Title: Information Security Blueprints
Course: IN 2001 Principle of Information Assurance > Section: Module 5: Chapter Five

Information Security Blueprints
1. The security blueprint is the basis for the design, selection, and implementation of all security program elements.
2. Built on top of the organizations information security policies, it is a scalable, upgradeable, comprehensive plan to meet the organization’s current and future information security needs.
3. It is a detailed version of the security framework, which is an outline of the overall information security strategy for the organization and a roadmap for planned changes to the information security environment of the organization.
4. One approach to selecting a methodology is to adapt or adopt a published model, or framework, for information security.
5. A framework is a basic structure within which the blueprint is developed or refined.
6. Experience teaches us that what works well for one organization may not work well for another.

The ISO 27000 Series
1. In 2000, this Code of Practice was adopted as an international standard by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) as ISO/IEC 17799.  The following is an outline of the content in ISO/IEC 17799:
2. One of the most widely referenced and often discussed security models is the Information Technology – Code of Practice for Information Security Management, which was originally published as the British Standard BS 7799.
3. Personnel security objectives include the following:
  - Reduce risks of human error, theft, fraud, or misuse of facilities
  - Ensure that users are aware of information security threats and concerns and are equipped to support the corporate security policy
4. Asset classification and control are needed to protect corporate assets and to ensure that information assets receive an appropriate level of protection
5. Organizational security infrastructure objectives include the following:
  - Manage information security within the company
  - Maintain the security of organizational information-processing facilities and information assets accessed by third parties
  - Maintain the security of information when the responsibility for information processing has been outsourced to another organization
6. Organizational security policy is needed to provide management direction and support for information security
7. Minimize the damage from security incidents and malfunctions and learn from such incidents
8. Physical and environmental security objectives include the following:
  - Prevent unauthorized access, damage, and interference to business premises and information
  - Prevent loss, damage, or compromise of assets and interruption to business activities
  - Prevent compromise or theft of information and information-processing facilities
9. Communications and operations management objectives include the following:
  - Ensure the correct and secure operation of information-processing facilities
  - Minimize the risk of systems failures
  - Protect the integrity of software and information
  - Maintain the integrity and availability of information processing and communication
  - Safeguard information in networks and protect the supporting infrastructure
  - Prevent damage to assets and interruptions to business activities
  - Prevent loss, modification or misuse of information that is exchanged between organizations
10. System access control objectives include the following:
  - Control access to information
  - Prevent unauthorized access to information systems
  - Protect networked services
  - Prevent unauthorized computer access
  - Detect unauthorized activities
  - Ensure information security when using mobile computing and telecommunication networks
11. System development and maintenance objectives include the following:
  - Ensure security is built into operational systems.
  - Prevent loss, modification, or misuse of user data in application systems
  - Protect the confidentiality, authenticity, and integrity of information
  - Ensure IT projects and support activities are conducted in a secure manner
  - Maintain the security of application system software and data
12. Business continuity planning is needed to counteract the interruptions caused by major failures or disasters to business activities and critical business processes
13. Compliance objectives include:
  - Avoid breaches of any criminal or civil law, statutory, regulatory or contractual obligations or security requirements
  - Ensure compliance of systems with organizational security policies and standards
  - Maximize the effectiveness of the system audit process and minimize interference with the process

NIST Security Models
1. Another approach available is described in the many documents available from the Computer Security Resource Center of the National Institute for Standards and Technology (csrc.nist.gov).
2. NIST documents are publicly available at no charge and have been available for some time.  They have been broadly reviewed by government and industry professionals and they are among the references cited by the federal government when it decided not to select the ISO/IEC 17799 standards.
3. SP 800-12, An Introduction to Computer Security: The NIST Handbook, is an excellent reference and guide for the security manager or administrator in the routine management of information security.
4. SP 800-14, Generally Accepted Principles and Practices for Securing Information Technology Systems, provides best practices and security principles that can direct the security team in the development of a security blueprint.
5. Enumerate these principles:
  - Security supports the mission of the organization
  - Security is an integral element of sound management
  - Security should be cost-effective
  - Systems owners have security responsibilities outside their own organizations
  - Security responsibilities and accountability should be made explicit
  - Security requires a comprehensive and integrated approach
  - Security should be periodically reassessed
  - Security is constrained by societal factors
6. Explain how SP 800-18 Rev.1, The Guide for Developing Security Plans for Federal Information Systems, can be used as the foundation for a comprehensive security blueprint and framework.  This publication provides detailed methods for assessing, designing and implementing controls and plans for applications of varying size.

IETF Security Architecture
1. Emphasize that while no specific architecture is promoted through the Internet Engineering Task Force, the Security Area Working Group acts as an advisory board for the protocols and areas developed and promoted through the Internet Society.
2. Explain how RFC 2196: Site Security Handbook provides an overview of five basic areas of security with detailed discussions on development and implementation.  Topics include security policies, security technical architecture, security services and security incident handling.

Baselining and Best Business Practices
1. Note that baselining and best practices are reliable methods used by some organizations to assess security practices.  They don’t provide a complete methodology for the design and implementation of all practices needed by an organization; however, it is possible to piece together the desired outcome of the security process and thus reverse engineer an effective design.
2. Explain how the Federal Agency Security Practices site (fasp.csrc.nist.gov) is designed to provide best practices for public agencies, but these practices can be adapted easily to private institutions.
3. Note that the documents found in this site include examples of key policies and planning documents, implementation strategies for key technologies and position descriptions for key security personnel.
4. Explain that a number of other public and semipublic institutions provide information on best practices. Some even hold seminars and classes on various topics.

Design of Security Architecture
1. Discuss the following sections, which outline a few key security architectural components.  To assess whether a framework and/or blueprint are on target to meet an organization’s needs you must have a working knowledge of these security architecture components.
2. Describe the concept of spheres of security.
  - Generally speaking, the spheres of security illustrate how information is under attack from a variety of sources.  The “sphere of use” illustrates the ways in which people access information
  - Information is always at risk from attacks through the people and computer systems that have access to the information
  - The “sphere of protection” illustrates that between each layer of the sphere of use, there must exist a layer of protection to prevent access to the inner layer from the outer layer.  People in the organization must become a layer of security, a human firewall that protects the information from unauthorized access and use
  - Information security is designed and implemented in three layers: policies, people (education, training and awareness programs) and technology, commonly referred to as PPT
3. Discuss the concept of levels of controls.
  - Information security safeguards provide three levels of control: managerial, operational and technical
  - Managerial controls are security processes that are designed by strategic planners and implemented by the security administration of the organization.  Management controls set the direction and scope of the security process and they provide detailed instructions for its conduct, while addressing the design and implementation of the security planning process and security program management
  - Operational controls are management and lower-level planning functions that deal with the operational functionality of security in the organization, such as disaster recovery and incident response planning. Operational controls also address personnel security, physical security and the protection of production inputs and outputs
  - Technical controls are the tactical and technical implementations of security in the organization.  Technical controls are the components put in place to protect an organization’s information assets
4. Explain the concept of defense in depth.
  - One of the basic tenets of security architectures is the layered implementation of security
  - To achieve defense in depth, an organization must establish multiple layers of security controls and safeguards, which can be organized into policy, training and education and technology
  - While policy itself may not prevent attacks, it certainly prepares the organization to handle them and coupled with other layers, it can deter attacks
  - Implementing multiple types of technology and thereby preventing the failure of one system from compromising the security of information is referred to as redundancy
5. Describe the security perimeter.
  - A security perimeter defines the boundary between the outer limit of an organization’s security and the beginning of the outside world.  It is the level of security that protects all internal systems from outside threats
  - Unfortunately, the perimeter does not protect against internal attacks from employee threats or on-site physical threats
  - Within security perimeters, the organization can establish security domains or areas of trust within which users can freely communicate
6. Discuss firewalls.
  - A firewall is a device that selectively discriminates against information flowing into or out of the organization.  Firewalls are usually placed on the security perimeter, just behind or as part of a gateway router
7. Firewalls can be packet filtering, stateful packet filtering, proxy or application level.  A firewall can be a single device or a firewall subnet, which consists of multiple firewalls creating a buffer between the outside and inside networks.
8. Describe DMZs.
  - A buffer against outside attacks is frequently referred to as a demilitarized zone (DMZ).  The DMZ is a no-man’s-land between the inside and outside networks
9. Explain Proxy Servers
  - A proxy server, or proxy firewall, performs actions on behalf of another system
  - The proxy server may be hardened and become a bastion host placed in the public area of the network, or it might be placed within the firewall subnet or the DMZ for added protection
  - For more frequently accessed Web Pages, proxy servers can cache or temporarily store the Page and thus they are sometimes called cache servers
10. Discuss intrusion detection systems (IDSs)
  - To detect unauthorized activity within the inner network or on individual machines, an organization can implement intrusion detection systems (IDSs).  IDSs come in two versions, with hybrids possible
  - Host-based IDSs are usually installed on the machines they protect to monitor the status of various files stored on those machines.  Network-based IDSs look at patterns of network traffic and attempt to detect unusual activity based on previous baselines
  - IDSs can be used together for the maximum level of security for a particular network and set of systems