SecDis1

hybridtek

Foundations_of_Information_Security_A_Straightforw..._----_Chapter_1_What_Is_Information_Security_.pdf

Home >Computer Science homework help >SecDis1

1 W H A T I S I N F O R M A T I O N

S E C U R I T Y ?

Today, many of us work with computers, play on computers at home, go to school

online, buy goods from merchants on the internet, take our laptops to the coffee shop to

read emails, use our smartphones to check our bank balances, and track our exercise with sensors on our wrists. In other words, computers are ubiquitous.

Although technology allows us to access a host of information with only a click of the mouse, it also poses major security risks. If the informa- tion on the systems used by our employers or our banks becomes exposed to an attacker, the consequences could be dire indeed. We could suddenly find the contents of our bank account transferred to a bank in another country in the middle of the night. Our employer could lose millions of dollars, face legal prosecution, and suffer damage to its reputation because of a system configuration issue that allowed an attacker to gain

Andress, Jason. Foundations of Information Security : A Straightforward Introduction, No Starch Press, Incorporated, 2019. ProQuest Ebook Central, http://ebookcentral.proquest.com/lib/snhu-ebooks/detail.action?docID=5965309. Created from snhu-ebooks on 2021-08-24 01:20:11.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

2 Chapter 1

access to a database containing personally identifiable information (PII) or proprietary information. Such issues appear in the news media with disturbing regularity.

Thirty years ago, such breaches were nearly nonexistent, largely because the technology was at a relatively low level and few people were using it. Although technology changes at an increasingly rapid rate, much of the theory about keeping ourselves secure lags behind. If you can gain a good understanding of the basics of information security, you’re on a strong foot- ing to cope with changes as they come.

In this chapter, I’ll cover some of the basic concepts of information secu- rity, including security models, attacks, threats, vulnerabilities, and risks. I’ll also delve into some slightly more complex concepts when discussing risk management, incident response, and defense in depth.

Defining Information Security Generally speaking, security means protecting your assets, whether from attackers invading your networks, natural disasters, vandalism, loss, or mis- use. Ultimately, you’ll attempt to secure yourself against the most likely forms of attack, to the best extent you reasonably can, given your environment.

You may have a broad range of potential assets you want to secure. These could include physical items with inherent value, such as gold, or those that have value to your business, such as computing hardware. You may also have valuables of a more ethereal nature, such as software, source code, or data.

In today’s computing environment, you’re likely to find that your logical assets (assets that exist as data or intellectual property) are at least as valu- able as your physical assets (those that are tangible objects or materials), if not more valuable. That’s where information security comes in.

Information security is defined as “protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction,” according to US law.1 In other words, you want to protect your data and systems from those who seek to misuse them, intentionally or unintentionally, or those who should not have access to them at all.

When Are You Secure? Eugene Spafford once said, “The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards—and even then, I have my doubts.”2 A system in such a state might be secure, but it’s not usable or productive. As you increase the level of security, you usually decrease the level of productivity.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

What Is Information Security? 3

Additionally, when securing an asset, system, or environment, you must consider how the level of security relates to the value of the item being secured. If you’re willing to accommodate the decrease in performance, you can apply very high levels of security to every asset for which you’re responsible. You could build a billion-dollar facility surrounded by razor- wire fences and patrolled by armed guards and vicious attack dogs, com- plete with a hermetically sealed vault, to safeguard your mom’s chocolate chip cookie recipe, but that would be overkill. The cost of the security you put in place should never outstrip the value of what it’s protecting.

In some environments, however, such security measures might not be enough. In any environment where you plan to put heightened levels of security in place, you also need to consider the cost of replacing your assets if you happen to lose them and make sure you establish reasonable levels of protection for their value.

Defining the exact point at which you can be considered secure presents a bit of a challenge. Are you secure if your systems are properly patched? Are you secure if you use strong passwords? Are you secure if you’re disconnected from the internet entirely? From my point of view, the answer to all these questions is no. No single activity or action will make you secure in every situation.

That’s because even if your systems are properly patched, there will always be new attacks to which you’re vulnerable. When you’re using strong passwords, an attacker will exploit a different avenue instead. When you’re disconnected from the internet, an attacker could still physically access or steal your systems. In short, it’s difficult to define when you’re truly secure. On the other hand, defining when you’re insecure is a much easier task. Here are several examples that would put you in this state:

• Not applying security patches or application updates to your systems • Using weak passwords such as “password” or “1234” • Downloading programs from the internet • Opening email attachments from unknown senders • Using wireless networks without encryption

I could go on for some time adding to this list. The good thing is that once you can point out the areas in an environment that can make it inse- cure, you can take steps to mitigate these issues. This problem is similar to cutting something in half over and over. There will always be some small portion left to cut in half again. Although you may never get to a state that you can definitively call “secure,” you can take steps in the right direction.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

4 Chapter 1

T H I S L A W I S Y O U R L A W . . .

The bodies of law that define standards for security vary quite a bit from one industry to another and differ wildly from one country to another. An example of this is the difference in data privacy laws between the United States and the European Union. Organizations that operate globally need to take care that they’re not violating any such laws while conducting business. When in doubt, consult legal counsel before acting.

Some bodies of law or regulations do try to define what secure means, or at least some of the steps you should take to be “secure enough.” The Payment Card Industry Data Security Standard (PCI DSS) applies to companies that pro- cess credit card payments, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) is for organizations that handle healthcare and patient records, the Federal Information Security Management Act (FISMA) defines security standards for many federal agencies in the United States, and there are a host of others. Whether these standards are effective is debatable, but following the security standards defined for the industry in which you’re operat- ing is advisable, if not mandated.

Models for Discussing Security Issues When discussing security issues, it’s often helpful to have a model that you can use as a foundation or a baseline. This provides a consistent set of ter- minology and concepts that we, as security professionals, can refer to.

The Confidentiality, Integrity, and Availability Triad Three of the primary concepts in information security are confidentiality, integrity, and availability, commonly known as the confidentiality, integrity, and availability (CIA) triad, as shown in Figure 1-1.

Confidentiality Integrity

Availability

Figure 1-1: The CIA triad

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

What Is Information Security? 5

The CIA triad is a model by which you can think about and discuss security concepts. It’s also sometimes written as CAI or expressed in its negative form as disclosure, alteration, and denial (DAD).

Confidentiality

Confidentiality refers to our ability to protect our data from those who are not authorized to view it. You could implement confidentiality at many levels of a process.

As an example, imagine a person is withdrawing money from an ATM. The person in question will likely seek to maintain the confidentiality of the personal identification number (PIN) that allows him to draw funds from the ATM if he has his ATM card. Additionally, the owner of the ATM will maintain the confidentiality of the account number, balance, and any other information needed to communicate to the bank from which the funds are being drawn. The bank will also maintain the confidentiality of the transac- tion with the ATM and the balance change in the account after the funds have been withdrawn.

Confidentiality can be compromised in a number of ways. You could lose a laptop containing data. A person could look over your shoulder while you enter a password. You could send an email attachment to the wrong person, or an attacker could penetrate your systems, to name a few ways.

Integrity

Integrity is the ability to prevent people from changing your data in an unauthorized or undesirable manner. To maintain integrity, not only do you need to have the means to prevent unauthorized changes to your data, but you need the ability to reverse unwanted authorized changes.

A good example of mechanisms that allow you to control integrity are in the file systems of many modern operating systems, such as Windows and Linux. For the purposes of preventing unauthorized changes, such systems often implement permissions that restrict what actions an unauthorized user can perform on a given file. For example, the owner of a file might have per- mission to read it and write to it, while others might have permission only to read, or no permission to access it at all. Additionally, some such systems and many applications, such as databases, can allow you to undo or roll back changes that are undesirable.

Integrity is particularly important when it concerns data that provides the foundation for other decisions. If an attacker were to alter the data that contained the results of medical tests, a doctor might prescribe the wrong treatment, which could kill the patient.

Availability

The final leg of the CIA triad is availability. Availability refers to the ability to access our data when we need it. You could lose availability due to a power loss, operating system or application problems, network attacks, or the com- promising of a system, for example. When an outside party, like an attacker, causes such issues, we typically call this a denial-of-service (DoS) attack.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

6 Chapter 1

How Does the CIA Triad Relate to Security?

Given the elements of the CIA triad, we can begin to discuss security issues with more detail than we otherwise could. For example, let’s consider a ship- ment of backup tapes on which you’ve stored the only existing, unencrypted copies of some sensitive data.

If you were to lose the shipment in transit, you would have a security issue. This is likely to include a breach of confidentiality since your files were not encrypted. The lack of encryption could also cause integrity issues. If you recover the tapes in the future, it may not be immediately obvious to you if an attacker had altered the unencrypted files, as you would have no good way to discern altered from unaltered data. As for availability, you’ll have an issue unless the tapes are recovered since you don’t have backup copies of the files.

Although you can describe the situation in this example with relative accuracy using the CIA triad, you might find that the model is too restric- tive to describe the entire situation. A more extensive model, the Parkerian hexad, exists for these cases.

The Parkerian Hexad The Parkerian hexad, a less well-known model named after Donn Parker and introduced in his book Fighting Computer Crime, provides a somewhat more complex variation of the classic CIA triad. Where the CIA triad con- sists only of confidentiality, integrity, and availability, the Parkerian hexad consists of these three principles as well as possession or control, authentic- ity, and utility,3 for a total of six principles, as shown in Figure 1-2.

Confidentiality

Possession

Availability Utility

Integrity

Authenticity

Figure 1-2: The Parkerian hexad

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

What Is Information Security? 7

Confidentiality, Integrity, and Availability

As I mentioned, the Parkerian hexad includes the three principles of the CIA triad, with the same definitions just discussed. Parker describes integ- rity slightly differently; he doesn’t account for authorized, but incorrect, modification of data. For him, the data must be whole and completely unchanged from its previous state.

Possession or Control

In the Parkerian hexad, possession or control refers to the physical disposition of the media on which the data is stored. This enables you to discuss your loss of the data in its physical medium without involving other factors such as availability. Returning to the example of your lost shipment of backup tapes, let’s say that some of them were encrypted and some of them were not. The principle of possession would enable you to more accurately describe the scope of the incident; the encrypted tapes in the lot cause a possession problem but not a confidentiality problem, while the unen- crypted tapes cause a problem on both counts.

Authenticity

The principle of authenticity allows you to say whether you’ve attributed the data in question to the proper owner or creator. For example, if you send an email message that is altered so that it appears to have come from a dif- ferent email address than the one from which it was actually sent, you would be violating the authenticity of the email. Authenticity can be enforced using digital signatures, which I’ll discuss further in Chapter 5.

A similar, but reversed, concept to this is nonrepudiation, which prevents people from taking an action, such as sending an email and then later deny- ing that they have done so. I’ll discuss nonrepudiation at greater length in Chapter 4 as well.

Utility

Finally, utility refers to how useful the data is to you. Utility is also the only principle of the Parkerian hexad that is not necessarily binary in nature; you can have a variety of degrees of utility, depending on the data and its format. This is a somewhat abstract concept, but it does prove useful in dis- cussing certain situations in the security world.

For instance, in the shipment of backup tapes example, imagine that some of the tapes were encrypted and some were not. For an attacker or other unauthorized person, the encrypted tapes would likely be of very little utility, as the data would not be readable. The unencrypted tapes would be of much greater utility, as the attacker or unauthorized person would be able to access the data.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

8 Chapter 1

The concepts discussed in both the CIA triad and the Parkerian hexad provide a practical basis to discuss all the ways in which something can go wrong in the world of information security. These models enable you to better discuss the attacks that you might face and the types of controls that you need to put in place to combat them.

Attacks You may face attacks from a wide variety of approaches and angles. You can break these down according to the type of attack, the risk the attack repre- sents, and the controls you might use to mitigate it.

Types of Attacks You can generally place attacks into one of four categories: interception, interruption, modification, and fabrication. Each of the categories can affect one or more of the principles of the CIA triad, as shown in Figure 1-3.

Interception

Interruption Modification Fabrication

Figure 1-3: The CIA triad and categories of attacks

The line between the categories of attack and the effects they can have are somewhat blurry. Depending on the attack in question, you might include it in more than one category or have more than one type of effect.

Interception

Interception attacks allow unauthorized users to access your data, appli- cations, or environments, and they are primarily attacks against confi- dentiality. Interception might take the form of unauthorized file viewing or copying, eavesdropping on phone conversations, or reading someone else’s email, and you can conduct it against data at rest or in motion (con- cepts explained in the “Data at Rest and in Motion” box). When they’re properly executed, interception attacks can be difficult to detect.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

What Is Information Security? 9

D A T A A T R E S T A N D I N M O T I O N

You will find, repeatedly throughout this book, that I refer to data being either “at rest” or “in motion,” so let’s talk about what this means. Data at rest is stored data that is not in the process of being moved from one place to another. It may be on a hard drive or flash drive, or it may be stored in a database, for example. This type of data is generally protected with some sort of encryption, often at the level of the file or entire storage device.

Data in motion is data that is moving from one place to another. When you are using your online banking session, the sensitive data flowing between your web browser and your bank is data in motion. Data in motion is also protected by encryption, but in this case the encryption protects the network protocol or path used to move the data from one place to another.

Some may also posit a third category, data in use. Data in use would be data that an application or individual was actively accessing or modify- ing. Protections on data in use would include permissions and authentication of users. Often you will find the concept of data in use conflated with data in motion. Sound arguments can be made on both sides about whether we should treat this type of data as its own category.

Interruption

Interruption attacks make your assets unusable or unavailable to you on a temporary or permanent basis. These attacks often affect availability but can affect integrity, as well. You would classify a DoS attack on a mail server as an availability attack.

On the other hand, if an attacker manipulated the processes on which a database runs to prevent access to the data it contains, you might consider this an integrity attack because of the possible loss or corruption of data, or you might consider it a combination of the two. You might also consider such a database attack to be a modification attack rather than an interrup- tion attack, as you’ll see next.

Modification

Modification attacks involve tampering with an asset. Such attacks might primarily be considered attacks on integrity but could also represent attacks on availability. If you access a file in an unauthorized manner and alter the data it contains, you’ve affected the integrity of the file’s data. However, if the file in question is a configuration file that manages how a service behaves— perhaps one that is acting as a web server—changing the contents of the file might affect the availability of that service. If the configuration you altered in the file for your web server changes how the server deals with encrypted con- nections, you could even call this a confidentiality attack.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

10 Chapter 1

Fabrication

Fabrication attacks involve generating data, processes, communications, or other similar material with a system. Like the last two attack types, fabrica- tion attacks primarily affect integrity but could affect availability, as well. Generating fake information in a database would be a kind of fabrication attack. You could also generate email, a common method for propagating malware. If you generated enough additional processes, network traffic, email, web traffic, or nearly anything else that consumes resources, you might be conducting an availability attack by rendering the service that handles such traffic unavailable to legitimate users.

Threats, Vulnerabilities, and Risk To speak more specifically about attacks, I need to introduce a few new terms. When you look at how an attack might affect you, you can speak of it in terms of threats, vulnerabilities, and the associated risk.

Threats

When I spoke of the types of attacks you might encounter earlier in this chapter, I discussed several types of attacks that could harm your assets— for instance, the unauthorized modification of data. Ultimately, a threat is something that has the potential to cause harm. Threats tend to be specific to certain environments, particularly in the world of information security. For example, although a virus might be problematic on a Windows operat- ing system, the same virus will be unlikely to have any effect on a Linux operating system.

Vulnerabilities

Vulnerabilities are weaknesses, or holes, that threats can exploit to cause you harm. A vulnerability might involve a specific operating system or appli- cation that you’re running, the physical location of your office building, a data center that is overpopulated with servers and producing more heat than its air-conditioning system can handle, a lack of backup generators, or other factors.

Risk

Risk is the likelihood that something bad will happen. For you to have a risk in an environment, you need to have both a threat and a vulnerability that the threat could exploit. For example, if you have a structure that is made from wood and you light a fire nearby, you have both a threat (the fire) and a matching vulnerability (the wood structure). In this case, you most defi- nitely have a risk.

Likewise, if you have the same threat of fire but your structure is made of concrete, you no longer have a credible risk because your threat doesn’t have a vulnerability to exploit. You could argue that a sufficiently hot flame could damage the concrete, but this is a much less likely event.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

What Is Information Security? 11

We often talk about potential, but unlikely, attacks in computing envi- ronments. The best strategy is to spend your time mitigating the most likely attacks. If you sink your resources into trying to plan for every possible attack, however unlikely, you’ll spread yourself thin and lack protection where you need it the most.

Impact

Some organizations, such as the US National Security Agency (NSA), add a factor to the threat/vulnerability/risk equation called impact. Impact takes into account the value of the asset being threatened and uses it to calcu- late risk. In the backup tape example, if you consider that the unencrypted tapes contain only your collection of chocolate chip cookie recipes, you may not actually have a risk because the data exposed contains nothing sensitive and you can make additional backups from the source data. In this case, you might safely say that you have no risk.

Risk Management Risk management processes compensate for risks in your environment. Figure 1-4 shows a typical risk management process at a high level.

Identify assets

Identify threats

Assess vulnerabilities

Assess risks

Mitigate risks

Figure 1-4: A risk management process

As you can see, you need to identify your important assets, figure out the potential threats against them, assess your vulnerabilities, and then take steps to mitigate these risks.

Identify Assets

One of the first and, arguably, most important parts of the risk management process is identifying the assets you’re protecting. If you can’t enumerate your assets and evaluate the importance of each, protecting them can become a difficult task indeed.

Although this may sound like an exceedingly simple task, it can be a more complex problem than it might seem on the surface, particularly in larger enterprises. In many cases, an organization might have various gen- erations of hardware, assets from acquisitions of other companies lurking in unknown areas, and scores of unrecorded virtual hosts in use, any of which may be critical to the continued functionality of the business.

Once you’ve identified the assets in use, deciding which of them are critical business assets is another question entirely. Making an accurate determination of which assets are truly critical to conducting business will generally require the input of functions that make use of the asset, those that support the asset itself, and potentially other involved parties as well.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

12 Chapter 1

Identify Threats

After enumerating your critical assets, you can then begin to identify the threats that might affect them. It’s often useful to have a framework for dis- cussing the nature of a given threat, and the CIA triad or Parkerian hexad discussed earlier in this chapter serves nicely for this purpose.

For instance, let’s apply the Parkerian hexad to examine the threats you might face against an application that processes credit card payments.

Confidentiality If you expose data inappropriately, you could poten- tially have a breach.

Integrity If data becomes corrupt, you may incorrectly process payments.

Availability If the system or application goes down, you won’t be able to process payments.

Possession If you lose backup media, you could potentially have a breach.

Authenticity If you don’t have authentic customer information, you may process a fraudulent transaction.

Utility If you collect invalid or incorrect data, that data will have limited utility.

While this is clearly a high-level pass at assessing threats for this system, it does point out a few problem areas immediately. You need to be concerned with losing control of data, maintaining accurate data, and keeping the sys- tem up and running. Given this information, you can begin to look at areas of vulnerability and potential risk.

Assess Vulnerabilities

When assessing vulnerabilities, you need to do so in the context of poten- tial threats. Any given asset may have thousands or millions of threats that could impact it, but only a small fraction of these will be relevant. In the previous section, you learned about potential threats against a system that processes credit card transactions.

Let’s look at the issues that were identified and attempt to determine whether vulnerabilities exist in any of them.

Confidentiality If you expose data inappropriately, you could have a breach.

Your sensitive data is encrypted at rest and in motion. Your systems are regularly tested by an external penetration testing company. This is not a risk.

Integrity If data becomes corrupt, you may incorrectly process payments.

You carefully validate that payment data is correct as part of the processing workflow. Invalid data results in a rejected transaction. This is not a risk.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

What Is Information Security? 13

Availability If the system or application goes down, you can’t process payments.

You do not have redundancy for the database on the back end of the payment processing system. If the database goes down, you can’t process payments. This is a risk.

Possession If you lose backup media, you could have a breach. Your backup media is encrypted and hand-carried by a courier. This

is not a risk.

Authenticity If you don’t have authentic customer information, you may process a fraudulent transaction.

Ensuring that valid payment and customer information belongs to the individual conducting the transaction is difficult. You do not have a good way of doing this. This is a risk.

Utility If you collect invalid or incorrect data, that data will have limited utility.

To protect the utility of your data, you checksum credit card num- bers, make sure that the billing address and email address are valid, and perform other measures to ensure that your data is correct. This is not a risk.

These examples are a high-level view of the process you’d need to undertake, but they serve to illustrate the task. From here, you can again see a few areas of concern, namely, in the areas of authenticity and availabil- ity, and you can begin to evaluate the areas in which you may have risks.

Assess Risks

Once you’ve identified the threats and vulnerabilities for a given asset, you can assess the overall risk. As discussed earlier in this chapter, risk is the conjunction of a threat and a vulnerability. A vulnerability with no matching threat or a threat with no matching vulnerability does not constitute a risk.

For example, the following item was both a potential threat and an area of vulnerability:

Availability If the system or application goes down, you can’t process payments.

You don’t have redundancy for the database on the back end of your payment processing system, so if the database goes down, you won’t be able to process payments.

In this case, you have both a threat and a corresponding vulnerability, meaning you risk losing ability to process credit card payments because of a single point of failure on your database back end. Once you’ve worked through your threats and vulnerabilities in this manner, you can mitigate these risks.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

14 Chapter 1

Mitigate Risks

To mitigate risks, you can put measures in place to account for each threat. These measures are called controls. Controls are divided into three catego- ries: physical, logical, and administrative.

Physical controls protect the physical environment in which your systems sit, or where your data is stored. Such controls also control access in and out of such environments. Physical controls include fences, gates, locks, bollards, guards, and cameras, but also systems that maintain the physical environment, such as heating and air-conditioning systems, fire suppression systems, and backup power generators.

Although at first glance physical controls may not seem like they’d be integral to information security, they’re one of the most critical controls; if you’re not able to physically protect your systems and data, any other controls that you put in place become irrelevant. If attackers can physically access your systems, they can steal or destroy them, rendering them unavailable for your use—in the best case. In the worst case, attackers will be able to access your applications and data directly and steal your information and resources or subvert them for their own use.

Logical controls, sometimes called technical controls, protect the systems, networks, and environments that process, transmit, and store your data. Logical controls can include items such as passwords, encryption, access controls, firewalls, and intrusion detection systems.

Logical controls enable you to prevent unauthorized activities; if your logical controls are implemented properly and are successful, an attacker or unauthorized user can’t access your applications and data without subvert- ing the controls.

Administrative controls are based on rules, laws, policies, procedures, guidelines, and other items that are “paper” in nature. Administrative con- trols dictate how the users of your environment should behave. Depending on the environment and control in question, administrative controls can represent differing levels of authority. You may have a simple rule such as “turn the coffee pot off at the end of the day,” aimed at avoiding a physical security problem (burning your building down at night). You may also have a more stringent administrative control, such as one that requires you to change your password every 90 days.

One important part of administrative controls is the ability to enforce them. If you don’t have the authority or the ability to ensure that people com- ply with your controls, they are worse than useless because they create a false sense of security. For example, if you create a policy that says employees can’t use business resources for personal use, you’ll need to be able to enforce this. Outside of a highly secure environment, this can be a difficult task. You’d need to monitor telephone and mobile phone usage, web access, email use, instant message conversations, installed software, and other potential areas for abuse. Unless you were willing to devote a great deal of resources to moni- toring these and handling violations of policy, you’d quickly have a policy that you wouldn’t be able to enforce. The next time you’re audited and asked to produce evidence of policy enforcement, you’ll face issues.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

What Is Information Security? 15

Incident Response If your risk management efforts are not as thorough as you hoped or you’re blindsided by something entirely unexpected, you can react with incident response. You should direct your incident response at the items that you feel are most likely to cause your organization pain. You should have already identified these as part of your risk management efforts.

As much as possible, you should base your reaction to such incidents on documented incident response plans, which should be regularly reviewed, tested, and practiced by those who will be expected to enact them in the case of an actual incident. You don’t want to wait until an actual emergency to find out documentation that has been languishing on a shelf is outdated and refers to processes or systems that have changed heavily or no longer exist.

The incident response process, at a high level, consists of the following:

• Preparation • Detection and analysis • Containment • Eradication • Recovery • Post-incident activity

I’ll go over these phases in more detail next.

Preparation

The preparation phase of incident response consists of all the activities you can perform ahead of time to better handle an incident. This typically involves creating policies and procedures that govern incident response and handling, conducting training and education for both incident handlers and those who are expected to report incidents, and developing and main- taining documentation.

You shouldn’t underestimate the importance of this phase of incident response. Without adequate preparation, it is extremely unlikely that the response to an incident will go well or according to your unpracticed plans. The time to determine what needs to be done, who needs to do it, and how to do it is not when you’re faced with an emergency.

Detection and Analysis

The detection and analysis phase is where the action begins. In this phase, you detect an issue, decide whether it’s actually an incident, and respond to it appropriately.

Most often, you’ll detect the issue with a security tool or service, like an intrusion detection system (IDS), antivirus (AV) software, firewall logs, proxy logs, or alerts from a security information and event monitoring (SIEM) tool or managed security service provider (MSSP).

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

16 Chapter 1

The analysis portion of this phase is often a combination of automation from a tool or service, usually a SIEM tool, and human judgment. While you can often use some sort of thresholding to say that a certain number of events in a given amount of time is normal or that a certain combination of events is not normal (two failed logins, followed by a success, a password change, and the creation of a new account, for instance), you’ll often want human intervention at a some point. Human intervention might include a review of logs output by various security, network, and infrastructure devices; contact with the party who reported the incident; and general evaluation of the situation. (Unfortunately for the incident handler, these situations often occur at 4 pm on a Friday or 2 am on a Sunday.)

When the incident handler evaluates the situation, that person will decide whether the issue constitutes an incident, evaluate the criticality of the incident, and contact any additional resources needed to proceed to the next phase.

Containment, Eradication, and Recovery

The containment, eradication, and recovery phase is where most of the work to solve the incident takes place, at least in the short term.

Containment involves taking steps to ensure that the situation doesn’t cause any more damage than it already has—or at least lessen any ongoing harm. If the problem involves a malware-infected server actively being controlled by a remote attacker, this might mean disconnecting the server from the network, putting firewall rules in place to block the attacker, and updating signatures or rules on an intrusion prevention system (IPS) to halt the traffic from the malware.

During eradication, you’ll attempt to remove the effects of the issue from your environment. In the case of your malware-infected server, you’ve already isolated the system and cut it off from its command-and-control network. Now you’ll need to clean the malware from the server and ensure that it doesn’t exist elsewhere in your environment. This might involve additional scanning of other hosts in the environment to ensure that the malware is not present and perhaps examining logs on the server and network to deter- mine what other systems the infected server has communicated with. With malware, particularly very new malware or variants, this can be a tricky task. Whenever you’re in doubt about whether you’ve truly evicted malware or attackers from your environment, you should err on the side of caution.

Lastly, you need to recover the state you were in prior to the incident. Recovery might involve restoring devices or data from backup media, rebuild- ing systems, or reloading applications. Again, this can be a more painful task than it initially seems because your knowledge of the situation might be incomplete or unclear. You may find that you are unable to verify that backup media is clean and free or infection or that the backup media is entirely bad. Application install bits may be missing, configuration files may not be avail- able, or many other issues could occur.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

What Is Information Security? 17

Post-Incident Activity

Like preparation, post-incident activity is easy to overlook, but you should ensure that you don’t neglect it. In the post-incident activity phase, often referred to as a post-mortem (Latin for “after death”), you attempt to deter- mine specifically what happened, why it happened, and what you can do to keep it from happening again. The purpose of this phase is not to point fingers or place blame (although this does sometimes happen) but to ulti- mately prevent or lessen the impact of future such incidents.

Defense in Depth Now that you’ve learned about the potential effects of a security breach, the kinds of attacks you might face, and the strategies for dealing with these attacks, I’ll introduce you to a method of working toward prevent- ing these attacks. Defense in depth is a strategy common to both military maneuvers and information security. The basic concept is to formulate a multilayered defense that will allow you to still mount a successful resis- tance should one or more of your defensive measures fail.

In Figure 1-5, you can see an example of layers you might want to put in place to defend your assets.

Data

Internal network

Host

External network

Application

Figure 1-5: Defense in depth

At the least, you would want defenses at the external network, internal network, host, application, and data levels. Well-implemented defenses at each layer make it difficult to successfully penetrate your network and attack your assets directly.

That said, defense in depth is not a magic bullet. No matter how many layers you put in place or how many defensive measures you place at each layer, you won’t be able to keep every attacker out for an indefinite period. Nor is this the goal of defense in depth in an information security setting. The goal is to place enough defensive measures between your truly impor- tant assets and the attacker so that you’ll notice that an attack is in progress and have enough time to prevent it.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

18 Chapter 1

An example of such a delaying tactic is requiring employees to change their passwords every 60 or 90 days. This makes it harder for an attacker to crack a password in time to still use it.

Using stringent password construction rules is another delaying tactic. Consider the password “mypassword,” which is ten characters long and uses only one character set. Using a relatively slow off-the-shelf system, an attacker might take a week or two to crack this password. With a purpose- built password cracking system or a botnet, an attacker might take only an hour or two.

If you use more secure password construction rules and go with a password along the lines of MyP@ssword1, which is also ten characters long but uses four character sets, cracking the password would take thou- sands of years on purpose-built hardware and upward of several years for a large botnet.

If you require employees to both change their passwords frequently and create complex passwords, an attacker won’t be able to crack one in time to use it.

E N T R O P Y I N P A S S W O R D S

The complex password example discussed previously uses a classic strong pass- word construction scheme, consisting of eight or more characters and comprising multiple character sets (upper alpha, lower alpha, numbers, and punctuation). Some would argue it contains insufficient entropy (unpredictability) to be truly secure and that you’d be better served with a longer, more entropic, and more easily remembered password like correcthorsebatterystaple.4

Ultimately, your primary concern should be in constructing reasonably secure passwords and changing them at regular intervals.

The layers you include in your defense-in-depth strategy will vary given the situation and environment you’re defending. As discussed, from a strictly logical (nonphysical) information security perspective, you’d want to look at the external network, network perimeter, internal network, host, application, and data layers as areas to place your defenses.

You could add complexity to your defensive model by including other vital layers, such as physical defenses, policies, or user awareness and train- ing, but I’ll stick with a simpler example for the time being.

Table 1-1 lists some of the defenses you might use for each of the layers discussed.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

What Is Information Security? 19

Table 1-1: Defense by Layer

Layer Defensive measures

External network DMZ VPN Logging Auditing Penetration testing Vulnerability analysis

Network perimeter Firewalls Proxy Logging Stateful packet inspection Auditing Penetration testing Vulnerability analysis

Internal network IDS IPS Logging Auditing Penetration testing Vulnerability analysis

Host Authentication Antivirus Firewalls IDS IPS Passwords Hashing Logging Auditing Penetration testing Vulnerability analysis

Application SSO Content filtering Data validation Auditing Penetration testing Vulnerability analysis

Data Encryption Access controls Backups Penetration testing Vulnerability analysis

In some cases, a defensive measure appears in multiple layers because it applies to more than one area. A good example of this is penetration testing, a method of finding gaps in your security by using some of the same strat- egies an attacker would use to break in, which appears in every layer. I’ll

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

20 Chapter 1

discuss this in greater depth in Chapter 14. You might want to use penetra- tion testing at every layer of your defense. You can also see where specific controls may be tied to particular layers, such as firewalls and proxies at the network perimeter. As with everything else in the security field, you could argue that some or all of these controls could exist at layers other than what is shown here, but this is a good general guideline. As you move through the book, I’ll discuss each of these areas shown in Table 1-1 in greater detail, as well as the specific defenses you might want to use for each.

Summary When discussing issues pertaining to information security, such as attacks and controls, it’s helpful to have a model by which to do so. This chapter discussed two potential models: the CIA triad, composed of confidentiality, integrity, and availability; and the Parkerian hexad, composed of confiden- tiality, integrity, availability, possession or control, authenticity, and utility.

As you look toward preventing attacks, it is also helpful to understand the general categories of damage that you might see occur in the event of an attack. Attacks may impact environments through interception, inter- ruption, modification, or fabrication. Each of these effects would impact particular areas of the CIA triad.

When discussing specific threats you might face, it’s important to understand the concept of risk. You only face risk from an attack when a threat is present and you have a vulnerability that threat can exploit. To mitigate risk, you use three main types of controls: physical, logical, and administrative.

Finally, this chapter covered defense in depth, a particularly important concept in the world of information security. To build defensive measures using this concept, you put in place multiple layers of defense to delay an attacker long enough to alert you to the attack and to allow you to mount a more active defense.

The concepts discussed in this chapter are foundational to informa- tion security. They’re used on a regular basis during normal information security tasks in many organizations; you might hear someone talking about breaches of confidentiality, for example, or the authenticity of a given email message.

Information security is a daily concern for organizations of any size, particularly those that handle any type of personal information, financial data, healthcare data, educational data, or other types of information regu- lated by the laws of the country in which the organization operates. When an organization doesn’t invest in information security, the repercussions can be severe. They might face fines, lawsuits, or even the inability to continue conducting business if they lose control of critical or sensitive data. In short, information security is a key component of the modern business world.

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

What Is Information Security? 21

Exercises Here are some questions to help you review the key concepts of this chapter:

1. Explain the difference between a vulnerability and a threat.

2. What are six items that might be considered logical controls?

3. What term might you use to describe the usefulness of data?

4. Which category of attack is an attack against confidentiality?

5. How do you know at what point you can consider your environment to be secure?

6. Using the concept of defense in depth, what layers might you use to secure yourself against someone removing confidential data from your environment on a USB flash drive?

7. Based on the Parkerian hexad, what principles are affected if you lose a shipment of encrypted backup tapes that contain personal and pay- ment information for your customers?

8. If the web servers in your environment are based on Microsoft’s Internet Information Services (IIS) and a new worm is discovered that attacks Apache web servers, what do you not have?

9. If you develop a new policy for your environment that requires you to use complex and automatically generated passwords that are unique to each system and are a minimum of 30 characters in length, such as “!Qa4( j0nO$&xn1%2AL34ca#!Ps321$,” what will be adversely impacted?

10. Considering the CIA triad and the Parkerian hexad, what are the advantages and disadvantages of each model?

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .

C o p yr

ig h t ©

2 0 1 9 . N

o S

ta rc

h P

re ss

, In

co rp

o ra

te d . A

ll ri g h ts

r e se

rv e d .