Defence in Depth
Total Page:16
File Type:pdf, Size:1020Kb
DEFENCE IN DEPTH Defence in depth June 2008 DISCLAIMER: To the extent permitted by law, this document is provided without any liability or warranty. Accordingly it is to be used only for the purposes specified and the reliability of any assessment or evaluation arising from it are matters for the independent judgment of users. This document is intended as a general guide only and users should seek professional advice as to their specific risks and needs. This information is not legal advice and should not be relied upon as legal advice. DEFENCE IN DEPTH FOREWORD In today’s business environment, controlling access to information is critical to long-term competitive advantage. Alongside significant benefits, every new technology introduces new challenges for the protection of this information. As a result, it is vital for owners and operators of critical infrastructure to develop appropriate strategies for mapping and understanding the layers of information that need to be protected. This report has been developed by the IT Security Expert Advisory Group (ITSEAG) which is part of the Trusted Information Sharing Network (TISN) 1 for critical infrastructure protection. TISN has previously released a number of papers to assist CEOs and CIOs in understanding IT security threats and strategic approaches to securing their IT infrastructure. Issues covered in these documents range from managing denial of service risks to information security strategy and governance. These papers are available at: www.tisn.gov.au. This paper is closely related to the Secure Your Information report of June 2007, which was developed to provide strategic guidance for the implementation of information security through seven core principles. The principles reflect the holistic approach required for the management of information security, by consideration for organisational mission, risk factors, internal and external stakeholders and continual improvement. This paper seeks to develop a practical approach for developing enterprise information security through a layered defence in depth approach with particular reference to the principles and recommendations contained in the Secure Your Information report. SIFT (www.sift.com.au) engaged in discussions with members of the ITSEAG and other relevant bodies including key stakeholders from the IT and information security sectors and owners and operators of critical infrastructure to gain an individual industry perspective on the issues. SIFT thanks all participants for their contributions to the project. 1 TISN enables the owners and operators of critical infrastructure to share information on important issues. It is made up of nine sector-specific Infrastructure Assurance Advisory Groups (IAAG), several Expert Advisory Groups (EAG), and the Critical Infrastructure Advisory Council (CIAC - which is the peak body of TISN and oversees the IAAGs and the EAGs). More information on TISN can be sought from www.tisn.gov.au or by contacting [email protected]. The ITSEAG is one of the expert advisory groups within the TISN framework. The ITSEAG provides advice to the CIAC and the sector-based IAAGs on IT security issues as they relate to critical infrastructure protection. It is made up of academic specialists, vendors, consultants and some industry association representatives who are leaders in the information technology/e-security field. The ITSEAG Secretariat can be contacted on (02) 6271 7018. DEFENCE IN DEPTH Contents Foreword..................................................................................................................................... 2 Figures...................................................................................................................................... 4 Tables....................................................................................................................................... 5 Focus area summaries.............................................................................................................. 5 Executive summary.................................................................................................................... 6 Overview ........................................................................................Error! Bookmark not defined. Critical infrastructure............................................................................................................... 9 The defence in depth concept ................................................................................................ 10 Establish context ...................................................................................................................... 11 Enterprise strategy ................................................................................................................. 13 Internal environment.............................................................................................................. 14 Governance ........................................................................................................................ 16 People................................................................................................................................. 16 Process ............................................................................................................................... 17 Technology ........................................................................................................................ 19 Threat environment................................................................................................................ 21 Adversaries and motivations.............................................................................................. 21 Risk analysis ............................................................................................................................. 23 Risk profiling ......................................................................................................................... 23 Risks, threats and vulnerabilities ........................................................................................... 23 Risk Analysis methodology ................................................................................................... 24 Identify risk........................................................................................................................ 25 Analyse risk ....................................................................................................................... 28 Evaluate risk....................................................................................................................... 31 Key success factors............................................................................................................ 32 Assessment methodologies and tools..................................................................................... 33 Assessing governance risks................................................................................................ 33 Assessing people risks ....................................................................................................... 35 Assessing process risks...................................................................................................... 38 Assessing technology risks ................................................................................................ 40 Implementing defence in depth............................................................................................... 44 Core principles....................................................................................................................... 45 Implement measures according to business risks .............................................................. 45 Implement controls using a layered approach ................................................................... 45 Controls should serve to increase the cost of an attack ..................................................... 46 Implement technical, procedural and operational controls................................................ 47 Implementing governance controls........................................................................................ 47 Accountability.................................................................................................................... 48 Policy and compliance management.................................................................................. 48 Control analysis ................................................................................................................. 49 Implementing people controls................................................................................................ 56 Job and role definition ....................................................................................................... 56 Recruitment and selection.................................................................................................. 57 Induction, training and development ................................................................................. 58 DEFENCE IN DEPTH Ongoing operations............................................................................................................ 59 Role change management .................................................................................................. 59 Managing morale ..............................................................................................................