Summary: Defense In Depth

DEFENSE IN DEPTH

Defense-in-depth involves using multiple layers of controls to avoid having a single point of failure. Computer security involves using a combination of firewalls, passwords, and other preventive procedures to restrict access. Redundancy also applies to detective and corrective controls.

Major types of preventive controls used for defense in depth include:

 Authentication controls to identify the person or device attempting access.

 Authorization controls to restrict access to authorized users. These controls are implemented with an access control matrix and compatibility tests.

 Training to teach employees why security measures are important and teach them to use safe computing practices.

 Physical access controls to protect entry points to

the building, to rooms housing computer equipment, to wiring, and to devices such as laptops, cell phones, and PDAs.
 Remote access controls include routers, firewalls, and intrusion prevention systems to prevent unauthorized access from remote locations.

A border router connects the IS to the Internet.

Behind the router is the main firewall.

It works with the border router to filter information trying to enter or leave the organization.

Data is transmitted over the Internet in packets through a protocol called TCP/IP. A set of rules called an access control list (ACL) determines which packets are allowed in and which are dropped. Stateful packet filtering examines the header of each packet in isolation. Deep packet filtering examines the data in the body of a packet to provide more effective access control. Deep packet filtering is the heart of a new type of filter called intrusion prevention systems.

Internal firewalls can be used to segment different departments within an organization.

Web servers and email servers are placed in a separate network outside the corporate network referred to as the demilitarized zone.

Special attention must be paid to use of rogue modems by employees. Wireless access and dial-up modems require special security procedures.

Host and application hardening procedures involve the use of supplemental preventive controls on workstations, servers, printers, and other devices. Special attention should be paid to host configuration, user accounts, and software

design.

Encryption provides the final barrier. It involves transforming normal text, called plaintext, into unreadable gibberish, called cipher text. Decryption reverses the process.

The factors that determine the strength of an encryption system are the length of the key, key management policies, and the nature of the encryption algorithm.

There are both symmetric and asymmetric encryption systems. Symmetric systems use the same key to encrypt and decrypt. Asymmetric systems use both a public and a private key. E-business uses symmetric encryption to encode most data, since it is faster, and uses asymmetric encryption to safely send the symmetric key to the recipient.

Hashing transforms plaintext into a short code called a hash.

 A digital signature is a hashed document that has been encrypted with the sender’s private key.
 A digital certificate certifies the owner of a particular public key.
 An organization that issues public and private keys and records the public key in a digital certificate is a certificate authority.
 Preventive controls are never 100% effective, so organizations implement controls to enhance security by monitoring the effectiveness of preventive controls and detecting incidents in which they have been circumvented. Detective controls include:
 Log analysisthe process of examining logs which record who accesses the system and the actions they take.
 Intrusion detection systems (IDS) automate the monitoring of logs of network traffic permitted to pass the firewall. The most common analysis is to compare the logs to a database containing patterns of known attacks.
 Managerial reports can be created to disclose the organization’s performance with respect to the COBIT objectives. Key performance indicators include downtime caused by security incidents, number of systems with IDS installed, and the time needed to react to security incidents once they are reported.
 Security testing includes
 Vulnerability scans, which use automated tools designed to identify whether a system contains any well-known vulnerabilities.
 Penetration testing which involves an authorized attempt by either an internal audit team or external security consulting firm to break into the organization’s IS.

Corrective controls include the following:
A computer emergency response teams (CERT), consisting of technical specialists and senior operations management, to deal with major incidents. The CERT leads the organization’s incident response process through four steps, which must be practiced regularly:

 Recognizing that a problem exists.
 Containing the problem.
 Recovery.
 Follow up.