Fundamentals of Information Systems Security: Lesson 6 Security Operations and Administration

Fundamentals of Information
Systems Security
Lesson 6
Security Operations and Administration
© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

www.jblearning.com
All rights reserved.
Learning Objective(s)
 Explain the role of IT operations,
administration, and security policies.

Fundamentals of Information Systems Security www.jblearning.com Page 2
Key Concepts
 Role of security administration within an
organization
 Components of an IT security policy infrastructure
 Data classification standards used by
organizations and the DoD
 Change management and configuration
management
 The system life cycle (SLC) and the system
development life cycle (SDLC)

Security Administration
 The group of individuals responsible for
planning, designing, implementing, and
monitoring an organization’s security plan
 Identify and document the assets, and then
assign responsibility of each one to a
person or position

Controlling Access
Identification
Authentication
Authorization
Accountability

Documentation, Procedures, and
Guidelines
The most common documentation requirements include:
• Sensitive assets list

• The organization’s security process
• The authority of the persons responsible for security
• The policies, procedures, and guidelines adopted by the
organization
An organization must comply with rules on two levels:
• Regulatory compliance
• Organizational compliance

Disaster Assessment and Recovery
 The security administration team handles
incidents, disasters, and other interruptions
 The emergency operations group is
responsible for protecting sensitive data in
the event of:
• Natural disasters
• Equipment failure
• Other potential emergencies

Security Outsourcing
 Advantages
• High level of expertise
 Disadvantages
• The outsourcing firm might not possess
internal knowledge
• You won’t develop in-house capability or
talent and have to continue to pay for these
services indefinitely

Outsourcing Concerns
Privacy
Risk
Data security
Ownership
Adherence to policy

Common Agreements
Service-level agreement (SLA)
Blanket purchase agreement (BPA)
Memorandum of understanding (MOU)
Interconnection security agreement (ISA)

Compliance
Event logs
Compliance liaison
Remediation

Professional Ethics
 Set the example
 Encourage adopting ethical guidelines and
standards
 Inform users through security awareness
training
 A code of ethics helps ensure
professionalism

Personnel Security Principles
Limiting Separation
Job rotation
Access of duties
Mandatory Security Security

vacations training awareness
Social
engineering

The Infrastructure for an IT Security
Policy
Policies
Standards
Procedures
Baselines
Guidelines

The Security Policy Environment

The Security
Policy
Hierarchy

Data Classification Standards
 Classification is the duty of the data owner
or someone the owner assigns
 System owner is the person or group that
manages the infrastructure
 Classifying information criteria:
• Value
• Sensitivity
• Criticality

Information Classification Objectives
 To identify information protection requirements
 To identify data value in accordance with organization
policy
 To ensure that sensitive and/or critical information is
provided appropriate protection/controls
 To lower costs by protecting only sensitive information
 To standardize classification labeling throughout the
organization
 To alert employees and other authorized personnel to
protection requirements
 To comply with privacy law and regulations
Examples of Classification
• Unclassified
• Restricted
U.S. government • Confidential
(standardized) • Secret
• Top Secret
• Public (low)
Private sector • Private (medium)
(not standardized) • Confidential (high)

Configuration Management
 The process of managing all changes to
computer and device configurations
 Evaluates the impact a modification might
have on security
 As a security professional, your job is to:
• Ensure that you adequately review all system
changes
• Ensure that configuration changes will not
cause unintended consequences for security
Hardware Inventory and
Configuration Chart
 A decision to roll out a new patch, service
pack, or release will be complicated if you
can’t find, update, and test every affected
device
 Have an up-to-date map or layout of the
configuration of the hardware components
 Regularly check for any available vendor
upgrades and service packs

The Change Management Process
Configuration control
• The management of the baseline settings for
a system device
Change control
• The management of changes to the
configuration

Change Control Management
 Communicate change management procedures
and standards effectively
 Reactive or proactive
• Reactive: Management responds to changes in the
business environment
• Proactive: Management initiates the change to
achieve a desired goal
 Occurs on a continuous, regularly scheduled,
release, or program-by-program basis

Change Control Committees
Ensure changes are:
• Properly tested
• Authorized
• Scheduled
• Communicated
• Documented

Change Control Procedures

Change Control Issues
• Ensure that a peer or another expert

Peer reviews double-checks all changes before you
put them into production
• Ensure that if the change doesn’t work

Back-out plans properly, a plan exists to restore the
system to a known good condition
• Keep documentation current to reflect

Documentation the true system’s design

Application Software Security
 Processes for software development:
• System Life Cycle (SLC)
• System Development Life Cycle (SDLC)
 Steps are similar; a few key differences:
• SLC includes operations and disposal
• SDLC ends with the transition to production

The System Life Cycle
Functional
Project initiation System design
requirements
and planning specification
and definition
Implementation
Build (develop) Acceptance
(transition to
and document testing
production)
Operations and
Disposal
maintenance

Testing Application Software
 Test for all expected and unexpected actions
 Handle errors correctly
 Perform tests to test the maximum load on the
system, including:
• Transaction volume
• Memory allocation
• Network bandwidth
• Response times
 Keep production or sensitive data secure during
testing
Catching Vulnerabilities
 Thoroughly evaluate any change to your
environment
 Formalize the process for procuring new
equipment
 Follow the guidance in your data policies
 Review a system throughout its life cycle to
ensure that it meets its specified security
(certification)
 Make sure management officially accepts the
system (accreditation)
Software Development and Security
 Checks user authentication to the application
 Checks user authorization (privilege level)
 Has procedures for recovering database integrity in the
event of system failure
 Handles errors and exceptions consistently and does not
allow any error or exception to go unhandled
 Validates all input
 Defines secure configuration baselines
 Provides guidance on hardening your application
 Provides and applies frequent patches

Software Development Models
The two most widely accepted models

for software development
Agile
The waterfall
development
model
method

The Waterfall Model

The Agile Software Development
Method

Summary
 Role of security administration within an
organization
 Components of an IT security policy
infrastructure
 Data classification standards used by
organizations and the DoD
 Change management and configuration
management
 The system life cycle (SLC) and the system
development life cycle (SDLC)


Fundamentals of Information Systems Security: Lesson 6 Security Operations and Administration

Caricato da

Informazioni sul documento

Titolo originale

Copyright

Formati disponibili

Condividi questo documento

Condividi o incorpora il documento

Opzioni di condivisione

Hai trovato utile questo documento?

Questo contenuto è inappropriato?

Copyright:

Formati disponibili

Fundamentals of Information Systems Security: Lesson 6 Security Operations and Administration

Caricato da

Copyright:

Formati disponibili

Fundamentals of Information

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

• Sensitive assets list

An organization must comply with rules on two levels:

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Blanket purchase agreement (BPA)

Memorandum of understanding (MOU)

Interconnection security agreement (ISA)

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Mandatory Security Security

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Ensure changes are:

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

• Ensure that a peer or another expert

• Ensure that if the change doesn’t work

• Keep documentation current to reflect

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

The two most widely accepted models

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

© 2018 Jones and Bartlett Learning, LLC, an Ascend Learning Company

Potrebbero piacerti anche