Reduce Security Compliance Costs Using Open Source
Total Page:16
File Type:pdf, Size:1020Kb
BLUE KAIZEN CENTER OF IT SECURITY Cairo Security Camp 2010 Reduce Security Compliance Costs Using Open Source Subject : This document gives the user an introduction to Information Security Compliance, Why Comply ?, Compliance Costs, Open Source Definition, Why Consider Open Source ?, Open Source Software useful for Security Compliance, Open Source References and Case Study, Facing Open Source Challenges and Open Source Software Selection Criteria. Author : Mostafa Ibrahim Version : 1.0 Date : July, 2010 Nb pages : 53 Reduce Security Compliance Costs Using Open Source Mostafa Ibrahim Security Meter CTO CISA, ISO 27001 LA, RHCE [email protected] AGENDA 1 Information Security Compliance 2 Why Comply ? 3 Compliance Costs 4 Open Source Definition 5 Why Consider Open Source ? 6 Open Source Software useful for Security Compliance 3 AGENDA 7 Open Source References and Case Study 8 Facing Open Source Challenges 9 Open Source Software Selection Criteria 10 Conclusion 4 AGENDA 1 Information Security Compliance 5 Information Security Compliance • Forcing companies to put their infrastructure in order • In many cases face stiff penalties if dead line are not met • Prescribe Policies and Procedures that > Cover minimum standards for use of IT equipment, > Cover definitions of misuse > Cover rules for enforcing the standards that have been set. > Protect the company's IT equipment, data, and other assets. > Include security and other business policies 6 Standards vs Regulations • Standards: – Issued by national or international bodies e.g. BSI, ISO. – Codes of practice (e.g. ISO 27001, ISO 9001, ISO 20000) – Sanctions: none • Regulations: – Issued by government agencies, markets or sectoral bodies – Gov. Agencies e.g. FISMA for U.S. federal government agency Markets Sectorals e.g. Basel II for Banks, HIPAA for Health Care / Insurance, PCI-DSS for Payment Card Industry, SOX for American Public Companies. – Sanctions: fines, loss of ability to do business 7 AGENDA 2 Why Comply ? 8 Why Comply ? • Helps management: “You can’t manage what you can’t measure” • Enables benchmarking internally and with others • Builds trust with partners and customers • Enables trend analysis: “Are things getting better or worse?” • Audits usually increases visibility on business processes and IT infrastructure • Avoid losing business because of being non compliant • Avoid being penalized for Noncompliance 9 Why Comply ? • TJX Scandal – One of the biggest retailers dealing with more than 60 banks – Considered to be the largest data breach ever. – At least 94 million Visa and MasterCard accounts may have been exposed – The company reported a spend of $202 million in response to the breach – Wireless Security Issue in one of its remote branches • Heartland Data Breach – One of the largest processors of credit and debit card transactions in the U.S – Estimates of more than 100 million accounts may have been exposed – Planting a malware capable of sniffing out payment card data as it moved across the company's network, and then to have spirited it out of Heartland's systems in encrypted data streams. 10 Path to Compliance… 1. Determine the scope precisely (In terms of assets and business processes) 2. Reduce scope by segmenting the network 3. Baseline your environment against the standard to identify gaps. 4. For all gaps determine remediation actions with associated effort. 5. Develop a prioritized plan to address gaps. 6. Execute (…but with management support). 11 AGENDA 3 Compliance Costs 12 Cost of Compliance U.S. public companies are spending $4.36 million each, on average, to comply with Section 404 of Sarbanes- Oxley (March 2005 survey conducted by Financial Executives International). Entities are typically spending between at $2 and $8 million each to comply with PCI-DSS. (From our experience in the region) Security Compliance is very expensive 13 AGENDA 4 Open Source Definition 14 Open Source Definition What exactly Open Source Software ? Open Source is about granting users the freedom to run, copy, distribute, study, change and improve the software. OSS is any software that provided the following freedoms. The freedom to: . Run the program, for any purpose (freedom 0) . Study how the program works, and adapt it to your needs (freedom 1). Redistribute copies so you can help your neighbor (freedom 2) . Improve the program, and release your improvements to the public, so that the whole community benefits (freedom 3). The OSS makes sure that software and their derivative works stay free through adequate license obligations. 15 Open Source vs. Other Types • Closed Source • The source is private and owned by someone. Usually you’d have to pay for the source code if its even for sale. • Freeware • Free software. It has nothing to do with the source code being available or not. • Source Available • The source is available to look at, but not modify or distribute. Allows users to understand how the software is working. 16 AGENDA 5 Why Consider Open Source ? 17 Why Consider Open Source ? Avoid Vendor Lock In Open Source allows for many people to find and fix security or efficiency problems Ease of Customization Deep Understanding for underlying Technology Lower TCO (No License Cost) 18 AGENDA 6 Open Source Software useful for Security Compliance 19 Open Source Software Useful for Security Compliance • Firewall • Network IDS / IPS • File Integrity Monitoring / HIDS • Web Application Firewall • Log Management • Encryption (at Rest, Motion) • Change Management • Vulnerability Scanning • Penetration Testing • Business Continuity • Alerting System • Configuration Management Database • Monitoring 20 Firewall • PCI-DSS Requirement 1: Install and maintain a firewall configuration to protect cardholder data • ISO 27k A 10.6.1 Networks shall be adequately managed and controlled, in order to be protected from threats, and to maintain security for the systems and applications using the network, including information in transit. 21 Open Source Firewalls • Netfilter / Iptables http://www.netfilter.org • Endian Firewall http://www.endian.com ClearOS http://www.clearfoundation.com/ Zeroshell http://www.zeroshell.net 22 IDS / IPS • PCI-DSS Requirement 11.4 Use intrusion-detection systems, and/or intrusion-prevention systems to monitor all traffic • ISO 27k A 10.6.1 Networks shall be adequately managed and controlled, in order to be protected from threats, and to maintain security for the systems and applications using the network, including information in transit. 23 Open Source IDS / IPS Snort Snort has become the de facto standard for IPS http://www.snort.org Base Basic Analysis and Search Engine http://base.secureideas.net Web Interface for Snort providing a reporting, analysis capabilities to Snort Sguil http://sguil.sourceforge.net intuitive GUI that provides access to realtime events, session data, and raw packet capture 24 HIDS / File Integrity Monitoring • PCI-DSS Requirement 11.5 Deploy file-integrity monitoring software to alert personnel to unauthorized modification of critical system files, configuration files, or content files; and configure the software to perform critical file comparisons at least weekly. • ISO 27k A.10.4 Protection against malicious and mobile code Objective: To protect the integrity of software and information. 25 Open Source HIDS / File Integrity Monitoring • OSSEC Runs on almost all popular OS Linux, MacOS, Solaris, HP-UX, AIX and Windows. Has its own web interface http://www.ossec.net Samhain Beltane is an intuitive Web Interface for Samhain http://www.la-samhna.de/ Osiris http://osiris.shmoo.com/ 26 Web Application Firewall • PCI-DSS Requirement 6.6 For public-facing web applications, address new threats and vulnerabilities on an ongoing basis and ensure these applications are protected against known attacks by Installing a web-application firewall in front of public-facing web applications 27 Open Source Web Application Firewall • ModSecurity The most widely used Web Application Firewall Over 10,000 deployment http://www.modsecurity.org 28 Log Management • PCI-DSS Requirement 10.2 Implement automated audit trails for all system components. 10.5.5 Use file-integrity monitoring or change-detection software on logs to ensure that existing log data cannot be changed without generating alerts • ISO 27k A.10.10.1 Audit logging security events shall be produced and kept for an agreed period to assist in future investigations and access control monitoring. A.10.10.3 Protection of log information Logging facilities and log information shall be protected against tampering and unauthorized access. 29 Open Source Log Management Solutions • Syslog-NG http://sourceforge.net/projects/syslog-ng/ Php-syslog-ng Web Interface for Syslog-NG http://sourceforge.net/projects/php-syslog-ng Snare Collecting windows logs and send them as a syslog messages http://www.intersectalliance.com OSSIM Open Source Security Information Management. Much more than a basic log Management Solution http://www.alienvault.com 30 Encryption • PCI-DSS 3.4 Render PAN, at minimum, unreadable anywhere it is stored 4.1 Use strong cryptography and security protocols such as SSL/TLS or IPSEC to safeguard sensitive cardholder data during transmission over open, public networks. • ISO 27k A.12.3 Cryptographic controls Objective: To protect the confidentiality, authenticity or integrity of information by cryptographic means. 31 Open Source Encryption Solutions • TrueCrypt Disk Encryption Windows 7/Vista/XP, Mac OS