Mitigating network attacks requires a comprehensive, end-to-end approach that includes creating and maintaining security policies based on the security needs of an organization. The first step in establishing an organization's security needs is to identify likely threats and perform a risk analysis, the results of which are used to establish the security hardware and software implementations, mitigation policies, and network design.
To help simplify network design, it is recommended that all security mechanisms come from a single vendor. The Cisco Self-Defending Network (SDN) is a comprehensive, end-to-end solution for network security. Cisco Security Manager and Cisco MARS provide network management options for Cisco SDN solutions.
After the network is designed, operations security entails the day-to-day practices necessary to first deploy and later maintain the secure system. Part of maintaining a secure system is network security testing. Security testing is performed by the operations team, to ensure that all security implementations are operating as expected. Testing is also used to provide insight into business continuity planning, which addresses the continuing operations of an organization in the event of a disaster, disruption, or prolonged service interruption.
After a secure network is implemented and continuity plans are established, those plans and documents must be continuously updated based on the changing needs of the organization. For this reason, it is necessary to understand the system development life cycle (SDLC) for the purposes of evaluating system changes and adjusting security implementations. The SDLC includes five phases: initiation, acquisition and development, implementation, operations and maintenance, and disposition. It is important to include security considerations in all phases of the SDLC.
A network security system cannot completely prevent assets from being vulnerable to threats. New attacks are developed and vulnerabilities identified that can be used to circumvent security solutions. Additionally, technical, administrative, and physical security systems can be defeated if the end user community does not adhere to security practices and procedures. A comprehensive security policy must be maintained which identifies an organization's assets, specifies the security hardware and software requirements for protecting those assets, clarifies the roles and responsibilities of personnel, and establishes the proper protocol for responding to security breaches. If security policies are established and followed, organizations can minimize the loss and damages resulting from attacks.
In a comprehensive hands-on lab for the chapter, Security Policy Development and Implementation, learners create a basic security policy, harden network routers, configure remote access and authentication options, configure NTP and logging, configure a CBAC firewall, configure a ZPF firewall, configure IPS using CLI and SDM, back up and secure router images and configuration files, harden network switches, configure remote access and authentication options, mitigate STP attacks, and configure and test remote access IPsec VPNs. The lab is found in the lab manual on Academy connection at cisco.netacad.net.
A comprehensive Packet Tracer activity, Configure a Network for Secure Operation, provides learners additional practice implementing the technologies introduced in this final chapter. Learners secure the routers with strong passwords and password encryption, secure the console and VTY lines, configure login banners, configure local AAA authentication, configure SSH, configure syslog, configure NTP, harden the network routers, configure CBAC, configure ZPF, and secure the network switches. Packet Tracer activities for CCNA Security are found on Academy Connection at cisco.netacad.net.
Mitigating network attacks requires a comprehensive, end-to-end approach:
Despite these security techniques, hackers are continuously developing new ways to attack networks. An important part of implementing a secure network is creating and maintaining security policies to mitigate existing as well as new kinds of attacks. These policies enforce a structured, informed, consistent approach to securing the network. When developing security policies, several questions must be answered:
Many security assumptions are made when designing and implementing a secure network. Unfortunately, unfounded assumptions about how and where the system will be used can lead to broken, misconfigured, or bypassed security mechanisms. An example of a bad assumption is that more users need to use a protocol, such as FTP, than is actually the case.
A wrong assumption has negative ramifications for all design work. It might influence one design decision, and then propagate to other decisions that depend on it. Wrong decisions are especially dangerous in early stages of secure system design when threats are modeled and risks are assessed. It is often easy to correct or enhance a single implementation aspect of a system, such as a firewall configuration. However, design errors, such as where that firewall is placed, are either extremely hard or impossible to correct without substantial investments in time and technology.
There are guidelines to help you avoid making wrong assumptions:
One of the first steps to establishing an organization's security needs is to identify likely threats. Threat identification provides an organization with a list of threats that a system is subject to in a particular environment. When identifying threats, it is important to ask two questions:
For example, threat identification for connecting an e-banking system would include:
Identifying vulnerabilities on a network entails understanding the important applications that are used as well as the different vulnerabilities of that application and hardware. This can require a significant amount of research on the part of the network administrator.
Risk analysis is the systematic study of uncertainties and risks. It estimates the probability and severity of threats to a system and provides an organization with a prioritized list. Risk analysts identify the risks, determine how and when those risks might arise, and estimate the impact (financial or otherwise) of adverse outcomes.
The first step in developing a risk analysis is to evaluate each threat to determine its severity and probability:
After the threats are evaluated for severity and likelihood, the information is used in a risk analysis. There are two types of risk analysis in information security, quantitative and qualitative.
Quantitative Risk Analysis
Quantitative risk analysis uses a mathematical model that assigns a monetary figure to the value of assets, the cost of threats being realized, and the cost of security implementations. Monetary figures are typically based on an annual cost.
Qualitative Risk Analysis
There are various ways of conducting qualitative risk analysis. One method uses a scenario-based model. This approach is best for large cities, states, and countries because it is impractical to try to list all the assets, which is the starting point for any quantitative risk analysis. For example, by the time a typical national government lists all of its assets, the list would have hundreds or thousands of changes and would no longer be accurate.
With qualitative risk analysis, research is exploratory and cannot always be graphed or proven mathematically. It focuses mostly on the understanding of why risk is present and how various solutions work to resolve the risk. Quantitative risk analysis is more mathematically precise and typically used by organizations as cost justification for proposed countermeasures. For this reason, the next topic investigates the specifics of building a quantitative risk analysis.
Quantitative analysis relies on specific formulas to determine the value of the risk decision variables. These include formulas that calculate the asset value (AV), exposure factor (EF), single loss expectancy (SLE), annualized rate of occurrence (ARO), and annualized loss expectancy (ALE).
Asset Value
The asset value includes the purchase price, the cost of deployment, and the cost of maintenance. In the instance of a database or a web server, the AV should also include the cost of development. AV is not an easy number to calculate.
Exposure Factor
The exposure factor is an estimate of the degree of destruction that could occur. For example, suppose water flooding is a possibility that could affect the e-banking data center. What is the likelihood that it could destroy the data center? Would the destruction be 60 percent, 80 percent, or 100 percent? The risk assessment team must evaluate all possibilities and then make a determination. Assuming that a backup copy of all media and data is stored offsite, the only losses are to the hardware and productivity. Therefore, a flood would have a 60 percent destruction factor.
As another example, consider data entry errors, which are much less damaging than a flood. A single data entry error is most likely less than a fraction of a percent in exposure, or .001 percent.
Single Loss Expectancy
The single loss expectancy calculation represents the expected loss from a single occurrence of the threat. The SLE is defined as AV multiplied by EF. Using the previous examples, the SLE calculations result in the following:
Flood threat
Data entry error
Annualized Rate of Occurrence
The annualized rate of occurrence estimates the frequency of an event and is used to calculate the ALE.
Using the previous examples, the type of flood to affect the data center would be a flood-of-the-century event, so it has a 1/100 chance of occurring this year, making the ARO for the flood 1/100.
Expect a data entry error to occur 500 times a day. Because the organization is open for business 250 days per year, estimate the ARO for the data entry error to be 500 * 250, or 125,000 total occurrences.
Annualized Loss Expectancy
Risk analysts calculate the ALE in annualized terms to address the cost to the organization if the organization does nothing to counter existing threats. The ALE is derived from multiplying the SLE by the ARO. The ALE calculations for the examples are surprising.
Data input error
A decision to spend US$50,000 to enhance the security of database applications to reduce data entry errors significantly is now an easy decision. It is equally easy to reject a proposal to enhance the defenses against floods that cost US$3,000,000.
It is necessary to perform a quantitative risk analysis for all threats identified during the threat identification process.
A list of all identified threats should state each expected issue, the relative cost of that issue, and the total cost if all expected threats are realized. This list should then be prioritized based on the most serious threat and relative cost.
If an organization had a list of 10 expected threats, it could then prioritize the threats and address the most serious ones first. This prioritization enables management to focus resources where they do the most good. For example, suppose an organization compiled this list of threats and costs:
Assume that a current anti-virus solution is in place and decision makers must decide whether to update it. Based on quantitative analysis, decision makers could determine that resources are best used toward addressing insider network abuse and not toward the new anti-virus solution.
In incidents that involve national security, it is not advisable to base decisions on cost.
When the threats are identified and the risks are assessed, a protection strategy must be deployed to protect against the risks. There are two very different methods to handle risks:
Consider the bank that wants to provide e-banking services. Risk management can be illustrated by high-level strategy decisions, which describe how to mitigate each risk. Keep in mind that not all mitigation techniques are implemented based on the risk versus cost formula used in the quantitative risk analysis:
Using the risk avoidance approach, a company would decide to not offer e-banking services at all because it is deemed too risky. Such an attitude might be valid for some military organizations, but is usually not an option in the commercial world. Organizations that can manage the risks are traditionally the most profitable.
After an organization identifies threats, it performs the appropriate analysis. If they decide to manage the risk, the next step is to create a security solution.
In the past, threats from internal and external sources moved slowly, and it was easy to defend against them. Now, Internet worms spread across the world in a matter of minutes. Security systems, and the network itself, must react instantaneously. As the nature of threats to organizations continues to evolve, the defensive posture taken by network security professionals and managers must also evolve. However, it is important that the evolution of network security solutions does not introduce complexity.
Complexity is one of the biggest enemies of security. Complexity makes it hard for the designer or administrator to predict how parts of the system will interact, and makes the system hard or impossible to analyze from a security perspective. Simplicity of design and implementation should therefore be one of the main goals of the designer. To meet complex security needs, consider using multiple, simple, and easy-to-verify mechanisms.
Simplicity is beneficial for the end users of the system. If the end user does not understand the system adequately, the system can be compromised through unintentional misuse. One way to introduce simplicity is to disable all unnecessary services that a system offers. Disabling unnecessary services removes many potential attack possibilities. On an end-user device, this practice is known as the enforcement of least privilege.
The concept of least privileges specifies that each subject, user, program, or host should have only the minimum necessary privileges to perform tasks. Having too many privileges allows end users to do more damage, whether intentional or unintentional, than would otherwise be possible. Least privilege also simplifies system analysis for possible flaws.
In addition to disabling unnecessary services on host devices, simplicity also entails disabling unnecessary services and features on networking devices. This is known as hardening.
Another way to simplify security is to help simplify end user functions. For example, if email must be encrypted when sent to external partners, the simplest solution is to use technology, such as a mail gateway, to automate email encryption.
Finally, simplicity should be built into the security design. There are many security solution vendors. To help simplify the design, it is recommended that all security mechanisms come from a single vendor. The Cisco Self-Defending Network (SDN) is a comprehensive, end-to-end solution for network security.
A Cisco Self-Defending Network uses the network to identify, prevent, and adapt to threats. Unlike point-solution strategies, where products are purchased individually without consideration for which products work best together, a network-based approach is strategic and meets the current challenges and evolves the security capability to address new security threats.
To enable its strategy, a Cisco Self-Defending Network has three key principles:
The Cisco Self-Defending Network strategy starts with a strong, secure, and flexible network platform. Security services are then layered on top of this platform as needed. Several security services are available through the Cisco Self-Defending Network:
Individual point solutions from a variety of vendors increase costs over time because of unplanned network design adjustments, inconsistencies, and complexities. The Cisco Self-Defending Network increases the value of an investment over time by using a common infrastructure. Management is more efficiently performed when it is simplified, enabling the identification and resolution of gaps before they become disabling vulnerabilities in the network design.
The Cisco Self-Defending Network approach is comprehensive and includes the following tools to provide security services:
There are a number of additional benefits that result from this comprehensive, integrated approach:
This enhanced threat control and containment solution portfolio delivers comprehensive threat protection across the entire infrastructure ensuring business continuity.
Threat Control and Containment
The Cisco Threat Control and Containment solution protects the network, servers, endpoints, and information. It is enabled by behavioral-based endpoint protection, DDoS mitigation, intrusion prevention, network anti-virus, policy enforcement, and proactive response. It regulates network access, isolates infected systems, prevents intrusions, and protects critical business assets. The Cisco Threat Control and Containment counteracts malicious traffic such as worms, viruses, and malware before they affect business through the use of centralized policy, configuration, and threat event management.
The Cisco Threat Control and Containment solution contains three elements:
There are a number of benefits to the Cisco Threat Control and Containment solution:
Secure Communications
Many organizations use the flexibility and cost effectiveness of the Internet to extend their network to branch offices, telecommuters, customers, and partners. When an organization extends its network in this way, ensuring the privacy and integrity of all information sent across the Internet is vital. This requires a manageable and cost-effective communications infrastructure that allows for secure communications. Secure communication is achieved through the use of IPsec and SSL VPNs.
There are several benefits to implementing a secure communications infrastructure:
The Cisco Secure Communications solution is a set of security services. These services are essential to the Cisco Self-Defending Network. The secure communications solution has two major elements. Both use cryptography to ensure confidentiality:
Operational Control and Policy Management
Operational control and policy management helps automate, simplify, and integrate a network to reduce operational costs and improve productivity. The Cisco Security Management Suite is a framework of products and technologies that are designed for scalable policy administration and enforcement for the Cisco Self-Defending Network.
There are two components in the Cisco Security Management Suite: Cisco Security Manager and Cisco Security MARS. They work together to centrally manage the network and to achieve critical functions such as availability, responsiveness, resilience, and security in a consistent way. Cisco Security Manager and Cisco Security MARS were designed to complement CiscoWorks products. This integrated solution simplifies and automates the tasks that are associated with security management operations, including configuration, monitoring, analysis, and response.
The Cisco Security Management Suite provides a number of benefits:
Cisco Security Manager is a powerful, easy-to-use solution for centrally provisioning all aspects of device configurations and security policies for the Cisco family of security products. The solution is effective for managing even small networks consisting of fewer than 10 devices, but also scales for efficiently managing large-scale networks composed of thousands of devices. Scalability is achieved through intelligent policy-based management techniques that can simplify administration. Cisco Security Manager includes a number of features:
Cisco Security MARS provides security monitoring for network security devices and host applications made by Cisco and other providers. Cisco Security MARS offers these benefits:
A truly secure network requires multiple products and technologies that collaborate seamlessly across platforms and integrate tightly with the network infrastructure. No single product or technology is able to secure a network.
Cisco offers the broadest portfolio of integrated security products in the industry. The portfolio is designed to meet the requirements and diverse deployment models of any network and any environment. These integrated security products provide a comprehensive solution:
Most organizations do not adopt all components of the Cisco Self-Defending Network at one time. This is because it can be difficult to overhaul all the required subsystems at once without disrupting the integrity of the IT services. Additionally, some organizations are hesitant to relinquish security controls to an automated system until they are confident that the system operates dependably. The Cisco Self-Defending Network design accommodates these concerns by providing products that can deploy independently of one another. Other product solutions can be added over time as confidence builds in the overall network security design.
While the Cisco Self-Defending Network does increase the level of security, it cannot guarantee a completely invulnerable network. New types of attacks and advances in hacking technologies are still threats to even the most secure systems. Additionally, all networks are vulnerable to attack if the planning, implementation, operations, and maintenance of the network do not adhere to operational security practices. Operations security is concerned with the day-to-day practices necessary to first deploy and later maintain a secure system.
Operations security starts with the planning and implementation process of a network. During these phases, the operations team proactively analyzes designs, identifies risks and vulnerabilities, and makes the necessary adaptations. After a network is set up, the actual operational tasks begin, including the continual day-to-day maintenance of the environment. These activities are regular in nature and enable the environment, systems, and applications to continue to run correctly and securely.
The responsibilities of the operations team pertain to everything that takes place to keep the network, computer systems, applications, and the environment up and running in a secure and protected manner. These individuals are concerned with the controls or security solutions used to protect hardware, software, and media on a day-to-day basis. This includes protection from threats in the operating environment, internal and external intruders, and operators who access resources inappropriately.
The operations team usually has the objectives of preventing reoccurring problems, reducing hardware failures to an acceptable level, and reducing the impact of hardware failure or disruption. They should investigate any unusual or unexplained occurrences, unscheduled initial program loads, deviations from standards, and other abnormal conditions occurring on the network. While the people within operations are responsible for ensuring that systems are protected and continue to run in a predictable manner, it is important to note that management is responsible for the behavior and correction of personnel. For this reason, it is necessary that management work closely with the operations team to ensure the continued security of the network.
To ensure a secure working environment within the operations department, certain core principles should be integrated into the day-to-day activities:
Separation of Duties
Separation (or segregation) of duties (SoD) is one of the main concepts of internal control and is the most difficult and sometimes the most costly control to achieve. SoD states that no single individual has control over two or more phases of a transaction or operation. Instead, responsibilities are assigned in a way that incorporates checks and balances. This makes a deliberate fraud more difficult to perpetrate because it requires a collusion of two or more individuals or parties.
The term SoD is already well known in financial systems. These companies do not combine roles such as receiving checks, approving discounts, depositing cash, reconciling bank statements, and approving time cards. This helps to reduce the potential damage from the actions of one person. Similarly, IT departments should be organized in a way that achieves adequate separation of duties. There are two methods to accomplish this.
The first method is known as the two-person control principle. It states that a task requires two individuals, and each is responsible for reviewing and approving the work of the other. In addition to providing accountability and reducing opportunities for fraud, this principle has the added benefit of reducing errors within configurations. Because of the overhead costs involved, this practice is usually limited to sensitive duties that are considered potential security risks.
Another method of implementing SoD is the dual operator principle in which a task is broken down and each part of the task is assigned to a different individual. The task is not complete until both individuals complete their part. An example of the dual operator principle is a check that requires two signatures for the bank to accept it.
Rotation of Duties
Rotation of duties, or job rotation, is a security measure in which individuals are given a specific assignment for a certain amount of time before moving to a new assignment. To successfully implement this principle, it is important that individuals have the training necessary to complete more than one job.
Peer review is built into the practice of rotation of duties. For example, suppose that a job rotation scheme has five people rotating through five different roles during the course of a week. Peer review of work occurs whether or not it was intended. When five people do one job in the course of the week, each person is effectively reviewing the work of the others.
In addition to providing security, rotation of duties also prevents boredom and gives individuals a greater breadth of exposure to the entire network operation. This creates a strong and flexible operations department because everyone is capable of doing multiple jobs.
Trusted Recovery
One of the easiest ways to compromise a system is to make the system restart and gain control of it before all of its defenses are reloaded. For this reason, trusted recovery is an important principle of operations security. This principle states that systems fail at some point, so a process for recovery must be established. The most common way to prepare for failure is to back up data on a regular basis.
Backing up data is standard practice in most IT departments. Keep in mind that many backup software programs use an account that bypasses file security. Therefore, individuals with the right to back up data can have access to files that they would not ordinarily be able to access. The same is true if those individuals who have the right to restore data.
Security professionals propose that a secure backup program contain some of the following practices:
One of the easiest ways for an attacker to obtain a password file (or any other data) is to get a copy of the backup tape because the backup tape is not always handled or stored very securely.
Being prepared for system failure is also an important part of operations security:
System recovery follows system failure. There are several examples of programs and applications that incorporate system recovery features:
Configuration and Change Control
Configuration and change control is a process that should be implemented to ensure that standardized methods and procedures are used to efficiently handle all changes. A change is defined as an event that results in a new status of one or more configuration items. A change should be approved by management, be cost effective, and be an enhancement to business processes with a minimum of risk to the IT infrastructure and security.
The configuration and change controls should address three major components: the processes in place to minimize system and network disruption, backups and reversing changes that go badly, and guidance on the economic utilization of resources and time.
A few suggestions are recommended to accomplish configuration changes in an effective and safe manner:
Although the change control process differs from organization to organization, certain patterns emerge in change management. There are five steps in a typical change control process:
Step 1. Apply to introduce the change.
Step 2. Catalog the proposed change.
Step 3. Schedule the change.
Step 4. Implement the change.
Step 5. Report the change to the relevant parties.
Operations security minimizes harm to the network by providing organized processes for security personnel. The effectiveness of an operations security solution fortunately can be tested without waiting for a real threat to take place. Network security testing makes this possible.
Network security testing is testing that is performed on a network to ensure all security implementations are operating as expected. Typically, network security testing is conducted during the implementation and operational stages, after the system has been developed, installed, and integrated.
Security testing provides insight into various administrative tasks such as risk analysis and contingency planning. It is important to document the results of security testing and make them available for staff involved in other IT areas.
During the implementation stage, security testing is conducted on specific parts of the security system.
After a network is fully integrated and operational, a Security Test and Evaluation (ST&E) is performed. ST&E is an examination or analysis of the protective measures that are placed on an operational network.
Tests should be repeated periodically and whenever a change is made to the system. For security systems that protect critical information or protect hosts that are exposed to constant threat, security testing should be conducted more frequently.
After a network is operational, it is important to ascertain its security status. Many tests can be conducted to assess the operational status of the system:
Some testing techniques are predominantly manual and other tests are highly automated. Regardless of the type of testing, the staff that sets up and conducts the security testing should have significant security and networking knowledge, including expertise in the following areas: network security, firewalls, intrusion prevention systems (IPSs), operating systems, programming, and networking protocols, such as TCP/IP.
Network security testing results can be used in several ways:
There are many tools available to test the security of systems and networks. Some of these tools are open source while others are commercial tools that require licensing.
Two of the most common security testing tools are Nmap and SuperScan.
Nmap
Nmap is the best-known low-level scanner available to the public. It is simple to use and has an array of excellent features which can be used for network mapping and reconnaissance. The basic functionality of Nmap allows the user to accomplish several tasks:
Advanced features of Nmap include protocol scanning, known as Layer 3 port scanning. This feature identifies Layer 3 protocol support on a host. Examples of protocols that can be identified include GRE and OSPF.
While Nmap can be used for security testing, it can also be used for malicious purposes. Nmap has an additional feature that allows it to use decoy hosts, on the same LAN as the target host, to mask the source of the scan.
Nmap has no Application Layer features and runs on UNIX, Linux, Windows and OS X.
Both console and graphical versions are available. The Nmap program and Zenmap GUI can be downloaded from the internet.
SuperScan
SuperScan is a Microsoft Windows port scanning tool. It runs on most versions of Windows and requires administrator privileges. Windows XP SP2 has removed support for raw sockets which limits the ability of SuperScan and other scanning tools.
A raw socket is a socket that allows a user to directly access and manipulate the header of a data packet.
While SP2 has increased the security aspect of this tool, some functionality can be restored by entering the net stop SharedAccess command at the Windows command prompt.
SuperScan version 4 has a number of very useful features:
Tools such as Nmap and SuperScan can provide effective penetration testing on a network and determine network vulnerabilities while helping to anticipate possible attack mechanisms. However network testing cannot prepare a network administrator for every security problem.
The good news is that networks can recover from most security issues by adapting the security solution. The bad news is that prior to adapting the security solution it is possible for an attack to cause disruption and even catastrophic damage. Catastrophic damage is serious disruption to network services or complete destruction of data or network systems. Catastrophic damage can also be caused by a cataclysmic event. A business must have a plan in place to recover and remain in business in the event of serious disruption or network destruction.
Business continuity planning addresses the continuing operations of an organization in the event of a disaster or prolonged service interruption that affects the mission of the organization. These plans address an emergency response phase, a recovery phase, and a return to normal operation phase. These phases should include a short to medium-term framework to continue the organizational operations. Each phase also identifies the responsibilities of personnel and the available resources during an incident.
In reality, contingency and disaster recovery plans do not address every possible scenario or assumption. Rather, they focus on the events most likely to occur and identify an acceptable method of recovery. Periodically, the plans and procedures should be practiced to ensure that they are effective and well understood.
For example, business continuity planning may address the following concerns:
Disaster recovery is the process of regaining access to the data, hardware, and software necessary to resume critical business operations after a natural or human-induced disaster. It also includes plans for coping with the unexpected or sudden loss of key personnel. A disaster recovery plan is part of business continuity planning.
After the events of September 11, 2001, when many companies lost irreplaceable data, the effort put into protecting data has changed. It is believed that some companies spend up to 25 percent of their IT budget on disaster recovery planning to avoid larger losses. Research indicates that of the companies that have had a major loss of computerized records, 43 percent never reopen, 51 percent close within two years, and only 6 percent remain in business.
When planning for disaster recovery and business continuity, the first step is identifying the possible types of disasters and disruptions. Not all disruptions to business operations are equal. A good disaster recovery plan takes into account the magnitude of the disruption, recognizing that there are differences between catastrophes, disasters, and minor incidents.
The only way to deal with destruction is redundancy. When a component is destroyed, it must be replaced with a redundant component. This component can be a standby component that is owned by the organization for disaster recovery purposes or a new device that is provided by the service provider that the organization has contracted services with. If the service provider is responsible for providing redundant components, this information must be contained within the service level agreement (SLA). The SLA should also cover redundancy when service is disrupted or provide for some type of compensation.
On a much larger scale, an organization might require a redundant facility if some catastrophic event results in facility destruction. Redundant facilities are referred to as hot, warm, and cold sites.
Each type of facility is available for a different price with different resulting downtimes. With hot sites, a completely redundant facility is required with almost identical equipment. The copying of data to this redundant facility is part of normal operations, so in the case of a catastrophe, only the latest data changes must be applied to restore full operations. Organizations that need to respond in seconds often employ global load balancing (GLB) and distributed SANs to respond quickly. With this type of redundancy in place, an organization can quickly recover from disruption or even destruction .
Warm sites are physically redundant facilities, but software and data are not stored and updated on the equipment. A disaster recovery team is required to physically go to the redundant facility and get it operational. Depending on how much software and data is involved, it can take days before operations are ready to resume.
A cold site is usually an empty datacenter with racks, power, WAN links, and heating, ventilation, and air conditioning (HVAC) already present, but no equipment. In this instance, an organization must first acquire routers, switches, firewalls, servers, and other equipment to rebuild everything. When the backups are uploaded onto the new equipment, operations can continue. This option is the least expensive in terms of money spent annually, but usually requires weeks to resume operations.
The type of redundancy, whether it is standby equipment, SLA redundancy agreements, or facility redundancy requirements, is dependant on the types of disasters that an organization deems possible and the time sensitivity of critical data. The more redundancy options an organization puts in place, the higher the cost. However, not having backup plans and recovery options could result in lost revenue and lost customer trust.
It is important to keep in mind that the disaster recovery plan and business continuity plan include not only the redundancy options but also all the steps and personnel required to implement the backup plan.
Business continuity and disaster recovery plans are ever-changing documents. They must be adjusted to changes in environment, equipment, and business needs. These changes not only affect continuity plans, but all aspects of network operations. Documentation should be maintained and updated regularly, and security needs should be continuously evaluated.
Evaluating system changes and adjusting plans are all part of a system life cycle. Keep in mind that the term "system" can refer to a single device or a group of devices that operate together within a network.
A general system development life cycle (SDLC) includes five phases:
1. Initiation
2. Acquisition and development
3. Implementation
4. Operation and maintenance
5. Disposition
When using the SDLC to design a network, each phase should include a minimum set of security requirements. This results in less expensive and more effective security as compared to adding security to an operational system after the fact. This purposeful inclusion of security in every phase of the life cycle is part of the secure network life cycle management process.
Initiation
These are the security tasks related to the initiation phase of the SDLC:
Acquisition and Development
These are the security tasks related to the acquisition and development phase of the SDLC:
Implementation
These are the security tasks related to the implementation phase of the SDLC:
Operations and Maintenance
These are the security tasks related to the operations and maintenance phase of the SDLC:
Disposition
These are the security tasks related to the disposition phase of the SDLC:
The Secure Network Life Cycle is a process of assessment and reevaluation of equipment and security needs as the network changes. One of the important aspects of this ongoing evaluation is understanding which assets an organization must protect, even as those assets are changing.
Determine what the assets of an organization are by asking questions:
The answers might identify assets such as critical databases, vital applications, important customer and employee information, classified commercial information, shared drives, email servers, and web servers.
Network security systems help protect these assets, but a security system alone cannot prevent assets from being vulnerable to threat. Technical, administrative, and physical security systems can all be defeated if the end user community does not adhere to security policies and procedures.
A security policy is a set of security objectives for a company, rules of behavior for users and administrators, and system requirements. These objectives, rules, and requirements collectively ensure the security of a network and the computer systems in an organization. Much like a continuity plan, a security policy is a constantly evolving document based on changes in technology, business, and employee requirements.
A comprehensive security policy has a number of benefits:
Security policies are used to inform users, staff, and managers of an organization's requirements for protecting technology and information assets. A security policy also specifies the mechanisms that are needed to meet security requirements and provides a baseline from which to acquire, configure, and audit computer systems and networks for compliance.
One of the most common security policy components is an acceptable (or appropriate) use policy (AUP). This component defines what users are allowed and not allowed to do on the various system components. This includes the type of traffic that is allowed on the network. The AUP should be as explicit as possible to avoid misunderstanding. For example, an AUP might list specific websites, newsgroups, or bandwidth intensive applications that are prohibited from being accessed by company computers or from the company network.
The audience for the security policy is anyone who has access to the network. The internal audience includes various personnel, such as managers and executives, departments and business units, technical staff, and employees. The external audience is also a varied group that includes partners, customers, suppliers, consultants, and contractors. It is likely that one document cannot meet the needs of the entire audience of a large organization. The goal is to ensure that the various information security policy documents are consistent with the needs of the intended audience.
The audience determines the content of the policy. For example, it is probably unnecessary to include a description of why something is necessary in a policy that is intended for the technical staff. It can be assumed that the technical staff already knows why a particular requirement is included. Managers are not likely to be interested in the technical aspects of why a particular requirement is needed. Instead, they want a high-level overview or the principles supporting the requirement. Employees often require more information on why particular security rules are necessary. If they understand the reasons for the rules, they are more likely to comply with them.
Most corporations use a suite of policy documents to meet their wide and varied needs. These documents are often broken into a hierarchical structure:
Governing Policy
The governing policy outlines the company's overall security goals for managers and technical staff. It covers all security-related interactions among business units and supporting departments in the company.
The governing policy aligns closely with existing company policies and is placed at the same level of importance as these other policies. This includes human resource policies and other policies that mention security-related issues, such as email, computer use, or related IT subjects.
A governing policy includes several components:
Technical Policy
Technical policies are detailed documents that are used by technical staff in the conduct of their daily security responsibilities. These policies are system-specific or issue-specific, such as router security and physical security issues. They are essentially security handbooks that describe what the technical staff does, but not how they perform the functions.
Technical policies are broken down into specified technical areas, including:
End User Policy
End-user policies cover all rules pertaining to information security that end users should know about and follow. End-user policies might overlap with technical policies. These policies are generally grouped together into a single document for ease of use.
Several different target groups require end-user policies. Each group might have to agree to a different end-user policy. For example, an employee end-user policy would probably be different from a customer end-user policy.
The security policy documents are high-level overview documents. The security staff uses detailed documents to implement the security policies. These include the standards, guidelines, and procedures documents.
Standards, guidelines, and procedures contain the actual details defined in the policies. Each document serves a different function, covers different specifications, and targets a different audience. Separating these documents makes it is easier to update and maintain them.
Standards Documents
Standards help an IT staff maintain consistency in the operations of the network. Standards documents include the technologies that are required for specific uses, hardware and software versioning requirements, program requirements, and any other organizational criteria that must be followed. This helps IT staff improve efficiency and simplicity in design, maintenance, and troubleshooting.
One of the most important security principles is consistency. For this reason it is necessary for organizations to establish standards. Each organization develops standards to support its unique operating environment. For example, if an organization supports 100 routers, it is important that all 100 routers are configured using the established standards. Device configuration standards are defined in the technical section of an organization's security policy.
Guideline Documents
Guidelines provide a list of suggestions on how to do things better. They are similar to standards, but are more flexible and are not usually mandatory. Guidelines can be used to define how standards are developed and to guarantee adherence to general security policies.
Some of the most helpful guidelines are found in organizational repositories called best practices. In addition to an organization's defined best practices, a number of guidelines are widely available:
Procedure Documents
Procedure documents are longer and more detailed than standards and guidelines. Procedure documents include implementation details, usually with step-by-step instructions and graphics. Procedure documents are extremely important for large organizations to have the consistency of deployment that is necessary for a secure environment.
All persons in an organization, from the chief executive officer (CEO) to the newest hires, are considered end users of the network and must abide by the organization's security policy. Developing and maintaining the security policy is delegated to specific roles within the IT department.
Executive-level management must always be consulted during security policy creation to ensure that the policy is comprehensive, cohesive, and legally binding. Smaller organizations might have a single executive position that oversees all aspects of operation, including network operations. Larger organizations might break up the executive task into several positions. The business and reporting structure of an organization depends on the organization's size and industry.
Some of the more common executive titles include:
Technical, administrative, and physical security is easily breached if the end-user community is not purposefully abiding security policies. To help ensure the enforcement of the security policy, a security awareness program must be put in place. Leadership must develop a program that keeps everyone aware of security issues and educates staff on how to work together to maintain the security of their data.
A security awareness program reflects the business needs of an organization tempered by known risks. It informs users of their IT security responsibilities and explains the rules of behavior for using the IT systems and data within a company. This program must explain all IT security policies and procedures. A security awareness program is crucial to the financial success of any organization. It disseminates the information that all end users need to effectively conduct business in a way that protects the organization from loss of intellectual capital, critical data, and even physical equipment. The security awareness program also details the sanctions that the organization imposes for noncompliance. This portion of the program should be part of all new hire orientation.
A security awareness program usually has two major components:
Awareness Campaigns
Awareness campaigns are usually aimed at all levels of the organization, including executive positions.
Security awareness efforts are designed to change behavior or reinforce good security practices. Awareness is defined in NIST Special Publication 800-16 as: "Awareness is not training. The purpose of awareness presentations is simply to focus attention on security. Awareness presentations are intended to allow individuals to recognize IT security concerns and respond accordingly. In awareness activities, the learner is the recipient of information... Awareness relies on reaching broad audiences with attractive packaging techniques."
An example of a topic for an awareness session (or awareness material to be distributed) is virus protection. The subject can be briefly addressed by describing what a virus is, what can happen if a virus infects a user system, what the user must do to protect the system, and what users do if they discover a virus.
There are several methods of increasing security awareness:
Training and Education
Training strives to impart needed security skills to end users who may or may not be members of the IT staff. The most significant difference between training and awareness is that training teaches skills that allow a person to perform a specific task, while awareness campaigns simply focus an individual's attention on security issues. The skills that users acquire during training build upon the information learned in security awareness campaigns. Following a security awareness campaign with training targeted to specific audiences helps cement the information and skills imparted. A training curriculum does not necessarily lead to a formal degree from an institution of higher learning, but it might contain much of the same material found in a course that a college or university includes in a certificate or degree program.
An example of a training course for non-IT personnel is one that addresses appropriate security practices specific to those applications that the end user must use, such as database applications. An example of training for IT personnel is an IT security course that addresses in detail the management, operational, and technical controls that must be implemented.
An effective security training course requires proper planning, implementation, maintenance, and periodic evaluation. The life cycle of a security training course includes several steps:
Step 1. Identify course scope, goals, and objectives. The scope of the course provides training to all types of people who interact with IT systems. Because users need training that relates directly to their use of particular systems, it is necessary to supplement a large organization-wide program by more system-specific courses.
Step 2. Identify and educate training staff. It is important that trainers have sufficient knowledge of computer security issues, principles, and techniques. It is also vital that they know how to communicate information and ideas effectively.
Step 3. Identify target audiences. Not everyone needs the same degree or type of computer security information to perform an assigned job. Security training courses that present only the information that is needed by the particular audience and omit irrelevant information have the best results.
Step 4. Motivate management and employees. Consider using motivational techniques to show management and employees how their participation in a training course benefits the organization.
Step 5. Administer the courses. Important considerations for administering the course include selecting appropriate training methods, topics, materials, and presentation techniques.
Step 6. Maintain the courses. Stay informed of changes in computer technology and security requirements. Training courses that meet the needs of an organization today can become ineffective when the organization starts to use a new application or changes its environment, such as the deployment of VoIP.
Step 7. Evaluate the courses. An evaluation seeks to ascertain how much information is retained, to what extent computer security procedures are being followed, and the general attitude toward computer security.
Education integrates all the security skills and competencies of the various functional specialties into a common body of knowledge, adds a multidisciplinary study of concepts, issues, and principles (technological and social), and strives to produce IT security specialists and professionals capable of vision and proactive response.
An example of an educational program is a degree program at a college or university. Some people take a course or several courses to develop or enhance their skills in a particular discipline. This is training as opposed to education. Many colleges and universities offer certificate programs, in which a student can take two or more classes in a related discipline and be awarded a certificate upon completion. Often, these certificate programs are conducted as a joint effort between schools and software or hardware vendors. These programs are more characteristic of training than education. Those responsible for security training must assess both types of programs and decide which one better addresses the identified needs.
A successfully implemented security awareness program measurably reduces unauthorized actions by insiders, increases the effectiveness of existing controls, and helps fight waste, fraud, and abuse of information systems resources.
Laws
For many businesses today, one of the biggest considerations for setting security policies and implementing awareness programs is compliance with the law. Network security professionals must be familiar with the laws and codes of ethics that are binding on Information Systems Security (INFOSEC) professionals. Most countries have three types of laws: criminal, civil (also called tort), and administrative.
Criminal law is concerned with crimes, and its penalties usually involve fines or imprisonment, or both.
Civil law focuses on correcting situations in which entities have been harmed and an economic award can help. Imprisonment is not possible in civil law. An example of a civil law case is if one company sues another company for infringing on a patent. The penalty in civil law is usually monetary, although there can also be performance requirements such as ceasing to infringe on the patent.
Administrative law involves government agencies enforcing regulations. For example, a company might owe its employees vacation pay. An administrative court could force the company to pay its employees as well as levy a fine that is payable to the court.
Not all governments accept or classify their laws the same way. This can impede prosecution for computer and networking crimes that cross international boundaries.
Ethics
Ethics is a standard that is higher than the law. It is a set of moral principles that govern civil behavior. Ethical principles are often the foundation of many of the laws currently in place. These principles are frequently formalized into codes of ethics. Individuals that violate the code of ethics can face consequences such as loss of certification, loss of employment, and even prosecution by criminal or civil court. The information security profession has a number of formalized codes:
(ISC)2 Code of Ethics
The (ISC)2 code of ethics consists of the preamble and the ethics canons. The canons are explained in more detail at the (ISC)2 website.
Code of Ethics Preamble
Safety of the commonwealth, duty to our principals, and to each other requires that we adhere, and be seen to adhere, to the highest ethical standards of behavior. Therefore, strict adherence to this Code is a condition of certification.
Code of Ethics Canons
Computer Ethics Institute Code of Ethics
The CEI formalized its code of ethics as the Ten Commandments of Computer Ethics:
1. Thou shalt not use a computer to harm other people.
2. Thou shalt not interfere with other people's computer work.
3. Thou shalt not snoop around in other people's computer files.
4. Thou shalt not use a computer to steal.
5. Thou shalt not use a computer to bear false witness.
6. Thou shalt not copy or use proprietary software which is not paid for.
7. Thou shalt not use other people's computer resources without authorization or proper compensation.
8. Thou shalt not appropriate other people's intellectual output.
9. Thou shalt think about the social consequences of the program being written or the system being designed.
10. Thou shalt always use a computer in ways that ensure consideration and respect for fellow humans.
IAB Code of Ethics
The IAB issued a statement that constitutes its code of ethics:
The Internet is a national facility whose utility is largely a consequence of its wide availability and accessibility. Irresponsible use of this critical resource poses an enormous threat to its continued availability to the technical community. The U.S. government, sponsors of this system, suffers when highly disruptive abuses occur. Access to and use of the Internet is a privilege and should be treated as such by all users of this system. The IAB strongly endorses the view of the Division Advisory Panel of the National Science Foundation Division of Network, Communications Research and Infrastructure which, in paraphrase, characterized as unethical and unacceptable any activity which purposely:
GASSP Code of Ethics
The GASSP Code of Ethics states that information systems and the security of information systems should be provided and used in accordance with the Code of Ethical Conduct of information security professionals. The Code of Ethical Conduct prescribes the relationships of ethics, morality, and information.
As social norms for using IT systems evolve, the Code of Ethical Conduct will change and information security professionals will spread the new concepts throughout their organizations and products. Safeguards may require an ethical judgment for use or to determine limits or controls. For example, entrapment is a process for luring someone into performing an illegal or abusive act. As a security safeguard, a security professional might set up an easy-to-compromise hole in the access control system, and then monitor attempts to exploit the hole. This form of entrapment is useful in providing warning that penetration has occurred. It can also provide enough information to identify the perpetrator. Due to laws, regulations, or ethical standards, it may be unethical to use data that is collected via entrapment in prosecution, but it may be ethical to use entrapment as a detection and prevention strategy. One should seek both legal and ethical advice when designing network security.
Laws and codes of ethics are in place to allow organizations and individuals a means of reclaiming lost assets and preventing crimes. Different countries have different legal standards. In most countries and courts, to successfully prosecute an individual, it is necessary to establish motive, opportunity, and means.
Motive answers the question of why a person committed the illegal act. As a crime is investigated, it is important to start with individuals who might have been motivated to commit the crime. For example, employees who believe they were wrongly passed over for advancement may be motivated to sell confidential company data to a competitor. Having identified likely suspects, the next thing to consider is whether the suspects had the opportunity to commit the crime.
Opportunity answers the question of when and where the person committed the crime. For example, if it can be established that three of the suspects were all participating in a wedding at the time of the security breach, they might have been motivated, but they did not have the opportunity because they were busy doing something else.
Means answers the question of how the person committed the crime. It is pointless to accuse someone who does not have the knowledge, skills, or access to accomplish the crime.
While establishing motive, opportunity, and means is a standard for finding and prosecuting individuals of all types of crimes, in computer crimes, it is fairly easy to manipulate and cover up evidence because of the complexity of computer systems, global accessibility via the Internet, and the knowledge of many attackers. For this reason, it is necessary to have strict protocols in place for security breaches. These protocols should be outlined in an organizations security policy.
Computer data is virtual data, meaning that there are rarely physical, tangible representations. For this reason, data can be easily damaged or modified. When working with computer data as part of a forensics case, the integrity of the data must be maintained if it is to be used as evidence in a court of law. For example, changing a single bit of data can change a timestamp from August 2, 2001 to August 3, 2001. A perpetrator can easily adjust data to establish a false alibi. Therefore, strict procedures are required to guarantee the integrity of forensics data recovered as part of an investigation. Some of the procedures that must be established are proper data collection, data chain of custody, data storage, and data backups.
The process of collecting data must be done precisely and quickly. When a security breach occurs, it is necessary to isolate the infected system immediately. Systems should not be shut down or rebooted before the memory is dumped to a file because the system flushes the memory every time a device is powered off. Additionally, a drive image should be taken before working with data on the hard drive. Multiple copies of the hard drive are usually made after the device is powered down to establish master copies. These master copies are usually locked up in a safe, and investigators use working copies for both the prosecution and the defense. Investigators can determine if data tampering has occurred by comparing working copies to the master copy that has been secured and untouched since the beginning of the investigation.
After data is collected but before equipment is disconnected, it is necessary to photograph the equipment in place. All evidence must be handled while maintaining a proper chain of custody, meaning that only those individuals with authorization have access to evidence, and all access is documented.
If security protocols are established and followed, organizations can minimize the loss and damages resulting from attacks.