how Access Control takes into account human nature and ways to prevent issues.
sarath_007
access_ppt15_l07.pptxAccess Control, Authentication, and Public Key Infrastructure
Lesson 7
Human Nature and Organizational Behavior
© ITT Educational Services, Inc. All rights reserved.
Page ‹#›
IS404 Access Control, Authentication and PKI (PKI)
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
1
1
Learning Objective and Key Concepts
Learning Objective
Define proper security controls within the User Domain to mitigate risks and threats caused by human behavior.
Key Concepts
Human resources access control considerations
User Domain security practices for human resources
Best practices for managing human risks
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
2
2
DISCOVER: CONCEPTS
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
3
| Type of Threat | Organizations Reporting Issue |
| Rogue Modems | 47% |
| Media Downloading | 40% |
| Personal Devices | 40% |
| Unauthorized Blogging | 25% |
| Personal Instant Messaging (IM) Accounts | 24% |
10 Prevalent Insider Threats (Continued)
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
4
| Type of Threat | Organizations Reporting Issue |
| Rogue Modems | 47 % |
| Media Downloading | 40 % |
| Personal Devices | 40 % |
| Unauthorized Blogging | 25 % |
| Personal Instant Message (IM) Accounts | 24 % |
10 Prevalent Insider Threats (Continued)
Source: Edward Cone, Baseline magazine, March 25, 2009
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
5
User Domain Access Control Management
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
6
Account Type
Justification for Secure Access
Internal User
Accountability, Auditing, and Assurance
The actions of each user’s account must be capable of being irrefutably linked to the account and the user assigned to that account.
Non-repudiation
External Remote User
Third Party
Privileged and System Accounts (Administrators)
Secure Network Access Considerations
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
7
DISCOVER: PROCESS
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
8
Pre-Employment Checks
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
9
What Information Can Be Considered
What Information Cannot be Considered
Applicant’s Rights
Consequences of a Bad Hiring Decision
Ongoing Observation of Personnel
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
10
Identify Potentially Disgruntled Employees
Proper Ways to Revoke Access upon Employee Termination
DISCOVER: ROLES
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
11
Roles and Responsibilities
Human Resources Department
Recruiting, retention, separation, development, promotion, welfare, and safety, health, and environment
Hiring Department Manager/Supervisor
Work specifications, data and application access, work supervision and review, promotion, reward, and discipline
Employee
Job knowledge and application, compliance with employment policies and procedures, and loyalty and ethical behavior
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
12
DISCOVER: RATIONALE
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
13
Security Awareness Training Facts
Information technology (IT) security surveys conducted by well-known accounting firms found the following:
Many organizations have some awareness training.
Most awareness programs omitted important elements.
Less than 25% of organizations had no way to track awareness program effectiveness.
Source: http://www.lumension.com/Resources/Resource-Center/Protect-Vital-Information-Minimize-Insider-Risks.aspx
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
14
Defining appropriate policies and procedures governing employee behavior
Educating employees about the policies and procedures relevant to them
Verifying employees’ understanding of relevant policies and procedures
Discovering and addressing behavioral shortcomings
Managing change over time
Best Practices for Managing Human Risks
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
15
Summary
10 prevalent insider threats
User Domain access control management
Security awareness training
Best practices for managing human resources
Page ‹#›
Access Control, Authentication, and PKI
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
09/23/10
16
