security planning and policyWord格式文档下载.docx

security planning and policyWord格式文档下载.docx

《security planning and policyWord格式文档下载.docx》由会员分享，可在线阅读，更多相关《security planning and policyWord格式文档下载.docx（14页珍藏版）》请在冰豆网上搜索。

Mostsecurityincidentsoccurbecausesystemadministratorsdonotimplementavailablecountermeasures,andhackersordisgruntledemployeesexploittheoversight.Therefore,theissueisnotjustoneofconfirmingthatatechnicalvulnerabilityexistsandfindingacountermeasurethatworks,itisalsocriticaltoverifythatthecountermeasureisinplaceandworkingproperly.ThisiswheretheSecurityWheel,acontinuousprocess,isaneffectiveapproach.

TheSecurityWheelpromotesretestingandreapplyingupdatedsecuritymeasuresonacontinuousbasis.

TobegintheSecurityWheelprocess,firstdevelopasecuritypolicythatenablestheapplicationofsecuritymeasures.Asecuritypolicyneedstoaccomplishthefollowingtasks:

∙Identifythesecurityobjectivesoftheorganization.

∙Documenttheresourcestobeprotected.

∙Identifythenetworkinfrastructurewithcurrentmapsandinventories.

∙Identifythecriticalresourcesthatneedtobeprotected,suchasresearchanddevelopment,finance,andhumanresources.Thisiscalledariskanalysis.

Afterthesecuritypolicyisdeveloped,makeitthehubuponwhichthefourstepsoftheSecurityWheelarebased.Thestepsaresecure,monitor,test,andimprove.

Secure

Securethenetworkbyapplyingthesecuritypolicyandimplementingthefollowingsecuritysolutions:

∙ThreatDefense

oStatefulInspectionandpacketfiltering–Filternetworktraffictoallowonlyvalidtrafficandservices.

oIntrusionPreventionSystems–Inlineintrusiondetectionsystems（IDS）,whichisbettertermedintrusionpreventionsystems（IPS）,canbedeployedatthenetworkandhostleveltoactivelystopmalicioustraffic.

oVulnerabilitypatching–Applyfixesormeasurestostoptheexploitationofknownvulnerabilities.Thisincludesturningoffservicesthatarenotneededoneverysystem.Thefewerservicesthatareenabled,theharderitisforhackerstogainaccess.

∙SecureConnectivity

oVirtualPrivateNetworks（VPNs）–Hidetrafficcontenttopreventunwanteddisclosuretounauthorizedormaliciousindividuals.

∙TrustandIdentity

oAuthentication–Giveaccesstoauthorizedusersonly.Oneexampleofthisisusingone-timepasswords.

oPolicyenforcement–Assureusersandenddevicesareincompliancewiththecorporatepolicy.

Monitor

Monitoringsecurityinvolvesbothactiveandpassivemethodsofdetectingsecurityviolations.Themostcommonlyusedactivemethodistoaudithost-levellogfiles.Mostoperatingsystemsincludeauditingfunctionality.Systemadministratorsforeveryhostonthenetworkmustturntheseonandtakethetimetocheckandinterpretthelogfileentries.

Passivemethodsincludeusingintrusiondetectionsystem（IDS）devicestoautomaticallydetectintrusion.Thismethodrequiresonlyasmallnumberofnetworksecurityadministratorsformonitoring.Thesesystemscandetectsecurityviolationsinrealtimeandcanbeconfiguredtoautomaticallyrespondbeforeanintruderdoesanydamage.

AnaddedbenefitofnetworkmonitoringistheverificationthatthesecuritydevicesimplementedinStep1oftheSecurityWheelhavebeenconfiguredandareworkingproperly.

Test

InthetestingphaseoftheSecurityWheel,thesecurityofthenetworkisproactivelytested.Specifically,thefunctionalityofthesecuritysolutionsimplementedinStep1andthesystemauditingandintrusiondetectionmethodsimplementedinStep2mustbeassured.VulnerabilityassessmenttoolssuchasSATAN,Nessus,orNMAPareusefulforperiodicallytestingthenetworksecuritymeasuresatthenetworkandhostlevel.

Improve

TheimprovementphaseoftheSecurityWheelinvolvesanalyzingthedatacollectedduringthemonitoringandtestingphases,anddevelopingandimplementingimprovementmechanismsthatfeedintothesecuritypolicyandthesecuringphaseinStep1.Tokeepanetworkassecureaspossible,thecycleoftheSecurityWheelmustbecontinuallyrepeated,becausenewnetworkvulnerabilitiesandrisksarecreatedeveryday.

Withtheinformationcollectedfromthemonitoringandtestingphases,intrusiondetectionsystemscanbeusedtoimplementimprovementstothesecurity.Thesecuritypolicyshouldbeadjustedasnewsecurityvulnerabilitiesandrisksarediscovered

Networksecuritypolicy

Securitypoliciesareworththetimeandeffortneededtodevelopthem.Asecuritypolicybenefitsacompanyinthefollowingway:

∙Itprovidesaprocesstoauditexistingnetworksecurity.

∙Itprovidesageneralsecurityframeworkforimplementingnetworksecurity.

∙Itdefineswhichbehaviorisandisnotallowed.

∙Itoftenhelpsdeterminewhichtoolsandproceduresareneededfortheorganization.

∙Ithelpscommunicateconsensusamongagroupofkeydecisionmakersanddefinestheresponsibilitiesofusersandadministrators.

∙Itdefinesaprocessforhandlingnetworksecurityincidents.

∙Itenablesglobalsecurityimplementationandenforcement.

∙Itcreatesabasisforlegalactionifnecessary.

Computersecurityisnowanenterprise-wideissueandcomputingsitesareexpectedtoconformtothenetworksecuritypolicy.

DevelopingaSecurityPolicy

AsecuritypolicycanbeassimpleasabriefAcceptableUsePolicyfornetworkresources,orcanbeseveralhundredpageslonganddetaileveryelementofconnectivityandassociatedpolicies.Althoughsomewhatnarrowinscope,RFC2196suitablydefinesasecuritypolicyasfollows:

"

Asecuritypolicyisaformalstatementoftherulesbywhichpeoplewhoaregivenaccesstoanorganization'

stechnologyandinformationassetsmustabide."

Itisimportanttounderstandthatnetworksecurityisanevolutionaryprocess.Nosingleproductcanmakeanorganizationsecure.Truenetworksecuritycomesfromacombinationofproductsandservices,combinedwithacomprehensivesecuritypolicyandacommitmenttoadheretothatpolicyfromthetopoftheorganizationdown.Infact,aproperlyimplementedsecuritypolicywithoutdedicatedsecurityhardwarecanbemoreeffectiveatmitigatingthethreattoenterpriseresourcesthanacomprehensivesecurityproductimplementationwithoutanassociatedpolicy.

Inorderforasecuritypolicytobeappropriateandeffective,itneedstohavetheacceptanceandsupportofalllevelsofemployeeswithintheorganization,includingthefollowing:

∙Sitesecurityadministrator.

∙Informationtechnologytechnicalstaff,suchasstafffromthecomputingcenter.

∙Administratorsoflargeusergroupswithintheorganization,suchasbusinessdivisionsoracomputersciencedepartmentwithinauniversity.

∙Securityincidentresponseteam.

∙Representativesoftheusergroupsaffectedbythesecuritypolicy.

∙Responsiblemanagement.

∙Legalcounsel,ifneeded.

Itisextremelyimportantthatmanagementfullysupportthesecuritypolicyprocess.Otherwise,thereislittlechancethattheprocesswillhavetheintendedimpact.

Aneffectivesecuritypolicyworkstoensurethatthenetworkassetsoftheorganizationareprotectedfromsabotageandfrominappropriateaccess,bothintentionalandaccidental.Allnetworksecurityfeaturesshouldbeconfiguredincompliancewiththeorganization'

ssecuritypolicy.Ifasecuritypolicyisnotpresent,orifthepolicyisoutofdate,thepolicyshouldbecreatedorupdatedbeforedecidinghowtoconfiguresecurityonanydevices.

Figureillustratesthetraitsthatanysecuritypolicyshouldinclude.

DevelopingSecurityProcedures

Securityproceduresimplementsecuritypolicies.Proceduresdefineconfiguration,login,audit,andmaintenanceprocesses.Securityproceduresshouldbewrittenforendusers,networkadministrators,andsecurityadministrators.Securityproceduresshouldspecifyhowtohandleincidents.Theseproceduresshouldindicatewhattodoandwhotocontactifanintrusionisdetected.

Hostandserverbasedsecuritycomponentsandtechnologies

Itiscriticaltoprotectnetworkhosts,suchworkstationPCsandservers.Thesehostsneedtobesecuredastheyareaddedtothenetworkandupdatedwithsecuritypatchesastheybecomeavailable.Additionalstepscanbetakentosecurethesehosts.Anti-virus,firewall,andintrusiondetectionarevaluabletoolsthatcanbeusedtosecurenetworkhosts.Becausemanybusinessresourcesmaybecontainedonasinglefileserver,itisespeciallyimportantforserverstobeaccessibleandavailable.

DeviceHardening

Whenanewoperatingsystemisinstalledonacomputer,thesecuritysettingsareallsettothedefaultvalues.Inmostcasesthislevelofsecurityisinadequate.Therearesomesimplestepsthatshouldbetakenth