DOCSLIB.ORG

Guide to Information Technology Security

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Guide to Information Technology Security Guide to Information Technology Security WMO-No. 1115 WMO-No. 1115 © World Meteorological Organization, 2016 The right of publication in print, electronic and any other form and in any language is reserved by WMO. Short extracts from WMO publications may be reproduced without authorization, provided that the complete source is clearly indicated. Editorial correspondence and requests to publish, reproduce or translate this publication in part or in whole should be addressed to: Chair, Publications Board World Meteorological Organization (WMO) 7 bis, avenue de la Paix Tel.: +41 (0) 22 730 84 03 P.O. Box 2300 Fax: +41 (0) 22 730 80 40 CH-1211 Geneva 2, Switzerland E-mail: [email protected] ISBN 978-92-63-11115-9 NOTE The designations employed in WMO publications and the presentation of material in this publication do not imply the expression of any opinion whatsoever on the part of the Secretariat of WMO concerning the legal status of any country, territory, city or area, or of its authorities, or concerning the delimitation of its frontiers or boundaries. Opinions expressed in WMO publications are those of the authors and do not necessarily reflect those of WMO. The mention of specific companies or products does not imply that they are endorsed or recommended by WMO in preference to others of a similar nature which are not mentioned or advertised. Revision History 2005-02-02 – ET-EUDCS, Draft version. 2006-07-19 – ET-CTS, First complete version. 2012-04-18 – ET-CTS, Second version with review of all text and addition of external references. 2016-04 – ET-CTS, Document review. CONTENTS 1 INTRODUCTION .................................................................................... Error! Bookmark not defined. 2 INFORMATION TECHNOLOGY SECURITY ...................................................................................... 8 2.1 Protecting systems against potential failures ............................................................................... 8 2.2 Malicious versus non-malicious activities ..................................................................................... 8 2.3 Establishing security criteria ........................................................................................................... 8 2.4 Security techniques and procedures to consider ........................................................................ 9 3 SECURITY THREATS ........................................................................................................................... 10 3.1 Reasons for threats ........................................................................................................................ 10 3.1.1 Obtain information or resources ............................................................................................... 10 3.1.2 Desire to cause harm ................................................................................................................. 10 3.1.3 Playful or exploration ............................................................................................................... 10 3.1.4 Accident .................................................................................................................................... 10 3.2 Common threats ............................................................................................................................. 10 3.2.1 Malicious codes: viruses, ransomware, worms and Trojans ..................................................... 10 3.2.2 Denial of service ....................................................................................................................... 11 3.2.3 Malicious hacking ..................................................................................................................... 11 3.2.4 Spying ....................................................................................................................................... 11 3.2.5 Compromising and abusing system resources .......................................................................... 11 3.3 Main attack methods ...................................................................................................................... 11 3.3.1 Hacking systems by finding security holes in systems ............................................................. 11 3.3.2 Denial-of-service attacks .......................................................................................................... 11 3.3.3 Malicious spam ......................................................................................................................... 12 3.3.4 Spying ....................................................................................................................................... 12 3.3.5 Root or domain controller access .............................................................................................. 12 3.3.6 Wireless Local Area Networks ................................................................................................. 12 4 IMPACTS OF THREATS AND SECURITY EVENTS ...................................................................... 14 4.1 System and service impacts ......................................................................................................... 14 4.2 Administrative, legal and reputation impacts ............................................................................. 15 5 INFORMATION TECHNOLOGY SECURITY PROCESS ............................................................... 16 5.1 Identify assets ................................................................................................................................. 16 5.2 Threats and risk assessment ....................................................................................................... 16 5.3 Business continuity planning ........................................................................................................ 16 5.4 Prevent ............................................................................................................................................. 16 5.5 Detect ............................................................................................................................................... 16 5.6 Respond and recover .................................................................................................................... 16 5.7 Investigate and correct .................................................................................................................. 17 6 BEST PRACTICES IN INFORMATION TECHNOLOGY SECURITY ........................................... 18 6.1 Information technology system security ..................................................................................... 18 6.2 Network architecture ...................................................................................................................... 19 6.2.1 Local Area Networks ................................................................................................................ 20 6.2.2 Wireless Local Area Networks ................................................................................................. 21 6.2.3 Firewall systems ........................................................................................................................ 21 6.3 Remote access ............................................................................................................................... 23 6.4 Server access and security ........................................................................................................... 23 6.4.1 File system authorization rules ................................................................................................. 25 6.5 Security policies .............................................................................................................................. 25 6.5.1 Requirement for a security policy ............................................................................................. 25 6.5.2 Developing a policy .................................................................................................................. 25 6.6 Threat and risk assessment ......................................................................................................... 26 6.7 Policy control ................................................................................................................................... 26 6.8 Procedures ...................................................................................................................................... 27 6.8.1 System management ................................................................................................................. 27 6.8.2 New system installation and change management .................................................................... 27 6.8.3 Installation of security patches .................................................................................................. 27 6.8.4 User account management ........................................................................................................ 27 6.8.5 Backup/restore procedures and regular testing ......................................................................... 28 6.8.6 Detection procedures ................................................................................................................ 28 6.8.7 Response/recovery procedures .................................................................................................
Load more

Recommended publications
  • NIST: Implementing Internet Firewall Security Policy
    Internet Firewall Policy DRAFT NIST Special Publication 800-XX IMPLEMENTING INTERNET FIREWALL SECURITY POLICY Barbara Guttman Robert Bagwill IMPLEMENTING INTERNET FIREWALL SECURITY POLICY Information Technology Laboratory Computer Security Division National Institute of Standards and Technology Gaithersburg, MD 20899-0001 April 13, 1998 U.S. Department of Commerce William M. Daley, Secretary Technology Administration Gary R. Bachula, Acting Under Secretary for Technology National Institute of Standards and Technology Raymond Kammer, Director 1 Internet Firewall Policy DRAFT 1 Background and Purpose ..............................................................................0 2 Overview ........................................................................................................0 3 Firewall Architectures ....................................................................................0 3.1 Multi-homed host ............................................................................................... 0 3.2 Screened host.................................................................................................... 0 3.3 Screened subnet................................................................................................ 0 4 Types of Firewalls..........................................................................................0 4.1 Packet Filtering Gateways ................................................................................. 0 4.2 Application Gateways .......................................................................................
    [Show full text]
  • Interim Agency Network Security Policy
    EPA Classification No.: CIO 2150.1 CIO Approval Date: 08/22/2011 CIO Transmittal No.: 11-0005 Review Date: 02/2013 Issued by the EPA Chief Information Officer, Pursuant to Delegation 1-19, dated 7/7/2005 Interim Agency Network Security Policy 1 PURPOSE This Policy – 1.1 establishes a security policy for the Environmental Protection Agency’s (EPA’s) national data communications network (EPA network). 1.2 establishes principles to ensure a secure network infrastructure that integrates confidentiality, availability, and integrity into the infrastructure design, implementation, and maintenance; in order to: 1.2.1 protect the Agency’s infrastructure and critical information assets from internal and external threats arising from connections to the EPA network and the Internet. 1.2.2 ensure that information technology (IT) resources attached to the EPA network are consistent with, and supportive of, a secure network IT infrastructure design. 1.2.3 protect EPA IT resources from malicious threats or unauthorized use, as well as unintentional misuse by authorized persons. 1.2.4 support the Agency in delivering reliable, high quality data in order for EPA to fulfill its mission of protecting human health and the environment. 1.2.5 maintain the appropriate level of security to support the ability of the Agency to conduct its work. 2 SCOPE AND APPLICABILITY 2.1 All EPA employees, contractors, grantees and all other users of the EPA information and systems. 2.2 All EPA information and information systems including information used and information systems used or operated by contractors and other third parties on behalf of EPA.
    [Show full text]
  • Personal Firewalls Are a Necessity for Solo Users
    Personal firewalls are a necessity for solo users COMPANY PRODUCT PLATFORM NOTES PRICE Aladdin Knowledge Systems Ltd. SeSafe Desktop Windows Combines antivirus with content filtering, blocking and $72 Arlington Heights, Ill. monitoring 847-808-0300 www.ealaddin.com Agnitum Inc. Outpost Firewall Pro Windows Blocks ads, sites, programs; limits access by specific times $40 Nicosia, Cyprus www.agnitum.com Computer Associates International Inc. eTrust EZ Firewall Windows Basic firewall available only by download $40/year Islandia, N.Y. 631-342-6000 my-etrust.com Deerfield Canada VisNetic Firewall Windows Stateful, packet-level firewall for workstations, mobile $101 (Canadian) St. Thomas, Ontario for Workstations users or telecommuters 519-633-3403 www.deerfieldcanada.ca Glucose Development Corp. Impasse Mac OS X Full-featured firewall with real-time logging display $10 Sunnyvale, Calif. www.glu.com Intego Corp. NetBarrier Personal Firewall Windows Full-featured firewall with cookie and ad blocking $50 Miami 512-637-0700 NetBarrier 10.1 Mac OS X Full-featured firewall $60 www.intego.com NetBarrier 2.1 Mac OS 8 and 9 Full-featured firewall $60 Internet Security Systems Inc. BlackIce Windows Consumer-oriented PC firewall $30 Atlanta 404-236-2600 RealSecure Desktop Windows Enterprise-grade firewall system for remote, mobile and wireless users Varies blackice.iss.net/ Kerio Technologies Inc. Kerio Personal Firewall Windows Bidirectional, stateful firewall with encrypted remote-management option $39 Santa Clara, Calif. 408-496-4500 www.kerio.com Lava Software Pty. Ltd. AdWare Plus Windows Antispyware blocks some advertiser monitoring but isn't $27 Falköping, Sweden intended to block surveillance utilities 46-0-515-530-14 www.lavasoft.de Network Associates Inc.
    [Show full text]
  • User Information Security Policy
    User Information Security Policy Urbano remains linty after Benjy phosphatizing muckle or decease any fuchsias. Rab allowances enclitically if arthropodal Gustavus mediate or stetted. Kerchiefed Hayes metaling or desalinizing some etaerios decorously, however malarious Vaclav clipt frankly or plasticize. Examine the whole section is subject that security information policy Protecting this College resource is a shared responsibility between more data users and the Information Technology staff Network security including firewall. Staff students and lead other user with car to University IT Systems must ready with multiple IT Security Policy 3 Information Handling 31 Classification of. CMS Information Security and sound Overview CMS. What line the security concepts? How miserable you test system security? Periodic user access reviews and education of information security policies. IDENTIFY THE VARIOUS CLASSES OF POLICY USERS 5 REQUIREMENT 3 ORGANIZE INFORMATION SECURITY POLICIES AND STANDARDS INTO. How you write an information security policy with template example. Information Security Policy manage your nutrition with these. Information Security Policy team of Information Technology. The means by provide access to computer files is limited to authorized users only Firewall A device andor software that prevents unauthorized and improper transit. What is dilute IT Security Policy Palo Alto Networks. What is security policy Definition from WhatIscom. Information Security Policy an overview ScienceDirect Topics. Computer network--everything from installation and maintenance to user. These regulations include Mass 93H210 CMR 17 Federal Red Flag Rules FERPA eDiscovery as reciprocal as non-Mass state personal information laws. Computer Security Policies Tutorialspoint. Cyber Security Policy all Library Georgia Institute of. This management is dictionary in order in ensure children access food the University's information and information systems is restricted to authorised users Acceptable.
    [Show full text]
  • NAVIGATING the CYBERSECURITY STORM
    NAVIGATING the CYBERSECURITY STORM A Guide for Directors and Officers BY PAUL A. FERRILLO EDITED BY BILL BROWN published by sponsored by sponsored by 1 © 2015 by Paul A. Ferrillo. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopy, recording, or any other information storage or retrieval system without prior written permission. To use the information contained in this book for a greater purpose or application, contact Paul A. Ferrillo via [email protected] 2 Is your company protected from the Internet of RiskSM? With CyberEdge® cyber insurance solutions you can enjoy the Business Opportunity of Things. 20 billion objects are connected to the Internet, what everyone is calling the Internet of Things. This hyperconnectivity opens the door both to the future of things, and to greater network vulnerabilities. CyberEdge end-to-end cyber risk management solutions are designed to protect your company from this new level of risk. So that you can turn the Internet of Things into the next big business opportunity. To learn more and download the free CyberEdge Mobile App, visit www.AIG.com/CyberEdge Insurance, products and services are written or provided by subsidiaries or affiliates of American International Group, Inc. Insurance and services may not be available in all jurisdictions, and coverage is subject to actual policy language. For additional information, please visit our website at www.AIG.com. ABOUT PAUL A. FERRILLO Paul Ferrillo is counsel in Weil’s Litigation Department, where he focuses on complex securities and business litigation, and internal investigations.
    [Show full text]
  • Stateful Firewalls
    05 7376 ch03 2/11/05 2:14 PM Page 55 3 Stateful Firewalls THE FOCUS OF THIS CHAPTER IS ON STATEFUL firewalls, a type of firewall that attempts to track the state of network connections when filtering packets.The stateful firewall’s capabilities are somewhat of a cross between the functions of a packet filter and the additional application-level protocol intelligence of a proxy. Because of this additional protocol knowledge, many of the problems encountered when trying to configure a packet-filtering firewall for protocols that behave in nonstandard ways (as mentioned in Chapter 2,“Packet Filtering”) are bypassed. This chapter discusses stateful filtering, stateful inspection, and deep packet inspection, as well as state when dealing with various transport and application-level protocols.We also demonstrate some practical examples of how several vendors implement state track- ing as well as go over examples of such firewalls. How a Stateful Firewall Works The stateful firewall spends most of its cycles examining packet information in Layer 4 (transport) and lower. However, it also offers more advanced inspection capabilities by targeting vital packets for Layer 7 (application) examination, such as the packet that ini- tializes a connection. If the inspected packet matches an existing firewall rule that per- mits it, the packet is passed and an entry is added to the state table. From that point forward, because the packets in that particular communication session match an existing state table entry, they are allowed access without call for further application layer inspec- tion.Those packets only need to have their Layer 3 and 4 information (IP address and TCP/UDP port number) verified against the information stored in the state table to confirm that they are indeed part of the current exchange.This method increases overall firewall performance (versus proxy-type systems, which examine all packets) because only initiating packets need to be unencapsulated the whole way to the application layer.
    [Show full text]
  • Guidelines on Firewalls and Firewall Policy
    Special Publication 800-41 Revision 1 Guidelines on Firewalls and Firewall Policy Recommendations of the National Institute of Standards and Technology Karen Scarfone Paul Hoffman NIST Special Publication 800-41 Guidelines on Firewalls and Firewall Revision 1 Policy Recommendations of the National Institute of Standards and Technology Karen Scarfone Paul Hoffman C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 September 2009 U.S. Department of Commerce Gary Locke, Secretary National Institute of Standards and Technology Patrick D. Gallagher, Deputy Director GUIDELINES ON FIREWALLS AND FIREWALL POLICY Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-41 Revision 1 Natl. Inst. Stand. Technol. Spec. Publ. 800-41 rev1, 48 pages (Sep. 2009) Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately.
    [Show full text]
  • Firewall & Security
    SD-Edge Services Overview Firewall & Security Secure Access Service Edge (SASE) Upgrading From Traditional Firewalls Traditional perimeter-only firewalls are no longer effective due to the high reliance on cloud-based applications and the limited budgets to provide deep-threat protection at every single business site and remote worker site. Furthermore, many sites have a large guest user base, such as in retail, education, healthcare, venues, MDUs, hospitality, and public WiFi networks. In all of these scenarios, there is a mix of trusted users (employees and staff), trust devices (Internet-of-Things), partially trusted users (vendors or suppliers), and untrusted users (guests). For all these different types of users, even trusted users, Benu supports a zero-trust approach. Zero-trust security restricts users to only the parts of the network and applications that they need, thereby reducing the attack surface and minimizing access to sensitive parts of the network. Microsegmentation creates separate zones within the network to maintain separate layers of access to applications and network resources. In addition, unlike typical firewalls, Benu’s SD-Edge platform supports per-user policy enforcement which is essential in environments with a high number of untrusted or partially trusted guests. These per-user policies include network access controls, QoS and rate limiting, content filtering, and data volume limits. What Sets Benu Apart Benu’s carrier-class firewall is protecting over 24 million WLAN APs and the users behind them. Carrying over 7 Petabytes of traffic a day, Benu’s firewall software is field proven for nearly a decade of broad commercial deployment. Trusted by the largest Tier-1 carriers in the world, Benu’s SD-Edge software and firewall capabilities are currently used in a wide range of applications, from public WIFi networks to major venues, carrier broadband access networks, multi-dwelling units (MDUs), retail establishments, and hospitality.
    [Show full text]
  • Stay Ahead of the Cybercriminal Heyday
    REINFORCE NETWORK SECURITY FOR THE 2020S Stay ahead of the cybercriminal heyday As business becomes increasingly mobile, digital and cloud-based, networks become ever more vulnerable to cyberattacks. Add in the rapid rise of AI, IoT and the demands on in-house IT teams, and it’s a perfect storm of opportunity for cybercriminals. To help defend your assets against today’s fast-evolving threats, experts recommend a multi-layered approach to network security. MANGED FIREWALL The ultimate balancing act: Enabling emerging technologies. Ensuring security. EMERGING TECH SECURITY RISKS Increasing … … exposes you to new and increased risks More exposure Personal apps on Mobility BYOD and endpoints company network Cloud AI, ML Sophisticated AI’s ability to find computing and bots phishing attacks and access data Deepfakes to Demands on Security alert IoT ransomware IT security teams fatigue targets Ransomvware RaaS spreading targeting the malware faster cloud New attacks leveraging old DIY cloud security malware Human error configuring the cloud Beware of low-hanging fruit for cybercriminals ° Old, unpatched vulnerabilities ° Misconfigured cloud environments ° Existing, successful malware ° Weak access controls ° Overreliance on traditional tools ° Lack of real-time visibility ° Legacy infrastructures ° Unmonitored network traffic ° Fragile connectivity More than $3.5 billion was reported lost as the result of cyber crimes in 2019 alone. FEDERAL BUREAU OF INVESTIGATION, 2019 INTERNET CRIME REPORT Defend against bad actors with an arsenal of security measures ° 24/7/365 monitoring ° SIEM ° IPsec VPN ° Stateful firewall ° Remote worker network access ° Application control ° Web content/URL filtering ° Antivirus/antimalware ° Intrusion prevention systems ° DNS filtering ° Cloud sandbox ° Botnet protection ° Content disarm and reconstruction ° Antispam ° Vulnerability management Much of the success of cyber adversaries has been due to the ability to take advantage of the expanding attack surface and the resulting security gaps due to digital transformation.
    [Show full text]
  • User-Oriented Network Security Policy Specification
    User-oriented Network Security Policy Specification Fulvio Valenza1;2*, and Antonio Lioy1 1Politecnico di Torino, DAUIN, corso duca degli Abruzzi 24, Turin, Italy 2CNR-IEIIT, corso duca degli Abruzzi 24, Turin, Italy ffulvio.valenza, [email protected] Abstract The configuration and management of security controls and applications is complex and not well understood by the majority of end-users (i.e. it typically requires specific skills). The security policy language simplifies this task and reduces the number of errors and anomalies. This paper proposes the specification of the two mechanisms for defining user’s security policies, namely High-level Security Policy Language (HSPL) and Medium-level Security Policy Language (MSPL). HSPL is suitable for expressing the protection requirements of typical non-technical users, while MSPL is a lower-level abstraction useful for expressing specific configurations of security controls in a generic format (as such it is more appealing for technical users). Keywords: network security policy, security requirement, policy refinement 1 Introduction Nowadays the common approach to protect personal devices from Internet threats relies on the installa- tion of appropriate security controls (e.g. firewall, VPN concentrator, etc.). To achieve this goal, typically it is required a deep knowledge on how each security control should be configured, which generally involves in setting up several security applications of different vendors and different security functions (or capabilities), like packet filtering, VPN gateway, parental control, etc.. In general, for non-technical users and occasionally for administrators, this may turn out a difficult hurdle to overcome[21]. In order to simplify the configuration of security controls, we propose the definition of two user- oriented network security policy languages.
    [Show full text]
  • 8 Fit Points to Help You Find the Right-Sized SD-WAN INTRODUCTION
    8 Fit Points to Help You Find the Right-Sized SD-WAN INTRODUCTION What would it mean for you to have a Software-Defined Wide Area Network (SD-WAN) tailored to fit your business? Would it mean you could launch your digital transformation initiatives and no longer be limited by your legacy MPLS circuits? Or, that you could be confident your network is secure in spite of having thousands of employees working from home? Or, that you could deploy touchless Payment Card Industry (PCI) compliant payment options easily across all your locations? For these and many other reasons, SD-WAN is not a simple off-the-shelf purchase. It requires a custom fit to truly meet your business needs and enhance operations and security; much like a custom-made suit will fit better than one that’s been pulled off the rack. Here, we define “8 Fit Points” to help you assess your current situation and determine how to get an SD-WAN solution tailored to your business. 8 FIT POINTS 2 Fit Point #1: Security Theoretically, everyone understands the need for network security. But let’s look at some hard data to better quantify the issues of risk and need, and to underscore its importance. According to predictions by Cybersecurity Ventures, cybercrime damages will cost $6 trillion annually across the globe by 2021. That’s double the figure from 2015, which came in at roughly $3 trillion. Why such a dramatic increase? Because there has been exponential growth in the types and numbers of devices that connect to networks over the past 5 years, as mobile use has been unleashed.
    [Show full text]
  • An Aryon Primer on the Need for a Next Generation Firewall
    Aryon Pty Ltd A Primer on the need for Next Generation Firewalls Cost and lost business associated with data breaches and lawsuits continue to increase every year. As long as valuable information exists, criminals will attempt to steal it using a wealth of traditional, as well as ever more sophisticated attacks. To stay ahead of new threats, businesses need a security platform that can provide protection against both known and new threats, while scaling to accommodate business growth and new services. Introduction The term ‘next-generation firewall’ (NGFW) became popular in 2009 when the research firm Gartner published a report titled “Defining the Next Generation Firewall”. The report refers to a firewall that offers specific features to address changes in both the way business processes use IT 1 and the ways attacks try to compromise business systems. Unfortunately, some Next Generation Firewalls not only fail to provide these advanced next- generation features to guard against new attacks; they also fail to provide a mature platform of core network protection features to block existing attacks. This is why industry analysts still caution that NGFW features are most effective when used in conjunction with other layers of security controls. In order to block all threats, Next Generation Firewalls must also include traditional packet filtering, network address translation, stateful protocol inspection, and virtual private network (VPN) capabilities.1 Next Generation Firewalls must be built on a solid, field-proven base of traditional or core network protection features before attempting to add next-generation security features such as application control and deep packet inspection.
    [Show full text]