System design and implementation information technology question
jackr.0035
Lecture20-DisasterRecovery.pptxLecture 20 – Disaster Recovery
1
Security levels
“You are the weakest link” – your security is only as strong as the weakest link
Physical Security
Physical security
The physical environment, including IT resources and people throughout the organization
Large firms often have a dedicated room built solely for IT operations
Smaller firms might use an office or storage area
Regardless of size, an operations center must be secure from unwanted intrusion
Operations center security - Each entrance must be equipped with a suitable security device
Use secure keypads and change the key regularly, or
Use biometric scanning devices
Video cameras, CCTV, motion detectors
Any other kind of monitors you would want in this room?
Other types of monitors would include: temperature and humidity in the computer room; smoke detectors
4
biometrics
Ask the class, why procedures?
5
Servers and desktop computers
Install locks on server racks to avoid unauthorized placement of keystroke loggers
Tamper evident cases
Monitor screen savers on laptops and desktops – probably should be set for about 5 minutes, so it will be effective without being distracting
BIOS-level password (aka boot-level password or power-on password) – user must enter into computer before it will boot – often used in a Single Sign-On (SSO) environment, as we have at GSU
Keystroke logger – although could be physical, today they are more likely to be downloaded as malware
Tamper evident cases – designed to show any attempt to open or unlock the case. In situation of a computer case being opened, an indicator LED remains lit until it is cleared wth a password
6
Portable computers – laptops and tablets
Use SSO (BIOS-level passwords) on these, too
Don’t allow administrator privileges
Mark or engrave computer case with company name, address, or use a tamper-proof asset tag
Consider devices that have a built-in fingerprint reader and use the Universal Security Slot (USS) if available
Back up all vital data before using the computer outside the office and link the system to a tracking software
Be alert to high-risk situations while traveling – airport baggage claim, rental car counters, hotel check-in, restaurants, bars. Place devices in trunk in a rental car
Use tracking software that directs laptop to periodically contact a security tracking center
While these measures won’t deter a professional thief, they might deter a casual thief, or at least make device less desirable because it would be more difficult to use or resell
7
Network Security
Network security guidelines
Use public key encryption – it’s normally used in e-commerce sites, anyway
Wireless networks:
Enforce use of VPN technology on corporate mobile users – organization must choose one VPN provider and ensure all corporate users use it on their laptops, tablets, & smartphones
Enforce the use of WPA2 to secure wireless access points (WAPs) in the corporate environment. WEP is outdated and should never be used, and WPA is as well
More network security guidelines
Within the corporate environment, use an Intranet (private network) – this will probably require implementation of SSO to access it
As mentioned before – use a VPN, especially for remote corporate employees
Perform regular port scans in the corporate environment
Hire a firm to do penetration testing at least once a year (of course, depends on size of your company) – your company probably doesn’t have the expertise to do this
Don’t just have this done and “sit on it” – implement the pen tester’s recommendations!
Ensure you have a firewall (perhaps more) in place – as a minimum, where your corporate network meets the untrusted Internet
Implement a network IDS – probably at the chokepoint where the network meets the untrusted Internet
Many of you have seen this before
Firewall Rules
Application Security
Services , hardening, application permissions
Services that are not needed must be disabled
Unnecessary or improperly configured service could create a security hole
Hardening process – makes a system more secure by removing unnecessary accounts, services, and features.
Hardening is necessary b/c default config of some software packages might create vulnerability
Also includes placement of anti-virus and anti-spyware programs
Application permissions – admin or superuser accounts allows unlimited access. These must be controlled rigorously.
Each user should have their program and file permissions set properly and periodically reviewed.
Security hole example – if a loosely configured FTP service is available to a hacker, he or she might be able to upload destructive code to the server
Hardening example – as we all know, initial software settings often use default passwords and/or configs, and these must be changed.
Hardening might be done manually, or with a config template, which speeds up process in large orgs
13
Input validation, patches & updates, software logs
Input validation helps safeguard data integrity and security
Patches and updates - Used to repair security holes, reduce vulnerabilities, and update the system. Must be performed on a regular basis, to all devices
Software logs document all events
Help understand past attacks and prevent future intrusions
System administrator must determine detail, or granularity, of these’
Might be determined by legal or professional regulations
Have to be stored in accordance with those regulations
14
File Security
Encryption, permissions
Encryption - Scrambles the contents of a file or document to protect it from unauthorized access
Organization has to determine at what level this will be performed: entire database; particular tables or files; record level; even field level
Org also has to determine the encryption methodology to use
Permissions - Describe the rights a user has to a particular file or directory on a server
Administrators can create user groups and assign file permissions to the entire group
User Security
User security
Identity management: Controls and procedures necessary to identify legitimate users and system components
Strategy must balance technology, security, privacy, cost, and user productivity
Password protection
Password policies need to specify a set minimum length, complexity, and a limit on invalid attempts
Social engineering: Intruder uses social interaction to gain unauthorized access to a computer system
Pretexting in social engineering – method of obtaining personal info under false pretenses. Commonly the precursor to identity theft
18
User resistance
Tight security measures may seem to employees, and especially managers, to be inconvenient and time consuming
You need to make users understand that the system being implemented will help the customers, and that those customers have entrusted their personal info to the firm. That the firm’s employees have entrusted their PII to the firm. All stored on system hard drives and other storage mechanisms.
Users need to understand and be a part of the organization’s commitment to security
19
Procedural Security
Procedural, or operational, security
Defines how particular tasks are to be performed
Includes safeguarding procedures that would be valuable to an attacker
Organization must explain procedures and issue reminders that will make security issues a priority
For example, an employee handbook might require users logout of their system accounts, clear their desks, and secure all documents before leaving for the day
“Clean Desk Policy” – similar to the one at AA & Co.
Document classification – esp docs used in acquisition and development of the system
Need-to-know concept: access is limited to employees who need the info to perform security-related tasks. Example: highly sensitive docs might be available only to the IT support team
21
Backup and recovery
Disaster recovery
Recovery involves restoring all data and restarting the system after an interruption
Overall backup and recovery plan that prepares for a potential disaster is a disaster recovery plan
Must include:
List of important personnel – who is going to do what, where, how, and especially, when
When the plan goes into effect – who and when is a disaster declared. What triggers the disaster declaration – is it really a disaster, or something less (an “incident”)
All of the step-by-step procedures that it will take to restore the org and its data to state prior to the disaster
23
backup
Backup media: Includes tape, hard drives optical and online storage
Offsiting: Storing backup away from the business location – where are you going to place this?
Cloud-based storage may make this effort a lot easier
Backup types:
Full, differential, incremental, and continuous
Retention periods: Backups are stored for a specific time beyond which they are either destroyed or reused
Backup types
Business continuity issues
A disaster recovery plan should be created along with a test plan
Often part of a business continuity plan (BCP)
BCP: Defines how critical business functions can continue during a major disruption
Specifies the use of a hot site, which requires data replication
Warm site – machines, but none of your software
Cold site – nothing there but HVAC and electricity. You have to bring everything yourself
