osr/aug 02 data security e2002, lecture 1 august 30, 2002 000-015 history background - batch -...

102
OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria - Code of Practice - BS 7799, ISO 17799 - ISO TR 13335 - DS 484

Post on 21-Dec-2015

214 views

Category:

Documents


0 download

TRANSCRIPT

Page 1: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Data SecurityE2002, Lecture 1 August 30, 2002

000-015 History Background

- Batch

- Remote access, DB, RACF

- Orange Book

- ITSec, Common Criteria

- Code of Practice

- BS 7799, ISO 17799

- ISO TR 13335

- DS 484

Page 2: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 3: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 4: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 5: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 6: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 7: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 8: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 9: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 10: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 11: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 12: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 13: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 14: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 15: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 16: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 17: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 18: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 19: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 20: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 21: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 22: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 23: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 24: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 25: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

015-030 What is Information Security ?

Why do we need Information Security ? - Commercial Image

- Loss of Reputation, Trust, Confidence

Examples

Page 26: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 27: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 28: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 29: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

TrustTrust

Page 30: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 31: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 32: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 33: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 34: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 35: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

030-090 Security Requirements

- Risk Assessment

¤ Exercise: Five most serious threats

¤ KPMG Security Survey

¤ Traffic Light Analysis

¤ Risk Model

¤ Vulnerability Analysis

Threats – BSI List

- Legal Requirements

¤ FSR Vejl. 14 + 17

¤ SysTrust

- Good Practice

Page 36: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 37: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 38: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 39: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 40: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Exercise

Which are the five most serious IT-security threats to an

organization ?

Page 41: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 42: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 43: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 44: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 45: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 46: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 47: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 48: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 49: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 50: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 51: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 52: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 53: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 54: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 55: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 56: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 57: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 58: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 59: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 60: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 61: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 62: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 63: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 64: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 65: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 66: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 67: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 68: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 69: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 70: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 71: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 72: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 73: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 74: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 75: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 76: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 77: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 78: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 79: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Risk model

0

0,5

1

1,5

2

2,5

3

High Medium Low

LowMedium

High

LowMediumHigh

Vulnerability

Impact

Th

reat

Page 80: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Legal, statutory, regulatory and contractual requirements

Page 81: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 82: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 83: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 84: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 85: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 86: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 87: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 88: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Principles and objectives

VisionEthicalGood PracticeIT Security Policy

Page 89: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

090-105 Controls

- Preventive

- Detective

- Corrective

105-135 Critical Success Factors

- Examples

Page 90: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 91: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 92: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 93: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 94: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Trafiklysanalyse

Page 95: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 96: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 97: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 98: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 99: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 100: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 101: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02

Page 102: OSR/Aug 02 Data Security E2002, Lecture 1 August 30, 2002 000-015 History Background - Batch - Remote access, DB, RACF - Orange Book - ITSec, Common Criteria

OSR/Aug 02