This! Attachment: Anna. Kournikova. jpg. vbs © Pearson Education Information Security: Principles and Practices 21

Principle 5: Computer Security Depends on Two types of Requirements: Functional and Assurance Requirements n Functional requirements q n Assurance requirements q n Describe what a system should do Describe how functional requirements should be implemented and tested Both sets of requirements are needed to answer the following questions: © Pearson Education Information Security: Principles and Practices 22

Does the system do the right things (behave as expected)? Does the system do the right things in the right way? q q Verification: ﺍﻟﺘﺤﻘﻖ Is the process of confirming that one or more predetermined requirements or specifications are met Validation ﺍﻟﺘﺤﻘﻖ ﻣﻦ ﺍﻟﺼﺤﺔ : Is a determination of the correctness or quality of the mechanisms used in meeting the needs © Pearson Education Information Security: Principles and Practices 23

n n Using car safety testing as an example, verification testing for seat belt functions may include stress tests on the fabric, testing the locking mechanisms, and making certain the belt will fit the intended application, thus completing the functional tests. Validation, or assurance testing , might then include crashing ﺗﺤﻄﻢ the car with crash-test dummies inside to “prove” that the seat belt is indeed safe when used under normal conditions and can survive under harsh conditions © Pearson Education Information Security: Principles and Practices 24

Information Security Principles: #6 Security Through Obscurity Is Not an Answer n Many people believe that if hackers don’t know how software is secured, security is better q n Although this seems logical, it’s actually untrue Obscuring security leads to a false sense of security, which is often more dangerous than not addressing security at all © Pearson Education Information Security: Principles and Practices 25

Information Security Principles: #7 Security = Risk Management n n n Security is not concerned with eliminating all threats within a system or facility but with eliminating known threats and minimizing losses if an attacker succeeds in exploiting a vulnerability Risk analysis and risk management are central themes to securing information systems Risk assessment and risk analysis are concerned with placing an economic value on assets to best determine appropriate countermeasures that protect them from losses © Pearson Education Information Security: Principles and Practices 26

Information Security Principles: #7 Security = Risk Management cont. n Vulnerability q n Exploit q n A known problem within a system or program A program or a “cookbook” on how to take advantage of a specific vulnerability Attacker q The link between a vulnerability and an exploit © Pearson Education Information Security: Principles and Practices 27

Information Security Principles: #7 Security = Risk Management cont. © Pearson Education Information Security: Principles and Practices 28

Information Security Principles: #8 Security Controls: Preventative, Detective, and Responsive n A security mechanism serves a purpose by preventing a compromise, detecting that a compromise or compromise attempt is underway, or responding to a compromise while it is happening or after it has been discovered © Pearson Education Information Security: Principles and Practices 29

Information Security Principles: #9 Complexity Is The Enemy of Security n The more complex a system gets, the harder it is to secure © Pearson Education Information Security: Principles and Practices 30

Information Security Principles: #10 Fear, Uncertainty, and Doubt (FUD) Do Not Work in Selling Security n n Information security managers must justify all investments in security using techniques of the trade When spending resources can be justified with good, solid business rationale, security requests are rarely denied © Pearson Education Information Security: Principles and Practices 31

Information Security Principles: #11 People, Process and Technology Are All Needed n People, process, and technology controls are essential elements of security practices including operations security, applications development security, physical security, and cryptography © Pearson Education Information Security: Principles and Practices 32

Information Security Principles: #12 Open Disclosure of Vulnerabilities Is Good for Security n n Keeping a given vulnerability secret from users and from the software developer can only lead to a false sense of security The need to know trumps the need to keep secrets in order to give users the right to protect themselves © Pearson Education Information Security: Principles and Practices 33

Summary n n Computer security specialists must not only know the technical side of their jobs but also must understand the principles behind information security These principles are mixed and matched to describe why certain security functions and operations exist in the real world of IT © Pearson Education Information Security: Principles and Practices 34