Title: Security Management Models
Course: IN 2001 Principle of Information Assurance > Section: Module 12: Chapter 12

Security Management Models
1. Only by creating an aggressive external and internal monitoring program can the information security team hope to stay abreast of changes in the environment.
2. To assist the information security community in managing and operating the ongoing security program, a management model must be adopted.  In general, management models are frameworks that structure the tasks of managing a particular set of activities or business functions.

NIST SP 800-100 Information Security Handbook: A Guide
for Managers
1. The NIST SP 800-100, which is a guide to information security governance, covering thirteen areas of information security management. The guidance describes specific monitoring activities for the information security management team to ensure continuous compliance and adaptability.
2. Information security governance, which mandates that agencies should monitor the status of their programs to ensure that:
  - Ongoing information security activities are providing appropriate support to the agency mission
  - Policies and procedures are current and aligned with evolving technologies, if appropriate
  - Controls are accomplishing their intended purpose
3. System development life cycle as a multistep process, incorporating information security related minima to assure and incorporate information security into implemented systems.
4. Awareness and training as the backbone of an information security program, ensuring that all users are both aware and trained on a minimum level of information security.
5. Capital planning and investment control, which implements a three-step process for the investment life cycle, select-control-evaluate, resulting in a seven-step process for prioritizing security investments.
6. System interconnection.  Explain that the NIST SP 800-47 approach includes a four phase (plan, establish, maintain and disconnect) plan for all interconnected systems.
7. The value of performance measures. With this type program, organizations develop information security metrics that measure the effectiveness of their security program and provide data to be analyzed and used by program managers and system owners to isolate problems, justify investment requests and target funds to the areas in need of improvement.
8. Security planning, in which strategic, tactical and operational plans must be developed in alignment with and support organizational and IT plans, goals and objectives.
9. Information technology contingency planning as a seven-step methodology explained in SP 800-34, Contingency Planning for Information Technology Systems.
10. Risk management as a cycle that is fundamental to the information security program and its continuous improvement.
11. Certification, accreditation, and security assessments as a monitoring program that implements the following, as a minimum:
  - Configuration management and configuration control processes for the information system
  - Security impact analyses on changes to the information system
  - Assessment of selected security controls in the information system and reporting of information system security status to appropriate agency officials
12. Security services and products acquisition, which states that when acquiring information security products, organizations are encouraged to conduct a cost benefit analysis—one that also includes the costs associated with risk mitigation.  This cost benefit analysis should include a life cycle cost estimate for the status quo and one for each identified alternative while highlighting the benefits associated with each alternative.
13. Incident response, which prescribes the four-phase incident response procedure from NIST SP 800-61 and includes preparation, detection and analysis, containment, eradication, and recovery and post-incident recovery.
14. The configuration (or change) management process as one that involves the continuous monitoring and management of changes to information systems or networks.

The Security Maintenance Model
1. A maintenance model is intended to complement the chosen management model and focus organizational effort on maintaining systems.
2. The model is based on five subject areas or domains:
  - External monitoring
  - Internal monitoring
  - Planning and risk assessment
  - Vulnerability assessment and remediation
  - Readiness and review

Monitoring the External Environment
1. The objective of the external monitoring domain in the maintenance model is to provide the early awareness of new and emerging threats, threat agents, vulnerabilities and attacks that is needed to mount an effective and timely defense.
2. External monitoring entails collecting intelligence from data sources, and then giving that intelligence context and meaning for use by decision makers within the organization.
3. The purpose of and types of data sources.
  - Acquiring data about threats, threat agents, vulnerabilities, and attacks is not difficult. There are many sources of raw intelligence and few costs associated with gathering it. What is challenging and can be expensive is turning this flood of good and timely data into information that decision makers can use.
  - External intelligence can come from three classes of sources:
  - Vendors
  - CERT organizations
  - Public network sources
  - Regardless of how the organization collects external monitoring data, the CISO evaluates the actions and personnel needed to act on the information. The responsibility for establishing a viable external monitoring program includes the following tasks:
  - Creating documented and repeatable procedures
  - Providing proper training to primary and backup staff members who are assigned to perform the monitoring tasks
  - Equipping assigned staff members with proper access and tools to perform the monitoring function
  - Designing criteria and cultivating expertise among the monitoring analysts so that they can perform analytic steps to cull meaningful summaries and actionable alerts from the vast flow of raw intelligence
  - Developing suitable communications methods for moving processed intelligence to designated internal decision makers in all three communities of interest
  - Integrating the incident response plan with the results of the external monitoring process for appropriate, timely responses
4. Monitoring, escalation and incident response processes.
  - The basic function of the external monitoring process is to monitor activity, report results, and escalate warnings
  - The optimum approach for escalation is based on a thorough integration of the monitoring process into the IRP
  - The monitoring process has three primary deliverables:
    - Specific warning bulletins issued when developing threats and specific attacks pose a measurable risk to the organization
    - Periodic summaries of external information
    - Detailed intelligence on the highest risk warnings
5. Data collection and management.
6. Over time, the external monitoring processes should capture knowledge about the external environment in a format that can be referenced both across the organization as threats emerge and for historical use.
7. In the final analysis, external monitoring collects raw intelligence, filters it for relevance to the organizations, assigns it a relative risk impact and communicates these findings to the decision makers in time to make a difference.

Monitoring the Internal Environment
1. It is just as important to monitor the internal computing environment, as it is to monitor the external environment.  The primary goal of the internal monitoring domain is to maintain an informed awareness of the state of all of the organization’s networks, information systems and information security defenses. Internal monitoring is accomplished by:
  - Building and maintaining an inventory of network devices and channels, IT infrastructure and applications, and information security infrastructure elements
  - Active participation in, or leadership of, the IT governance process within the organization to integrate the inevitable changes found in all network, IT, and information security programs
  - Real-time monitoring of IT activity using intrusion detection systems to detect and initiate responses to specific actions or trends of events that introduce risk to the organization’s assets
  - Periodic monitoring of the internal state of the organization’s networks and systems.  This recursive review of the network and system devices that are online at any given moment and of any changes to the services offered on the network is needed to maintain awareness of new and emerging threats.  This can be accomplished through automated difference-detection methods that identify variances introduced to the network or system hardware and software
2. Network characterization and inventory process.
  - Each organization should have a carefully planned and fully populated inventory for all network devices, communication channels, and computing devices
  - The process of collecting this information is called characterization, as it is the systematic collection of the characteristics of the network and computer devices that are present in the environment.  Once the characteristics have been identified, they must be carefully organized and stored using a manual or automated mechanism that allows timely retrieval and rapid integration of disparate facts
3. How to make intrusion detection and prevention systems work.
  - To be effective, IDS must be integrated into the maintenance process. An endless flow of alert messages makes little difference to the effectiveness of the information security program. After all, the IDS is reporting events that have already occurred
  - The most important value of the raw intelligence provided by the IDS is that it can be used to prevent risk in the future
  - Whether the organization outsources IDS monitoring, staffs IDS monitoring 24/7, staffs IDS monitoring during business hours, or merely ignores the real-time alerts from IDS, the log files from the IDS engines can be mined for information that can be added to the internal monitoring knowledge base
  - Analyzing attack signatures for unsuccessful system attacks can identify weaknesses in various security efforts
4. How to detect differences.
  - One approach that has achieved good results is to perform various combinations of manual and automated difference analysis to identify changes to the internal environment
  - Difference analysis is a procedure that compares the current state of a network segment (the systems and services it offers) against a known previous state of that same network segment (the baseline of systems and services).

Planning and Risk Assessment
1. The primary objective of the planning and risk assessment domain is to keep a lookout over the entire information security program.  This is done in part by identifying and planning ongoing information security activities that further reduce risk.
2. The risk assessment group also identifies and documents risks introduced by both IT projects and information security projects.  The group also identifies and documents risks that may be latent in the present environment.
3. The primary objectives of this domain as follows:
  - Establish a formal information security program review process that complements and supports both the IT planning process and strategic planning processes
  - Institute formal project identification, selection, planning, and management processes for information security follow-up activities that augment the current program
  - Coordinate with IT project teams to introduce risk assessment and review for all IT projects, so that risks introduced from the launching of IT projects are identified, documented, and factored into projects decisions
  - Integrate a mindset of risk assessment across the organization to encourage the performance of risk assessment activities when any technology system is implemented or modified
4. The main issues surrounding information security program planning and review.
  - Periodic review of an ongoing information security program coupled with planning for enhancements and extensions is a recommended practice for each organization
  - The strategic planning process should examine the future IT needs of the organization and the impact those needs will have on information security
  - A recommended approach takes advantage of the fact that most organizations have annual capital budget planning cycles and manage security projects as a part of that process
  - Projects that organizations might fund to maintain, extend, or enhance the information security program will arise in almost every planning cycle. Larger information security projects should be broken into smaller, incremental projects. Doing this is important for several reasons:
    - Smaller projects tend to have more manageable impacts on the networks and users
    - Larger projects tend to complicate the change control process in the implementation phase
    - Short planning, development, and implementation schedules reduce any uncertainty for IT planners and financial sponsors
    - Most large projects can easily be assembled from smaller projects, providing more opportunities to change direction and gain flexibility as events occur and circumstances change
5. The process of conducting security risk assessments.
  - A key component in the engine that drives change in the information security program is a relatively straightforward process called an information security operational risk assessment.
  - The RA is a method of identifying and documenting the risk that a project, process, or action introduces to the organization and may also offer suggestions for controls that can reduce that risk.
  - The information security group often finds itself in the business of coordinating the preparation of many different types of RA documents, including:
    - Network connectivity RA
    - Dialed modem RA
    - Business partner RA
    - Application RA
    - Vulnerability RA
    - Privacy RA
    - Acquisition or divesture RA
    - Other RAs

Vulnerability Assessment and Remediation
1. The primary goal of the vulnerability assessment and remediation domain is to identify specific, documented vulnerabilities and remediate them in a timely fashion.  This is accomplished by:
  - Using vulnerability assessment procedures that are documented to safely collect intelligence about networks, platforms, dial-in modems, and wireless network systems
  - Documenting background information and providing tested remediation procedures for the reported vulnerabilities
  - Tracking, communicating, reporting and escalating to management the itemized facts about the discovered vulnerabilities and the success or failure of the organization to remediate them
2. The process of identifying and documenting specific and provable flaws in the organization’s information asset environment is called vulnerability assessment.
3. While the exact procedures can vary, the following five vulnerability assessment processes can serve many organizations as they attempt to balance the intrusiveness of vulnerability assessment with the need for a stable and productive production environment.
4. The process of identifying and documenting specific and provable flaws in the organization’s information asset environment is called vulnerability assessment.
5. While the exact procedures can vary, the following five vulnerability assessment processes can serve many organizations as they attempt to balance the intrusiveness of vulnerability assessment with the need for a stable and productive production environment.
6. Penetration testing as the systematic use of tools to attempt to undermine the security of a system to demonstrate potential weaknesses of a system for the purpose of strengthening the security posture of the organization.
7. The Internet vulnerability assessment process.
  - The Internet vulnerability assessment process is designed to find and document the vulnerabilities that may be present in the public-facing network of the organization
  - Because attackers from this direction take advantage of any loophole or flaw, this assessment is usually performed against all public-facing addresses, using every possible penetration testing approach
  - The steps in the process are:
    - Planning, scheduling and notification of the penetration testing: Large organizations often take an entire month to perform the data collection phase, using nights and weekends and avoiding change control blackout windows.  The various technical support communities are given the detailed plan so that they know when each device is scheduled for testing and what tests are to be used
    - Target selection: Working from the network characterization database elements that are stored in the risk, threat, and attack database, the penetration targets are selected
    - Test selection: Using the external monitoring intelligence generated previously, the test engine is configured for the tests to be performed
    - Scanning: The penetration test engine is unleashed at the scheduled time using the planned target list and test selection. The results of the entire test run are logged in text log files for analysis. This should be a monitored process so that if an invasive penetration test causes a disruption to a targeted system, the outage can be reported immediately for recovery
    - Analysis: A knowledgeable and experienced vulnerability analyst screens the test results for the vulnerabilities logged during scanning
    - Record keeping: The organization records the details of the documented vulnerability in the vulnerability database, identifying the logical and physical characteristics and assigning a response risk level to the vulnerability to differentiate the truly urgent from the merely critical
8. The intranet vulnerability assessment process.
  - The intranet vulnerability assessment process is designed to find and document selected vulnerabilities that are likely to be present on the internal network of the organization
  - Attackers from this direction are often internal members of the organization, affiliates of business partners or automated attack vectors (such as viruses and worms)
  - This assessment is usually performed against selected critical internal devices with a known, high value by using selective penetration testing.  The steps in the process are almost identical to the steps in the Internet vulnerability assessment, except as noted below
  - Planning, scheduling and notification of the penetration testing: There will be substantially more systems to assess.  Intranet administrators often prefer that penetration testing be performed during working hours
  - Target selection: At first, the penetration test scanning and analysis should focus on testing only the highest value, most critical systems. As the configuration of these systems is improved and fewer candidate vulnerabilities are found in the scanning step, the target list can be expanded
  - Test selection: The selection of the tests to be performed usually evolves over time to correspond with the evolution of the threat environment. Most organizations focus their intranet scanning efforts on a few very critical vulnerabilities at first, and then expand the test pool to include more scripts
  - Scanning: Just as it is in Internet scanning, the process should be monitored so that if an invasive penetration test causes disruption, it can be reported for repair
  - Analysis: Follows the same three steps as Internet analysis: classify, validate and document
  - Record keeping: Identical to the one followed in an Internet vulnerability analysis
9. Platform security validation process.
  - The platform security validation (PSV) process is designed to find and document the vulnerabilities that may be present because of misconfigured systems in use within the organization
  - These misconfigured systems fail to comply with company policy or standards as adopted by the IT governance groups and communicated in the information security and awareness program
  - Fortunately, automated measurement systems are available to help with the intensive process of validating the compliance of platform configuration with policy
10. Wireless vulnerability assessment process.
  - The wireless vulnerability assessment process is designed to find and document the vulnerabilities that may be present in the wireless local area networks of the organization
  - Because attackers from this direction are likely to take advantage of any loophole or flaw, this assessment is usually performed against all publicly accessible areas, using every possible wireless penetration testing approach
11. Modem vulnerability assessment process.
  - The modem vulnerability assessment process is designed to find and document any vulnerability that is present on dial-up modems that are connected to the organization’s networks
  - Since attackers from this direction take advantage of any loophole or flaw, this assessment is usually performed against all telephone numbers owned by the organization, using every possible penetration testing approach
  - One of the elements of this process is called war dialing, which involves using scripted dialing attacks against a pool of phone numbers
12. How to document vulnerabilities.
  - The vulnerability database, like the risk, threat and attack database, both store and tracks information.  It should provide details about the vulnerability being reported as well as linkage to the information assets that are characterized in the risk, threat and attack database
  - While this can be done through manual data storage, the low cost and ease of use associated with relational databases makes them a more realistic choice
  - The data stored in the vulnerability database should include:
    - A unique vulnerability ID number for reporting and tracking remediation actions
    - Linkage to the risk, threat, and attack database based on the physical information asset underlying the vulnerability
    - Vulnerability details usually based on the test script used for the scanning step of the process
    - Dates and times of notification and remediation activities
    - Current status of the vulnerability instance
    - Comments
    - Other fields as needed to manage the reporting and tracking processes in the remediation phase
    - The vulnerability database is an essential part of effective remediation as it helps organizations avoid losing track of specific vulnerability instances as they are reported and remediated
13. The process of remediating vulnerabilities.
  - The objective of remediation is to repair the flaw that is causing a vulnerability instance or remove the risk associated with the vulnerability. As a last resort, informed decision makers with the proper authority can accept the risk
  - When approaching the remediation process, it is important to recognize that building relationships with those who control the information assets is the key to success. Success depends on the organization adopting a team approach to remediation, in place of cross-organizational push and pull
  - Acceptance or transference of risk involves the following issues
  - In some instances, risk must simply be acknowledged as part of the organization’s business process.
  - The information security professional must assure the general management community that the decision to accept the risk was made by properly informed decision makers.  These decision makers must have the proper level of authority to accept the risk
  - In the final analysis, the information security group must make sure the right people make risk assumption decisions and that these people are aware of both the potential impact of their decision and the cost of the possible security controls
  - Threat removal involves the following issues
  - In some circumstances, threats can be removed without repairing the vulnerability.  The vulnerability can no longer be exploited, and the risk has been removed
  - Other vulnerabilities may be amenable to controls that require an expensive repair but allow the risk associated with the vulnerability to be successfully removed from the situation
  - Vulnerability repair involves the following issues
  - The optimum solution in most cases is to repair the vulnerability. Applying patch software or implementing a workaround to the vulnerability often accomplishes this
  - In some cases, simply disabling the service removes the vulnerability.  In other cases, simple remedies are possible. Of course, the most common repair is the application of a software patch to make the system function in the expected fashion and to remove the vulnerability

Readiness and Review
1. The primary goal of the readiness and review domain is to keep the information security program functioning as designed and to keep it continuously improving over time.  This is accomplished by:
  - Policy review: Sound policy needs to be reviewed and refreshed from time to time to provide a current foundation for the information security program
  - Readiness review: Major planning components should be reviewed on a periodic basis to ensure they are current, accurate and appropriate
  - Rehearsals: When possible, major plan elements should be rehearsed
2. Policy review is the primary initiator of the readiness and review domain. As policy is revised or current policy is confirmed, the various planning elements are reviewed for compliance, the information security program is reviewed and rehearsals are held to make sure all participants are capable of responding as needed.
3. Policy needs to be reviewed periodically.  As policy needs shift, a thorough and independent review of the entire information security program should be undertaken.  While an exact timetable for review is not proposed here, many organizations find that the CISO should conduct a formal review annually.
4. Major planning elements should be rehearsed whenever possible.  Rehearsal adds value by exercising procedures, identifying shortcomings and providing security personnel the opportunity to improve the security plan before it is needed.  In addition, rehearsals make people more effective when an actual event occurs. Rehearsals that closely match reality are called war games.