andrew kozma - security 101 - atlseccon2011
Post on 07-Feb-2017
125 Views
Preview:
TRANSCRIPT
Security 101Principles Models & Concepts
Andrew Kozma
Sr. Security Administrator
Capital District Health Authority
Defense In Depth
• Originally a military model used to slow the progress of an attacker
• The building up, layering on and overlapping of security measures
• Should one defensive measure fail there are other defensive measures
in place that continue to provide protection
• The strength of any system is no greater than its weakest link
Figure. 1
The OSI Model – Open Systems Interconnect
• An industry standard model
• Defines the framework for
implementing protocols into seven
layers
•A hierarchal model where the layer
below supports the layer above it
• Security services can be added to
individual layers to support the
defense in depth principle
Figure. 2
The Physical Layer
• Classify your data
• If it is important lock it up!
• Servers that house sensitive data should be behind a locked door with
controlled access
• If an attacker has physical access they own it…. period
Data Link Layer
• Media Access Control (MAC Address)
• ARP – Address Resolution Protocol
• Threat = ARP Poisoning
• MAC Flooding – Targets switching infrastructure
• Man In the Middle – Intercept traffic destined for another host
• DOS – Direct traffic to “Nowhere”
• Mitigation = Network Access Control (NAC)
The Network Layer
• Provides routing services and is the home to routable protocols (IP)
• ICMP – Evaluate the requirements, manage this at select gateways as
required.
• Enumeration – OS Detection, port scanning, sniffing
• Traditional firewalls
• Intrusion Detection Services
• Intrusion Prevention Services
Securing the Host Layers
The landscape is changing, users are now more mobile and portable than
ever before.
• Endpoint protection
• Anti Virus
• Client Side Firewalls with IPS
• Encryption Services
• Software updates
• Microsoft WSUS
• Application updates, flash player
• The model of trusted and untrusted networks is blurring.
The Human Factor
• The user community historically is the weakest link
• Raising awareness - Educate your user community, build the “Human
Firewall”
• Incident response - Know what to do when something goes wrong
• Who needs to know
• When do they need to know it
The Importance Of Logging
• At a minimum enable logging. If there are too many consider event log
correlation and management solutions
• Historical data will be required for forensic analysis in the event of a data
breach or a disruption in service
• Maybe required to provide information to law enforcement
• If you don‟t know what happened how can you prevent it from happening
again?
The Security Life Cycle
• Security is not just at the perimeter
• Security is a process not a product
Aligning Security With The Business
Balance security with cost
• Risk analysis
• Project Management
Compliancy and policy
• SOX
• HIPPA
• PHIA
• PIPEDA
Lessons Learned
• Have to be right all of the time, the bad guys only needs to be right once
• Multiple vendor solutions can be complex and can increase
administration requirements
• Defense in depth is not a security blanket, be careful not to buy the
latest and greatest technology for multiple layers
• Multiple management domains, not necessarily a single pane of glass
• Select a few solutions but know them well
• Meet with vendors often to review implementation and services
Lessons Learned
• Good enough is not good enough anymore
• Stay current
• Training, instructor led, online, webcasts *(EC Council first look)
• research new technologies
• read vendor reports
• Meet with vendors
• Share your knowledge, mentor and be mentored
• Attend ATLSECCON „12
Summary
• Align security with business
• Develop policy
• Maintain compliance
• Strive for Continuous improvement
• Manage - Security is a process not a product
• Measure - Vulnerability assessments
Summary
• Monitor – Baseline and know the behavior of your environment
• Alert - Notify on changes and anomalies
• Log & Report - Know your security posture, audit and prove compliance
top related