Information Technology Security Handbook
Total Page:16
File Type:pdf, Size:1020Kb
IT-SECURITY INFORMATION TECHNOLOGY SECURITY HANDBOOK by George Sadowsky James X. Dempsey Alan Greenberg Barbara J. Mack Alan Schwartz © 2003 The International Bank for Reconstruction and Development / The World Bank 1818 H Street, NW Washington, DC 20433 Telephone 202-473-1000 Internet www.worldbank.org E-mail [email protected] All rights reserved. The findings, interpretations, and conclusions expressed herein are those of the author(s) and do not necessarily reflect the views of the Board of Executive Directors of the World Bank or the governments they represent. The World Bank does not guarantee the accuracy of the data included in this work. The boundaries, colors, denominations, and other information shown on any map in this work do not imply any judgment on the part of the World Bank concerning the legal status of any territory or the endorsement or acceptance of such boundaries. This Handbook is distributed on the understanding that if legal or other expert assistance is required in any particular case, readers should not rely on statements made in this Handbook, but should seek the services of a competent professional. Neither the authors, nor the reviewers or The World Bank Group accepts responsibility for the consequences of actions taken by readers who do not seek necessary advice from competent professionals, on legal or other matters that require expert advice. Rights and Permissions The material in this work is copyrighted. Copying and/or transmitting portions or all of this work without permission may be a violation of applicable law. The World Bank encourages dissemination of its work and will normally grant permission promptly. Portions of this publication have been extracted, with permission of the publisher, from Simson Garfinkel, Gene Spafford, and Alan Schwartz, Practical Unix and Internet Security, 3rd edition, © O'Reilly & Associates, Inc., February 2003, and Simson Garfinkel and Gene Spafford, Web Security, Privacy and Commerce, 2nd edition, © O'Reilly & Associates, Inc., January 2002. For permission to photocopy or reprint any part of this work, please send a request with complete information to the Copyright Clearance Center, Inc., 222 Rosewood Drive, Danvers, MA 01923, USA, telephone 978-750-8400, fax 978-750-4470, www.copyright.com. All other queries on rights and licenses, including subsidiary rights, should be addressed to the Office of the Publisher, World Bank, 1818 H Street NW, Washington, DC 20433, USA, fax 202-522-2422, e-mail [email protected]. Design: Studio Grafik, Herndon, VA GLOBAL INFORMATION AND COMMUNICATION TECHNOLOGIES DEPARTMENT THE WORLD BANK 1818 H STREET · NW WASHINGTON · DC 20433 USA telephone 202.458.5153 facsimile 202.522.3186 email [email protected] website infodev.org ISBN 0-9747888-0-5 INFORMATION FOR DEVELOPMENT PROGRAM A CRONYMS ICT Information and Communication Technology OECD DAC Organization for Economic Cooperation and Development's Development Assistance Committee MDGs Millennium Development Goals NGO Non–Government-Organization WSIS World Summit on the Information Society DotForce Digital Opportunity Task Force of the G8 states. G8 Major industrial democracies have been meeting annually since 1975 to deal with the major economic and political issues facing their domestic societies and the international community as a whole. These states – the G8 – contain France, USA, Germany, Japan, Italy, Great Britain, Canada and – since the Birmingham Summit in 1998 - Russia. UN ICT Task Force United Nations Information and Communication Technology Task Force PDA Personal Digital Assistant SME’s Small and Medium Enterprises HIPC Highly Indebted Poor Countries FDI Foreign Direct Investment OECD Organization for Economic Cooperation and Development DFID Department for International Development ITDG Intermediate Technologies Development Group VoIP Voice-over-Internet-Protocol Information Technology Security Handbook iii CONTENTS 1 PREFACE 125 CHAPTER 9. COMPUTER CRIME 130 CHAPTER 10. MOBILE RISK MANAGEMENT 7 EXECUTIVE SUMMARY 139 CHAPTER 11. BEST PRACTICES: BUILDING SECURITY CULTURE 144 CHAPTER 12. GENERAL RULES FOR 13 PART 1. INTRODUCTION COMPUTER USERS 14 CHAPTER 1. IT SECURITY IN THE DIGITAL AGE 150 CHAPTER 13. GLOBAL DIALOGUES ON SECURITY 29 PART 2. SECURITY FOR INDIVIDUALS 163 PART 4. INFORMATION SECURITY AND 30 CHAPTER 1. INTRODUCTION TO SECURITY GOVERNMENT POLICIES FOR INDIVIDUALS 164 CHAPTER 1. INTRODUCTION 31 CHAPTER 2. UNDERSTANDING AND 167 CHAPTER 2. PROTECTING GOVERNMENT SYSTEMS ADDRESSING SECURITY 174 CHAPTER 3. THE ROLE OF LAW AND GOVERNMENT 35 CHAPTER 3. KEEPING YOUR COMPUTER POLICY VIS A VIS THE PRIVATE SECTOR AND DATA SECURE 176 CHAPTER 4. GOVERNMENT 43 CHAPTER 4. KEEPING YOUR CYBER-SECURITY POLICIES OPERATING SYSTEM AND APPLICATION SOFTWARE SECURE 47 CHAPTER 5. MALICIOUS SOFTWARE 189 PART 5. IT SECURITY FOR 53 CHAPTER 6. SECURING SERVICES OVER NETWORKS TECHNICAL ADMINISTRATORS 63 CHAPTER 7. TOOLS TO ENHANCE SECURITY 190 CHAPTER 1. BACKGROUND 68 CHAPTER 8. PLATFORM SPECIFIC ISSUES 196 CHAPTER 2. SECURITY FOR ADMINISTRATORS 73 ADDENDUM 1. INTRODUCTION TO ENCODING 209 CHAPTER 3. PHYSICAL SECURITY AND ENCRYPTION 220 CHAPTER 4. INFORMATION SECURITY 77 ADDENDUM 2. TCP/IP 238 CHAPTER 5. IDENTIFICATION AND AUTHENTICATION 79 ADDENDUM 3. MINI-GLOSSARY OF TECHNICAL TERMS 266 CHAPTER 6. SERVER SECURITY 288 CHAPTER 7. NETWORK SECURITY 314 CHAPTER 8. ATTACKS AND DEFENSES 81 PART 3. SECURITY FOR ORGANIZATIONS 326 CHAPTER 9. DETECTING AND MANAGING A BREAK-IN 82 CHAPTER 1. INTRODUCTION 341 CHAPTER 10. SYSTEM-SPECIFIC GUIDELINES 86 CHAPTER 2. OVERVIEW OF E-SECURITY RISK MITIGATION 94 CHAPTER 3. RISK EVALUATION AND LOSS ANALYSIS 351 ANNEXES 101 CHAPTER 4. PLANNING YOUR SECURITY NEEDS 352 ANNEX 1. GLOSSARY 105 CHAPTER 5. ORGANIZATIONAL SECURITY POLICY 362 ANNEX 2. BIBLIOGRAPHY AND PREVENTION 371 ANNEX 3. ELECTRONIC RESOURCES 112 CHAPTER 6. PERSONNEL SECURITY 378 ANNEX 4. SECURITY ORGANIZATIONS 117 CHAPTER 7. SECURITY OUTSOURCING 384 ANNEX 5. PRINT RESOURCES 122 CHAPTER 8. PRIVACY POLICIES LEGISLATION, AND GOVERNMENT REGULATION Information Technology Security Handbook v FORWARD he Preparation of this book was fully funded by a grant from the infoDev Program of the World Bank Group. The topic of Information Technology (IT) security has been growing in importance in the last few years, and Twell recognized by infoDev Technical Advisory Panel. We would like to thank the State Secretariat of Economic Affairs of Switzerland (SECO) for having been instrumental not only in providing the funding for this project, but also in recognizing the urgency of the matter and allowing this book to come to fruition. We recognize the fundamental role of Informational and Communication Technologies (ICT) for social and economic development. Similarly, we recognize that there cannot be an effective use of ICT in the absence of a safe and trusted ICT environment. Thus, IT security plays a prime role in helping creating the environment needed to set the ground for implementing successful national ICT plans, e-Government or e-Commerce activities, as well as sectoral projects, such as, for example, in the areas of education, health, or finance. IT security is a complex topic and evolves almost as fast as technology does. The authors have succeeded in providing technology-independent best practices, as well as recommendations for particular IT environments. As technology evolves, the accompanying web site (www.infodev-security.net) will provide updates as appropriate, allowing for a constant dissemination of developments in the field of IT security. While the opinions and recommen- dations made in this book do not necessarily reflect the views of infoDev or The World Bank Group, we believe that the combination of the book and its supporting web site will make a valuable contribution to the understanding of IT security around the globe. The book is composed of five parts, each of which can be read independently. After an introduction to general issues of IT security, the book addresses issues relevant specifically to individuals, small and medium organizations, government, and technical administrators. Although most of the research and publications on IT security comes from developed countries, the authors have attempted to provide practical guidance applicable anywhere and to include examples from developing countries. We hope that this book and its supporting web site will provide the beginning of an interactive process, where the content and best practices will evolve overtime as technology advances, but more importantly, as readers will share their experiences and best practices with their peers. Mohsen A. Khalil Director, Global Information and Communication Technologies Department The World Bank Group Bruno Lanvin Program Manager, infoDev Program The World Bank Group Michel H. Maechler InfoDev Task Manager Senior Informatics Specialist The World Bank Group vi Walter Duss Bertrand Livinec, CISA Review Vice President, Practice Lead Sub-Saharan swiss interactive media and Francophone Africa Region Committee software association (simsa) Group Risk Management Solutions Managing Director, (GRMS) Members ASP Konsortium Switzerland PriceWaterhouseCoopers Wilen, Switzerland Paris, France Information Technology Kurt Haering Michel Maechler, CISA, CISM Security Handbook President Senior Informatics Specialist EFSI AG Global Information and Basel, Switzerland Communications Technology, Policy (Formerly President of Division Infosurance, Zürich, The World Bank Switzerland) Washington, DC, USA Thomas