AIS 5136 - INFORMATION SECURITY AND MANAGEMENT

Chapter 5: Identity and Access Management user-defined groups.

Part 2 ○ can be used to explicitly deny access
to a particular individual or group
5.1 Authorization Issues - Introduction ○ access can be at the discretion of the
● Authorization process used for access control policy maker (and implemented by the
requires that the system be able to identify security administrator) or individual
and differentiate among users. user, depending upon how the
● Access rules (authorization) specify who can controls are technically implemented
access what. ● When users changes job roles within an
➢ Example: Access control based on organization, often their old access rights are
least privilege, not removed before adding their new required
● Access should be on a documented accesses.
need-to-know and need-to-do basis by type ➢ Without removing the old access
of access. rights, there could be a potential SoD
● When IS auditors review computer issue.
accessibility, they need to know what can be
done with the access and what is restricted. Logical Access Security Administration
● Access restrictions at the file level generally ● In a client-server environment, the access I&A
include the following: and authorization process can be
a. Read, inquire, or copy only administered either through a centralized or
b. Write, create, update, or delete only decentralized environment.
c. Execute only ● Advantages of decentralized environment are:
d. A combination of the above ○ The security administration is onsite at
● Least dangerous type of access: read only, as the distributed location.
long as the information being accessed is not ○ Security issues are resolved in a
sensitive or confidential. timely manner.
➢ This is because the user cannot alter ○ Security controls are monitored on a
or use the computerized file beyond more frequent basis.
basic viewing or printing.
● Risks of decentralized environment:
Access Control List ○ Local standards might be
● Access authorization tables, also referred to implemented rather than those
as access control lists (ACLs): used to provide required by the organization.
security for the fule and facilities listed ○ Levels of security management might
previously. be below what can be maintained by
● ACLs refer to a register of: a central administration.
○ Users (s (including groups, machines ○ Management checks and audits that
and processes) who have permission are often provided by central
to use a particular system resource. administration to ensure that
○ The types of access permitted. standards are maintained might be
● ACLs vary in capability and flexibility. unavailable.
➢ Some only allow specifications for
certain preset groups (e.g., owner, ● Controls for remote and distributed sites
group and world), (decentralized):
● Advanced ACLs: ○ Software controls over access to the
○ allow much more flexibility, such as computer, data files and remote
 access to the network should be functionality that exists within their office.
implemented. ➢ In doing so, the remote access design
○ The physical control environment uses the same network standards and
should be as secure as possible, with protocols applicable to the systems
additions, such as lockable terminals that they are accessing.
and a locked computer room.
○ Access from remote locations via Common Connectivity Methods for Remote
modems and laptops to other Access
microcomputers should be controlled ● TCP/IP Internet-based remote access: a
appropriately. cost-effective approach that enables
○ Opportunities for unauthorized people organizations to take advantage of the public
to gain knowledge of the system network infrastructures and connectivity
should be limited by implementing options available, under which Internet service
controls over access to system providers (ISPs) manage modems and dial-in
documentation and manuals. servers
○ Controls should exist for data ➢ Internet service providers (ISPs) -
transmitted from remote locations, manage modems and dial-in servers
such as sales in one location that ➢ DSL and cable modems - reduce
update accounts receivable files at costs further to an organization
another location. ● Virtual private network (VPN): used to
➢ The sending location should communicate securely data packets over the
transmit control information, internet
such as transaction control ● Advantages of VPNs:
totals, to enable the receiving a. ubiquity
location to verify the update b. ease of use
of its files. c. inexpensive connectivity
➢ When practical, central d. read, inquiry or copy only access
monitoring should ensure that ● Disadvantages of VPNs:
all remotely processed data a. less reliable
have been received b. no central authority,
completely and updated c. difficult to troubleshoot
accurately. ● Use of VPNs can create holes in security
○ When replicated files exist at multiple infrastructure
locations, controls should ensure that ● Preventive controls: Intrusion detection
all files used are correct and current systems (IDS) and virus scanners
and, when data are used to produce ● Good practice: terminate all VPNs to the same
financial information, that no endpoint
duplication arises. ● Less common method: use of dial-up lines
(modem asynchronous point-to-point or
Remote Access Security integrated services digital network- ISDN)
● Remote access connectivity to their ● Most common protocol: Remote Access
information resources is required for many Dial-in User Service (RADIUS) and Terminal
organizations for different types of users, such Access Controller Access ControlSystem
as employees, vendors, consultants, business (TACACS)
partners and customer representatives ● Good security practice: terminate call AFTER
● Remote access users can connect to their recording the number.
organization’s networks with the same level of ● Standard security practice: NAS to initiate a
 call back ○ Proper authorizations
● Remote access server (RAS): server whose ○ Identification and authentication
OS is set-up to accept remote access; dial-up mechanisms
connectivity not based on centralized control; ○ Encryption tools and techniques
not recommended ➢ such as use of a VPN
● Dedicated network connections: use private ○ System and network management
network circuits;considered safest; used by
branch/regional offices 5.2 Audit Logging in Monitoring System
● Advantages of dedicated network Access
connections include Audit Logging and Monitoring System Access -
a. greater performance gains in data Introduction
throughput and ● Security Features of access control software:
b. reliability, and enable a security administrator to automatically
c. data on a dedicated link belonging to log and report all levels of access attempts—
the subscribing organization, where successes and failures alike
an intruder would have to ➔ Applied by most access control
compromise the telecommunications software
provider itself to access the data link. ➢ Example: access control software can
● Disadvantages of dedicated network log computer activity initiated through a
connection logon ID or computer terminal
○ cost is typically two- to five-times ● Provides an Audit trail: to monitor activities of
higher than connections to the suspicious nature, such as a hacker attempting
Internet brute force attacks on a privileged logon ID
● Remote access risk includes the following: ● Keystroke logging: can be turned on for users
a. Denial of service (DoS) - remote who have sensitive access privileges
users may not be able to gain access ➔ What is logged is determined by the
to data or applications that are vital action of the organization.
for them to carry out their day-to-day ● Issues:
business 1) What is logged?,
b. Malicious third parties - these may 2) Who has access to logs?, and
gain access to critical applications or 3) How long logs are retained?
sensitive data by exploiting (recors-retention item)
weaknesses in communications
software and network protocols Audit Logging and Monitoring System Access –
c. Misconfigured communications Access Rights to System Logs
software - may result in unauthorized ● Access rights to system logs for security
access or modification of an administrators to perform the previous
organization’s information resources activities should be strictly controlled
d. Misconfigured devices on the ● Who should have access to system logs?
corporate computing infrastructure ➢ Computer security managers and
e. Host systems that are not secured system administrators/managers
appropriately - can be exploited by should have access for review
an intruder gaining access remotely purposes;
f. Physical security issues - over ➢ Security and/or administration
remote users’ computers. personnel who maintain logical
● Remote access controls include the following: access functions may not need to
○ Policy and standards access audit logs
● It is particularly important to ensure the Audit Logging and Monitoring System Access –
integrity of audit trail data against Tools for Audit Trail (Logs) Analysis
modification. ● Purpose of the tools developed:
○ Use of digital signatures, write-once - to help reduce the amount of
devices, security information and information contained in audit records
event management (SIEM) system and
● Audit trail files/records should be protected: - to delineate useful information from
➔ Why? Intruders may try to cover their the raw data
tracks by modifying audit trail records ● Audit trail software: on most system, audit trail
➔ How? By strong access controls to software can create large files, which can be
help prevent authorized access extremely difficult to analyze manually
● Integrity of audit trail information may be ● Use of automated tools: likely to be the
particularly important when legal issues arise difference between unused audit trail data and
- Use of audit trails as legal evidence an effective review
➢ require daily printing and ● Types of tools:
signing of the logs a) Audit reduction tools:
- Questions regarding such legal issues - Reduce volume of audit trail:
should be directed to the appropriate They are preprocessors
legal counsel. designed to reduce the volume
● Confidentiality of audit trail information may of audit records to facilitate
be protected if the audit trail is recording manual review.
information about users that may be - Remove records of little
disclosuresensitive, such as transaction data significance: this is before a
containing personal information security review; may cut in half
➢ before and after records of the number of records in the
modification to income tax data audit trail
● Media logging is used for accountability - Remove records generated by
➔ Logs with control numbers or other specified classes of events:
tracking data, such as: these may be records
1. the times and dates of generated by nightly backups
transfers, b) Trend/variance-detection tools
2. names and signatures of - Look for anomalies s in user
individuals involved, and or system behavior
3. other relevant information - More sophisticated
➔ Conduct periodic spot checks or processors that monitor
audits to determine usage and detect variations
a. no controlled items have been can be constructed
lost and ➢ Example: If a user typically
b. all are in the custody of logs in at 09:00 but appears
individuals named in control at 04:30 one morning, this
logs may indicate a security
➔ Use of automated media tracking problem that may need to be
systems are helpful in maintaining investigated
inventories of tape and disk libraries c) Attack-signature-detection tools
- Look for an attack signature,
which is a specific sequence
 of events indicative of an ➔ More complex tools, such as SIEM
unauthorized access attempt systems, will be more expensive both
➢ Example: repeated failed to purchase and to implement
logon attempts ● Final cost of audit trails: cost of investigating
d) Security information and event unexpected events and anomalous events
management (SIEM) systems: ➔ If the system is identifying too many
- Capture audit trails/ logs and events as suspicious, administrators
perform real-time analysis may spend undue time reconstructing
- Can be configured to perform events and questioning personnel.
automated tasks based upon ● Frequency of review of reports = Sensitivity of
the alerts the computerized information being protected
➢ Example: launching a ➔ The more sensitive, the more
vulnerability scan or frequency
commanding the ● IS auditor: ensure that the logs cannot be
firewall to close a tampered with, or altered, without leaving an
certain port audit trail
● When reviewing or performing security access
Audit Logging and Monitoring System Access – follow-up, the IS auditor should look for:
Cost Considerations ○ Patterns or trends that indicate abuse
● Audit trails involve many costs that factor into of access privileges,
IT’s determination as to how much logging is ➢ example: concentration on a
enough sensitive application
● System overhead is incurred while recording ○ Violations (such as attempting
the audit trail computer file access that is not
➢ Additional system overhead will be authorized) and/or use of incorrect
incurred to store and process the passwords
records. ● Actions when a violation is identified:
➢ The more detailed the records, the 1. Refer problem to security
more overhead is required. administrator for investigation
● In some systems, logging every event could ➔ The person who identified the
cause the system to lock up or slow to the violator should refer the
point at which response time would be problem
measured in minutes. 2. Investigate and determine severity of
➔ this is not acceptable if IT is properly the violation
aligned with the needs of the business ➔ The security administrator and
● Another cost consists of human and machine responsible management
time to perform the analysis; should work together
➔ can be minimized by using tools to ➔ Generally, most violations are
perform most of the analysis accidental.
➔ Use of simple analyzers can be 3. Notify executive management, not the
constructed quickly and inexpensively law enforcement officials, if violation
from system utilities, but they are attempt is serious
limited to audit reduction and the ➔ Executive management
identification of particularly sensitive normally is responsible for
events notifying law enforcement
officials.
 ➔ Involvement of external resource (data set or file) and at what level
agencies may result in (read or update)
adverse publicity that is ● The access control mechanism applies these
ultimately more damaging rules whenever a user attempts to access or
than the original violation; use a protected resource
therefore, the decision to ● Access control naming conventions:
involve external agencies ➔ Are structures to govern user access
should be left to executive to the system and user authority to
management. access or use computer resources,
4. Set-up procedures to manage public such as:
relations and the press
a) Files
5. Provide written guidelines to identify
b) Programs
types and levels of violations, and
how these will be addressed c) terminals
➔ To facilitate proper handling of ➔ Are required in a computer
access violations environment to establish & maintain
➔ This effectively provides personal accountability and SOD in
direction for judging the the access of data
seriousness of a violation. ➔ Are set-up by the owners (with the
6. Apply consistent disciplinary action help of the security officer) of the
➔ Must be a formal process
data or application
that is applied consistently
➔ Naming conventions should promote
➔ This may involve a
the implementation of efficient
- Reprimand - to
access rules and simplify security
criticize adversely or
formally (admonish) administration
- probation or ● The NEED of Sophisticated naming
- immediate conventions over access controls: depend
termination. on importance and level of security needed
➔ The procedures should be to ensure that unauthorized access has not
legally and ethically sound to been granted
reduce the risk of legal action ● Naming conventions for system resources:
against the company. pre-requisite for efficient
7. Include in the corrective measures the implementation/administration of security
review of access rules controls
➔ not only for the perpetrator
but for interested parties Example system resources:
➔ Excessive or inappropriate
access rules should be 1) Data sets
eliminated. 2) Volumes
3) Programs
5.3 Naming Conventions for Logical Access 4) Employee Workstations
Controls
● Structure of naming conventions: resources
● Access capabilities: are implemented by the
beginning with same high-level qualifier can
security administration in a set of access
be governed by one or more generic rule(s)
rules which stipulate which users/group of
➔ This reduces the number of rules
users are authorized to access what
 required to adequately protect monitoring mechanisms to ensure
resources which in turn, protect unauthorized access are prevented or
security administration and detected or corrected.
maintenance efforts

5.4 Federated Identity Management 5.5 Auditing Logical Access

Federated Identity Management (FIM) ● Obtain a general understanding of security

● Definition: arrangement for multiple risk facing information processing through:
enterprises; to use common identification data
a) Review of relevant documentation
of users; to provide access
➢ AKA Identity Federation b) Inquiry
● A corporate entity may initiate such federation c) Observation
for group enterprises within corporate control d) Risk Assessment and Evaluation
● Main objective: make access easy for users Techniques
● Identify federation: links user’s identity
across multiple security domains, each ● Document and evaluate controls over
supporting its own identity management access paths over potential access paths, to
system assess their:
● Two federated domains: a user
authenticated in its home domain can access 1) Adequacy
resources in the other domains without 2) Efficiency
separate login process 3) Effectiveness by/how:
● Advantages of identity federation: economic
advantage and convenience
➔ Reviewing appropriate hardware,
➢ For example: multiple corporations
software, and security features
can share a single application,
➔ Identifying any deficiencies or
resulting in cost-savings and
redundancies
consolidation of resources.
● Test the controls over access paths to
● Effective FIM: the partners must have a
determine whether they’re functioning &
presence of mutual trust, generally
effective by applying appropriate audit
established through contracts and secured
channel for message transmission techniques
➢ Partnering organizations policies: ● Evaluate access control environment to
must adhere to security requirements determine if the control objectives are
of members, which can sometimes be achieved by analyzing test results and other
complicated due to different security audit evidence
requirements and rules set by each
enterprise.
● Evaluate the security environment to assess
➔ When an organization is a
its adequacy by:
member of multiple federations,
the process of ensuring 1. Reviewing written policies
accuracy of policies can be
2. Observing practices and procedures
time-consuming, costly and
and comparing with appropriate
complex.
practices, standards, or procedures
● IS auditor: should review the need for identity
used by the organization
federation; should review policies and
Auditing Logical Access — FAMILIARIZATION the unnecessary services such as:
1. Those connected with remote
WITH THE IT ENVIRONMENT
procedure calls
● First step of the audit
2. Sending emails
● Obtaining a clear understanding of technical,
3. Network management & library
managerial and security environment of the IS
routines
processing facility
● Common activities: interviews, physical • Parameter settings and configuration
walkthrouqhs, documentation reviews, of PC OS should be investigated; ports
assessing of risks not used must be closed

Auditing Logical Access — ASSESSING AND 2) Second

DOCUMENTING THE ACCESS PATHS • One or more servers on which the

● Access path: logical route an end-user takes application to be used/invoked
to access computerized information
➔ Similar to the OS of the PC in the
● Starts with terminal/workstation and ends
previous sequence
with data being processed/accessed ● Server OS must be patched
➔ Numerous hardware & software are according to the suggestions of the
encountered supplier of the OS
● IS auditor: should evaluate hardware and • Virus defense should be updated;
software components for implementation and Outdated OS version and virus
physical & logical access security defenses can be exploited by attackers
● Special considerations should be given to: • Server OS should be hardened
a) Origination and authorization of data deleting the unnecessary services such
b) Validity and correctness of input data as:
c) Maintenance of affected OSs (attaching, 1. Those connected with remote
hardening, and closing the procedure calls
unnecessarily open ports) 2. Sending emails
3. Network management &
SEQUENCE OF COMPONENTS
library routines
1) First • Parameter settings and configuration
• End user signs to PC which is part of of server OS should be investigated;
the LAN; ports not used must be closed
➔ physically secure PC
➔ restrict logon ID/password
used for the sign-on 3) Third
• PC OS must be patched according to ● Telecommunications software/LAN
the suggestions of the supplier of the server/Terminal emulator (if
OS connected to a mainframe) intercepts
● Malware defense should be updated the logon to direct it to the proper
● Outdated OS version and virus telecommunication link
defenses can be exploited by ○ The telecommunication
attackers software can restrict the
● PC OS should be hardened, deleting specific data or application
 software b) access to data dictionary is
restricted to the DB Administrator

● Key audit issue: to ensure all applications c) all data elements are subject to
have been identified/defined within the the logical access control
software, and optional telecommunication ● the application now can be
control and processing features used are accessed in this sequence
appropriate and approved by management
7) Seventh
● Analysis here needs the aid of a system • The access control software may
software analyst wrap logical access security around all
of the above components
4) Fourth - Done via internal security tables
● Transaction processing software may • Audit issues: ensure that-
be the next component in the access a) all the above or previous
path components are defined to
● Transaction processing software the access control software,
routes transactions to the proper providing access rules that
define who can access what
application software
on a need-to-know basis
● Key audit issues: ensure appropriate
b) security table access is
identification/authentication (log-on
restricted to the security
ID & password) and authorization of
administrator
the user to gain access to the
NOTE:
application
• Discipline is needed in developing
● Analysis here is by reviewing internal
application systems
tables that reside in the transaction
processing software or to a separate • IS auditor:
security software (access restricted ● Should evaluate the control
to security administrator) objectives referring to the origination
and authentication of the application
5) Fifth data
● Should evaluate the control measures
● Application software is encountered used in data input and processing
and processes transactions ● What is the effect of omitting control
according to the program logic objectives and measures?
● Audit issue: restrict access to ○ Makes the application
production software library to ONLY vulnerable to attacks either
from within or without
the implementation coordinator
(especially from the Internet)
6) Sixth
● Firewalls do not protect applications
● DBMS directs access to computerized against the types of attacks that come
Information from the HTTP (hypertext transfer protocol)
communication, that is usually permitted
● Audit issues: ensure that-
on applications
a) all data elements are identified in
○ HTTP: this is the protocol, standard,
the data dictionary
 rule, or guideline used to transfer data confidentiality
over the web. It is part of the internet
protocol suite that defines the
commands and services used for
Auditing Logical Access — REVIEWING
transmitting webpage data
REPORTS FROM ACCESS CONTROL
SOFTWARE
● Do firewalls protect, in this case

Auditing Logical Access — INTERVIEWING

● Reporting features: provide security
SYSTEM PERSONNEL
administrator and used for the opportunity
● Technical experts: required; to control and
to monitor adherence to security policies
maintain access path components, as well as
● Purpose of reviewing sample security
the OS and computer mainframe;
○ These people can be a valuable reports: to determine if-
source of information to the IS ○ Information is enough to support
Auditor when gaining an investigation
understanding of security ○ Security administrator is doing an
effective review
● Determination of Technical experts: IS auditor
should meet with IS manager and review org. Unsuccessful attempts
charts and job descriptions ● Should be reported
● Key people: security administrator, network ● Should identify relevant information about
control manager, systems software manager the access attempt, such as:
(focus on interviewing them) a) Time
○ Security administrator should be b) Terminal
asked on his duties, responsibilities &
c) Log -on
function of his position
d) The file or data element
○ If answers are not sufficient or do not
support sound control practices or do
not adhere to the written job Auditing Logical Access — REVIEWING
description, IS auditor should APPLICATIONS SYSTEMS OPERATIONS
compensate by expanding the scope MANUAL
by testing access controls
● In addition, the IS auditor should determine • Application systems manual:
the security administrator’s: ➔ Should contain documentation on
○ Awareness of the logical accesses to programs generally used in a data
be protected processing installation to support the;
○ Motivation and means to monitor 1) Development
logons to account employee 2) Implementation
changes 3) Operations
○ Knowledge in maintaining and
4) Use of application systems
monitoring access
➔ Should include information on the
• A sample End users should be interviewed
platform where the application can run
to assess their awareness of management
on, DBMSs, compilers, interpreters,
policies regarding logical security and
telecommunication monitors, and other
 applications 3) Monitor and control the movement of
sensitive information on end-user
5.6 Data Leakage Data Leak Prevention systems
Data Leakage ● The objectives are associated with the
● Involves siphoning or leaking information out following primary states of information:
of the computer (e.g. dumping files to paper 1) Data at rest
or stealing computer reports and tapes). 2) Data in motion
➔ Leaves the original copy, which may go 3) Data in use
➔ Each state is addressed by a
undetected
specific set of technologies
➔ Involves the unauthorized transfer of
provided by DLP solutions
sensitive or proprietary information from
an internal network
- DATA AT REST:
● Ways of data leakage include the following:
● A basic function of DLP solutions is
➢ Peer-to-peer (P2P) networks,
the ability to identify and log where
➢ Instant message (IM),
specific types of information are
➢ Social media,
stored throughout the enterprise.
➢ Email,
● Most DLP systems use crawlers,
➢ Cloud storage, and
which are applications that are
➢ File sharing solutions
deployed remotely to log onto each
● Common controls to prevent data leakage:
end system and “crawl” through data
1) Identifying assets,
stores, searching for and logging the
2) Classifying assets, and
location of specific information sets.
3) Information security management
system (ISMS), including policies and
- DATA IN MOTION:
procedures
● DLP solutions use specific network
● Data leakage may:
appliances or embedded technology
- create risk to enterprises, their
to selectively capture and analyze
customers and business partners, and
network traffic.
- negatively impact an enterprise’s
● To inspect information being sent
reputation, compliance, competitive
across the network, the DLP solution
advantage and finances
must be able to:
● Data leak prevention/protection (DLP)
a) Passively monitor the network
solutions: arose due to the need to better
traffic,
control and protect sensitive information.
b) Recognize the correct data
These vary in capabilities and methodologies.
streams to capture,
c) Assemble the collected
Data Leak Prevention
packets (of information),
● Definition: A suite of technologies and
d) Reconstruct the files carried
associated processes that locate, monitor and
in the data stream, and
protect sensitive information from
e) Perform the same analysis
unauthorized disclosure.
done on the data at rest
● Has three key objectives, namely:
● At the core of this ability is a process
1) Locate and catalog sensitive
known as deep packet inspection
information stored in the enterprise
(DPI).
2) Monitor and control the movement of
➔ DPI goes beyond the basic
sensitive information across enterprise
header information and reads
networks
 data contents within the management system to route specific
packet’s payload incidents to the appropriate parties.
➔ If sensitive data are detected, - Backup and Restore:
DLP solution has the capability ● Allows for preservation of policies and
to alert and optionally block the other configuration settings.
data flows in real or near real - Reporting:
time ● May be internal or may leverage
➔ Based on the rule set, the external reporting tools.
solution may also quarantine or
encrypt the data in question. DLP Risks, Limitations, and Considerations
- Improperly Tuned Network DLP Modules:
- DATA IN USE (ENDPOINT): ● Proper tuning and testing of the DLP
● Refers to monitoring data movement system should occur before enabling
stemming from actions taken by end actual blocking of content.
users on their workstations. ● Monitor-only mode allows for tuning
● DLP solutions typically accomplish and provides the opportunity to alert
this through the use of a software users to out-of-compliance processes
program known as an agent, which is and activities.
ideally controlled by the same central ● Involving the appropriate business
management capabilities of the and IT stakeholders in the planning
overall DLP solution. and monitoring stages helps to ensure
that disruptions to processes will be
A full DLP solution should have the capability to anticipated and mitigated.
address the three states of information and be ● A means of accessibility must be
integrated by a centralized management function. established when there is critical
➔ The range of services varies but many DLP content being blocked during
solutions have functions in common. off-hours when the team is
unavailable.
Common Functions of (DLP) Solutions - Excessive Reporting and False Positives:
- Policy Creation and Management: ● DLP solutions may register significant
● Policies (rule sets): dictate the actions amounts of false positives, which
taken by various DLP components. overwhelm staff and can obscure
● Most DLP solutions come with valid hits.
preconfigured policies that map to ● Avoid excessive use of template
common regulations; these policies patterns or black box solutions that
should be able to be customized allow for little customization.
● Policies should be built upon the ● The greatest feature of a DLP solution
asset management and data is the ability to customize rules or
classifications exercises. templates.
- Directory Services Integration: ● The system should be rolled out in
● This allows the DLP console to map a phases, focusing on the highest risk
network to address to a named end areas first.
user. - Encryption:
- Workflow Management: ● DLP solutions can only inspect
● Most DLP solutions provide the encrypted information that they can
capacity to configure incident first decrypt. As such, there is a need
handling, which allows the central to use the appropriate decryption
 keys. Controls over the communication network:
● Files cannot be analyzed if keys to 1. Network control functions performed by
personal encryption packages are not individuals with sufficient training and
managed by the enterprise and not experience.
provided to the DLP solution. 2. Network control functions separated; duties
● Ways to mitigate this risk include: should be rotated on a regular basis
a) forbid the installation and use 3. Network control software restricts operator
of encryption solutions that access for certain functions.
are not centrally managed, ➢ (e.g., the ability to amend or delete
b) users should be educated operator activity logs)
that anything that cannot be 4. Network control software should maintain an
decrypted for inspection will audit trail of all operator activities .
ultimately be blocked 5. Audit trails reviewed periodically by operations
- Graphics: management to detect any unauthorized
● DLP solutions cannot intelligently network operations activities.
interpret graphics files. 6. Network operation standards and protocols
● This includes sensitive information documented, available, and reviewed
scanned into a graphics file or periodically to ensure compliance.
intellectual property that exists in a 7. Network access by systems engineers
graphics format. monitored and reviewed closely to detect
● As such, enterprises should develop unauthorized access to the network.
strong policies that govern the use 8. Analysis should be performed to ensure:
and dissemination of this information. - workload balance
● Although DLP solutions cannot - fast response time
intelligently read contents of a - system efficiency
graphics file, they can identify specific 9. Terminal identification file should be
file types, their source, and maintained by the communications software
destination. to check the authentication of a terminal when
➔ This capability can flag it tries to send or receive messages.
uncharacteristic movement of 10. Data encryption should be used, where
this type of information and appropriate, to protect messages from
provide some level of control. disclosure during transmission..
11. Remote printing facilities restricted. to ensure
Chapter 6: Network Infrastructure Security sensitive documents cannot be read by
unauthorized personnel.
6.1 & 6.2: Introduction and Client-Server 12. Device hardening thru keeping devices up to
Security date. That means upgrading the firmware,
patching and updated to fix any security gaps.
INTRODUCTION
● Communication networks: include devices ● To improve the control and maintenance of
connected to network; control thru network the infrastructure and its use, besides the
control terminal and specialized direct management of the network devices,
communications software. consolidate logs of devices with firewall logs
➔ Control is done thru network control and client server OS’s logs (detective control)
terminal and specialized ● Fiber channel connections: basis of
communications software management of large capacity storage units
 ● Dynamic inventory of devices: improves - OS
systems security. - Database
- In the case of an incident, it is - Middleware
important to know which computer is ➢ Middleware is a software layer
used by whom. situated between applications
● Ability to identify users at every step of and operating systems.
their activity: important security improvement ➢ Middleware is typically used in
- Some application packages used distributed systems where it
defined names (e.g., system); new simplifies software
monitoring tools have been developed development.
to resolve this problem ➢ Middleware is a software that
● Adopting IT governance practice: means to acts as an intermediary
comply with network security requirements between applications or
effectively. services to facilitate
- Some application packages use communication.
predefined names (e.g., SYSTEM). ● In a client-server environment, several access
New monitoring tools have been routes exist because application data may
developed to resolve this problem. exist on the server or on the client.
● Information Technology Infrastructure ● Access routes must be examined individually
Library (ITIL): framework for information and with each other to ensure no exposures
technology service management; can be used are left unchecked.
for setting up service level agreements (SLAs), ● Potential gaps among components:
specifically for enterprise network operations, additional risk to consider.
to maintain the uninterrupted operation of the - How do the components connect to
network through controls, incident handling each other?
and auditing.
● Example: two-tiered environment. (the thick
CLIENT-SERVER SECURITY client must connect to the database: it can
● Client server: network architecture where the achieved by:
computer/process is either a server (a source 1. every user has a database account
of services and data) or a client (a user of - in which case they may be
these services and data that relies on servers able to bypass the client
to obtain them). application (and hence the
● Client server architectures can be: application controls) and
- two tiered: includes the use of a thick connect directly to the
client database
- three-tiered: includes the use of 2. a proxy user (i.e., a single account
application servers and a thin client, that connects to the database on
probably a browser behalf of all others) is used.
- n-tiered: includes multiple - in which case the database
applications servers, middleware, etc password must be stored
● The security of a client-server environment is somewhere.
dependent on the security of its component - This may be stored securely
part. or unencrypted
● Components of client server environment: ● The IS auditor should ensure that:
- LAN - Application controls cannot be
- Client bypassed.
 - Passwords are always encrypted. IDS architectures
- Access to configuration or e) Remote access for coordinating and
initialization files be kept to a centrally controlling dial-up access
minimum. f) Incident handling and response for
- Access to configuration or detection, response, containment and
initialization files be audited. recovery
g) Configuration management for
6.3 Internet Security Controls controlling the security baseline when
● To establish effective Internet security changes do occur
controls, an organization must develop h) Encryption techniques applied to
controls within an information systems protect information assets
security framework from which Internet i) A common desktop environment to
security controls can be implemented and control what is displayed on a user’s
supported. desktop
➔ Establishing such a framework entails j) Monitoring Internet activities for
defining the rules the organization will unauthorized usage and notification to
follow to control Internet usage. end users of security incidents via
● One set of rules should address appropriate computer emergency response
use of Internet resources with rules that might team (CERT) bulletins or alerts
reserve Internet privileges for those with a ● Internet usage is drastically changing the way
business need. business is done and is creating opportunities
● Another set of rules should address the for organizations to compete in what has
classification of the sensitivity or criticality of become a global virtual market.
corporate information resources. ● Security, as it relates to the Internet, will have
➔ These will help determine what to be considered an enabler for success and
information will be available for use on treated as an essential business tool.
the Internet and the level of security to
be used for corporate resources of a
sensitive or critical nature on the
Internet.
● An organization will be able to develop 6.4 Firewall Security Systems
guidelines for defining levels of security
controls on confidentiality, integrity, and Firewall Security Systems - Introduction
availability of information resources on the ● Danger: Every time a corporation connects its
Internet. internal computer network to the Internet
● Supporting processes over these controls ➔ Because of the Internet’s openness,
should be defined, including the following: every corporate network connected to it
a) Risk assessments performed is vulnerable to attack.
periodically ➔ Hackers on the Internet could
b) Security awareness and training for theoretically break into the corporate
employees, tailored to their levels of network and do harm in a number of
responsibilities ways
c) Firewall standards and security to ● Firewalls:
develop and implement firewall ➔ Companies build firewalls: as one
architectures means of perimeter security of
d) Intrusion detection standards and network;
security to develop and implement
 ➔ Likewise, the same principle is ● Firewalls enable organizations to:
applicable as protection to sensitive or a) Block access to particular sites on the
critical systems that need to be Internet
protected from untrusted users inside b) Limit traffic on an organization’s public
the corporate network (internal services segment to relevant addresses
hackers) and ports
➔ Firewalls are defined as a device c) Prevent certain users from accessing
installed at the point where network certain servers or services
connecting enter a site d) Monitor communications and record
➔ they apply rules to control the type of communications between an internal
networking traffic flowing in and out and an external network
➔ Most commercial firewalls are built to e) Monitor and record all
handle the most commonly used communications between an internal
Internet protocols network and the outside world to
● For firewalls, to be effective investigate network penetrations or
- firewalls should allow individuals on detect internal subversion
the corporate network to access the f) Encrypt packets that are sent between
Internet different physical locations within an
- at the same time, stop hackers or organization by creating a VPN over the
others on the Internet from gaining Internet (i.e., IPSec, VPN tunnels)
access to the corporate network to ● Extended firewall capabilities: provide for
cause damage protection against viruses and attacks directed
● Deny-all philosophy: means that access to a to exploit known OS vulnerabilities
given resource will be denied unless a user
can provide a specific business reason or Firewall Security Systems – Firewall Types
need for access to the information resource. ● Firewall types/categories
➔ Generally, most organizations will follow 1) Packet filtering
this philosophy 2) Application firewall systems
● Accept-all philosophy: everyone is allowed 3) Stateful inspection
access unless someone can provide a reason
for denying access Firewall Security Systems – Firewall Types
➔ Converse of Deny-all philosophy 1) Packet Filtering Firewalls
➔ Not widely accepted ● Packet filtering-based firewalls: simplest and
earliest kinds of firewalls (i.e., first generation
Firewall Security Systems – Firewall General of firewalls)
Features ➔ deployed between the private network
● Firewall Features: and the Internet
- Hardware and software combinations ● Screening router examines the header of
- Built using routers, servers and every packet of data traveling between the
different software Internet and the corporate network
- Separate networks from each other ● Information content of packet headers:
and screen the traffic between them - includes the IP address of the sender
- control the most vulnerable point and receiver and the authorized port
between a corporate network and the numbers (application or service)
Internet allowed to use the information
- Simple or complex, as the corporate transmitted
security policy demands
 ➔ Based on that information, the ➔ allows for penetration of the
router knows what kind of system perimeter
Internet service, such as - Spoofing user internal IP address: the
web-based or FTP, is being firewall can be configured to drop the
used to send the data as well packet on the basis of packet flow
as the identities of the sender direction analysis.
and receiver of the data. - Spoofing using secure or trusted
➔ Using that information, the external IP address: firewall
router can prevent certain architecture is defenseless
packets from being sent b) Source routing specification
between the Internet and the - Possibility to define route of IP packet
corporate network. must take when it traverses from the
- Example: The router could block any source host to the destination host,
traffic except for email or traffic to and across the Internet
from suspicious destinations. ➔ bypass the firewall;
● Advantages: simplicity and generally stable ➔ can be done by those with
performance as the filtering rules are performed knowledge of the IP address,
at the network layer subnet mask, default gateway
● Disadvantage: Its simplicity is also a settings at the firewall routing
disadvantage, because it is vulnerable to station
attacks from improperly configured filters and - Defense: examine and drop the
attacks tunneled over permitted services. packet, if source routing specification
● Potential for attack: determined by the total is enabled , drop that packet;
number of hosts and services to which the ➔ However, if the topology
packet filtering router permits traffic permits a route, skipping the
➔ Because the direct exchange of choke point, this
packets is permitted between outside countermeasure will not be
systems and inside systems effective
● Effect of compromising a single packet - Subnetting: is a strategy used to
filtering router: every system on the private partition a single physical network into
network may be compromised and more than one, smaller subnetworks
organizations with many routers may face or subnets
difficulties in designing, coding and maintaining ➔ An IP address includes a
the rule base. network segment and a host
● Each host directly accessible from the Internet segment
needs to support sophisticated user ➔ Subnets are designed by
authentication and needs to be regularly accepting bits from the IP
examined address’ host part, and using
these bits to assign a smaller
● Common attacks against packet filter subnet/ subnetwork inside the
firewalls original network
a) IP spoofing ➔ Helps to reduce the network
- Attacker fakes the IP address of traffic and conceals network
network host (internal or trusted) so complexity
that the packet being sent will pass - Subnet Mask: a 32-bit number used
the rule base of the firewall to differentiate the network
component of an IP address, by
 dividing the IP address into a network ● Work at the application level of the OSI (Open
address and the host address Systems Interconnection) model
➔ Aka address mask ● Application-level gateway firewall: analyzes
➔ Used to design subnetworks/ packets through set of proxies—one for each
subnets that connect local service
networks ➔ e.g., HTTP proxy for web traffic, FTP
c) Miniature fragment attack proxy
- an attacker fragments the IP packet ➔ Hypertext Transfer Protocol (HTTP)
into smaller ones and pushes it proxy: known as a web application
through the firewall firewall (WAF). This applies rules to
➔ in the hope that only the first HTTP conversations that cover known
of the sequence of attacks, such as cross-site scripting
fragmented packets would be (XSS) and Structured Query Language
examined and the others (SQL) injection. This kind of work could
would pass without review reduce network performance.
➔ true if the default setting is to ➔ Circuit-level firewalls: are more
pass residual packets efficient and also operate at the
- Countered: by configuring the firewall application level—where TCP and User
to drop all packets where IP Datagram Protocol (UDP) sessions are
fragmentation is enabled validated, typically through a single,
general-purpose proxy before opening
2) Application Firewall Systems a connection. Commercially,
● Two types circuit-level firewalls are quite rare.
➔ application-level firewall systems ● OSI Model: a conceptual model created by
➔ circuit-level firewall systems the International Organization for
● Provides greater protection than packet Standardization (ISO) which enables diverse
filtering routers communication systems to communicate
➔ Packet filtering routers allow the direct using standard protocols
flow of packets between internal and ➔ Using plain English, the OSI provides
external systems. a standard for different computer
➔ Application and circuit gateway systems to be able to communicate
firewall systems allow information to with each other
flow between systems but do not allow ➔ Can be seen as a universal language
the direct exchange of packets. for computer networking
● Primary Risk of allowing packet exchange ➔ Based on the concept of splitting-up a
between internal and external systems: threat communication system into seven
posed by allowed packets to the host abstract layers, one each one stacked
applications residing on the protected network’s upon the last
system - Layer 1: Physical
➔ the host applications residing on the - Layer 2: Data link
protected network’s systems must be - Layer 3: Network
secure against any threat posed by - Layer 4: Transport
allowed packets - Layer 5: Session
● Could be an appliance or sit atop hardened - Layer 6: Presentation
(tightly secured) OSs, such as Windows or - Layer 7: Application
UNIX ● Bastion hosting
 ➔ Employed by both application-level and modifying and securing it to
and circuit level firewalls known vulnerabilities
➔ All incoming requests from the ➔ Can log all traffic between the network
internet to the corporate network (FTP and the Internet
or web requests) are only handled by ● Telnet (TN): a networking protocol and
a single host software program used to access remote
➔ Bastion host is fortified against attack computers and terminals over the internet or
➔ By having only, a single host handling TCP-IP computer network
incoming requests, Bastion host ➔ Designed for remote server access,
makes it easier to maintain security management, and client-server
➔ In case of break-in, only the firewall architectures
system is affected and compromised, ➔ Telnet works through a purpose-built
not the entire network program that provides connectivity
➔ Effective level of security: no direct with a remote computer server and a
contact for requests in the internet host computer
with computers/host in the corporate ● Application-level firewall implementation of
network proxy server functions: based on providing a
● Application-based firewalls are set-up as separate proxy for each application service
proxy servers (FTP, Telnet, HTTP)
● Proxy servers ● Circuit-level firewall: no need for special proxy
➔ Act on behalf of someone inside an for each application-level service (what proxy
organization’s private network server is used for all services)
➔ Use special purpose codes (proxy ● Advantages of application-level firewall
servers) is incorporated into the - provide security for commonly used
firewall system instead of packet protocols
filtering tool, rather than relying on a - generally hide the internal network
generic pocket filtering tool to manage from outside untrusted networks
the flow of services through the ➔ Example: a feature available on
firewall these types of firewall systems
- Example: If someone inside the is the network address
corporate network wants to translation (NAT) capability
access a server on the internet, ➔ This capability takes private
a request to the internet is sent internal network addresses
to the proxy server, and the (unusable on the Internet) and
proxy server contacts the maps them to a table of public
server on the internet. The IP addresses, assigned to the
proxy server then sends the organization, which can be
information from the internet used across the Internet
server to the computer inside ● Disadvantages of application-level firewall
the corporate network - Poor performance and scalability as
➔ Facilitate request/communication Internet usage grows
between a computer in the network ➔ To offset this problem, the
and the Internet concept of load balancing is
➔ Act as go-between; can maintain applicable in cases where a
security by examining a service or redundant fail-over firewall
services (FTP or telnet program code) system may be used.
 3) Stateful Inspection Firewalls (packet filtering) and application server
● Keeps track of the destination IP address of security (proxy services)
each packet that leaves the organization’s ➔ An intruder in this configuration has to
internal network penetrate two separate systems
● Whenever the response to a packet is received, before the security of the private
its Referencing of record: network can be compromised
➔ Ensure incoming message is in ● Consists of private network, bastion host,
response to request from the packet filtering router and Internet
organization’s network ➔ configured with the bastion host
➔ Done by mapping the source IP connected to the private network with
address with the list of destination IP a packet filtering router between the
addresses that is maintained and Internet and the bastion host
updated ➔ Router filtering rules allow inbound
➔ Prevents any attack initiated and traffic to access only the bastion host,
originated by an outsider which blocks access to internal
● Advantage of stateful inspection firewalls over systems
application firewall systems ● Because the inside hosts reside on the same
➔ control the flow of IP traffic by network as the bastion host, the security policy
matching information contained in the of the organization determines whether inside
headers of connection-oriented or systems are given permission to access the
connectionless IP packets at the Internet (either direct access or whether they
transport layer, against a set of rules are required proxy services on the bastion
specified by the firewall administrator; host)
➔ provides greater degree of efficiency 2) Dual-homed firewall
when compared to typical ● Has two or more network interfaces, each of
CPU-intensive, full-time application which is connected to a different network
firewall systems’ proxy servers, which ● Acts to block or filter some or all of the traffic
may perform extensive processing on trying to pass between the networks in the
each data packet at the application firewall configuration
level ● More restrictive form of a screened-host
● Disadvantage of stateful inspection firewalls: firewall system
complex to administer, compared to the other ➔ a dual-homed bastion host is
two types of firewalls configured with one interface
established for information servers
Firewall Security Systems – Examples of Firewall and another for private network host
Implementations computers
● Firewall implementations: take advantage of 3) Demilitarized zone (DMZ) or screen-subnet
the functionality available in a variety of firewall
firewall designs to provide a robust layered ● Utilizing two packet-filtering routers and a
approach in protecting an organization’s bastion host → Most secure firewall
information assets ➔ supports network and
application-level security while having
● Commonly used implementations a separate DMZ network
1) Screened-host firewall ● Functions as a small, isolated network for an
● Utilizing a packet-filtering router and a bastion organization’s public servers, bastion host
host; implements basic network layer security information servers and modem pools.
 ● Configured to limit access from the Internet and exists is strictly controlled or prohibited
the organization’s private network altogether
● Outside router: restricts incoming traffic to the c) Misconfigured firewalls
DMZ network - may allow unknown and dangerous
● Limiting the services available for use: protects services to pass through freely.
the organization against certain attacks d) Wrong understanding about what constitutes
● External systems can access only the bastion a firewalls
host (and its proxying service capabilities to - Example: companies claiming to have
internal systems) and possibly information a firewall merely have a screening
servers in the DMZ router
● Inside router: provides a second line of e) Irregular monitoring of activities
defense, managing DMZ access to the private - Example: log settings not
network, while accepting only traffic originating appropriately applied and reviewed
from the bastion host f) Firewall Policies not maintained regularly
➔ For outbound traffic, the inside router g) Most Firewalls operating only at the network
manages private network access to the layer
DMZ network. - therefore, they do not stop any
- permits internal systems to application-based or input-based
access only the bastion host attacks.
and information servers in the - Example of attacks: SQL injection and
DMZ buffer-overflow attacks
● Filtering rules on the outside router: require - Newer-generation firewalls are able to
proxy services by accepting only outbound inspect traffic at the application layer
traffic on the bastion host and stop some of these attacks.
● Key benefits of DMZ: Firewall Platform
- Intruder should penetrate three
separate devices Firewall Security Systems – Firewall Platforms
- Private network addresses not ● Hardware or software platform
disclosed to the Internet implementations
- Internal systems do not have direct ● Hardware-based firewall platforms: provide
access to the Internet good performance with minimal overhead;
faster; not as flexible or scalable as
Firewall Security Systems – Firewall Issues software-based firewalls
● Issues on Implementing Firewalls ● Software-based firewalls: slower; high systems
a) False sense of security overhead; e flexible with additional services;
- may exist if management feels that no may include content and virus checking, before
further security checks and controls traffic is passed to users
are needed on the internal network ● Appliances-type firewalls: generally better to
- Example: the majority of incidents are use than normal servers; installed with hardened
caused by insiders, who are not OSs; generally, significantly faster to set-up and
controlled by firewalls recover
b) Circumvention of firewalls thru modems ● Server-based firewalls: OSs in servers are often
- may connect users directly to Internet vulnerable to attacks;
Service Providers (ISPs) - When the attacks on OSs succeed, the
- Management should provide assurance firewall is compromised.
that the use of modems when a firewall
6.5 Development and Authorization of
Network Changes
● Network configuration changes to update ● Controls to prevent unauthorized changes to
telecommunications lines, terminals, modems software and software configurations include:
and other network devices should be - Ensure SoD among software
authorized in writing by management and development, software administration
implemented in a timely manner. and computer operations
● An IS Auditor can test the change control by: - Restrict the software development
- Sampling recent change requests, team’s access to the development
looking for appropriate authorization environment only
and matching the request to the - Restrict access to the software source
actual network device codes
- Matching recent network changes, ● Controls to detect unauthorized changes to
such as new telecommunication lines, software include:
to added terminals and authorized - Software code comparison utilities
change requests ● Controls to detect unauthorized changes to
● The IS Auditor should determine who can configurations/parameters include:
access the network change software - this - Logging and monitoring system
should be restricted to senior network administrator activities
administrators.
● What will prevent unauthorized access to
● Development and change control procedures data?
should cover the following network - Application access control
components’ hardware and software: mechanisms
a) Firewalls - Built-in application controls
b) Routers ➔ These can be circumvented
c) Switches by direct access to data,
d) Application gateways which should be restricted
e) DNS/network topology and monitored.
f) Client software
g) Network management software Chapter 7: Data Encryption and
h) Web server hardware and Encryption-related Techniques
configuration
i) Application software 7.1 Key Elements of Encryption Systems
j) Web pages Introduction
● Encryption
Unauthorized Changes - process of converting a plaintext
● One of the most important objectives of message into a secure-coded form of
change control procedures is to prevent or text, called ciphertext
detect unauthorized changes to software, ➔ which cannot be understood
configurations or parameters, and data. without converting it back via
● Unauthorized changes may include: decryption (the reverse
➢ Changes to software or process) to plaintext
configurations/parameters that occur - Reverse is decryption (ciphertext back
without conforming to change control to plaintext)
procedures - Done via a mathematical function and
➢ Changes made to software code a special encryption/decryption
without authorization password called the “key”
 ● Uses of Encryption tries to decrypt a piece of ciphertext using all
➔ Protect data in transit over networks the possible encryption keys until the correct
from unauthorized interception and one is found
manipulation ➔ Example: brute forcing stops when the
➔ Protect information in computers from ciphertext does not decrypt to a
unauthorized viewing and manipulation non-sense message
➔ Prevent and detect accidental or ● Fundamental to choose the key adequately to
intentional alterations of data/ ensure the overall security of encryption scheme
information ➔ Because the amount of time required to
➔ Verify authenticity of a transaction or search for the correct key depends
document exponentially on its length
● In many countries, encryption is subject to ● Attacks can be mounted against the
governmental laws and regulation robustness of the underlying mathematical
● Limitation: Encryption cannot prevent algorithms to speed up the brute forcing
loss/modification of data process
● Protection of keys: paramount concern when ➔ Cryptanalysis is the science of finding
using encryption systems such weaknesses
➔ Even when encryption is regarded as ➔ Example: algorithm prone to a
an essential form of access control, it known-plaintext attack allows an
sill requires a thorough understanding attacker to discard a large portion of
of how schemes work the possible decryption keys if
➔ misuse or misconfiguration may samples of ciphertexts and
significantly undermine the protection corresponding plaintexts are available
that an organization believes is in place ➔ Variation of the attack: the attacker
guesses parts of the plaintext by
Key Elements of Encryption Systems leveraging on statistical properties of
● Key Elements of Encryption Systems the encrypted data (e.g., spotting
1) Encryption algorithm: mathematical vowels or finding the word “the” in an
function used to encrypt/decrypt data English text)
2) Encryption keys: A piece of information ● Randomness of key generation: significant
that is used by the encryption algorithm factor on the ability of compromising
to make the encryption or decryption encryption scheme
process unique ➔ Common words or phrases
➔ Similar to passwords, a user significantly lessen the key space
needs to provide the correct combinations required to search for the
key to access or decrypt a key, diminishing the strength of the
message. encryption algorithm
➔ The wrong key will decipher - Therefore, the capabilities of a
the message into an 128- bit encryption algorithm
unreadable form. are diminished when
3) Key length: a predetermined length for encrypting keys are based on
the key passwords, and the passwords
➔ the longer the key, the more lack randomness
difficult to compromise in a ● Effective password syntax rules should be
brute force attack applied and easily guessed passwords be
● Encryption schemes are susceptible to brute prohibited
force attacks in which an attacker repeatedly ● Two types of encryption schemes
 a) Symmetric key systems: use a unique ➔ In the hash function, all of the
key for encryption and decryption different passwords are
- Unique key: aka secret key; a converted into fixed-length
bidirectional key because it strings before being stored in
encrypts and decrypts and it the database. These output
must be shared out of band strings cannot be converted
(i.e., via a secure, alternative back to find out the actual
method to the encrypted passwords.
message) - The length of digest or hash value
b) Asymmetric key systems: decryption depends on the hash algorithm used.
key different from encryption key; ➔ Example: MD5 generates a
- Unidirectional keys: they digest length of 128 bits;
encrypt or decrypt—but are SHA-1, a digest of 160 bits;
complementary and SHA-512, a digest of 512
- The two parties (the sender bits
and the recipient) are not - Most common message digest
expected to trust each other to algoritms: MD5 and SHA-1
keep the secret key - Industry transitioning to SHA-2, due to
- Encryption key is publicly security considerations
disclosed, decryption key is ➔ Has six hash functions
private available with varying message
- Asymmetric systems are also digest lengths
known as public-key schemes - Announcing SHA-3 by National
● Hash functions or hashing algorithms Institute for Standards and
- Important component of cryptographic Technology (NIST)
protection schemes ➔ In the event a successful
- Transform text of arbitrary or random ayttack is developed against
length into one of fixed with length SHA-2
(digest or hash value of the input text) - Senders: When they want to send a
➔ Example: a hash function is message and ensure that it has not
one that just truncates a text been altered, they can compute the
string after a fixed number of digest of the message and send it
characters along with the message to the receiver.
- Must be one-way: to be used in - Receiver: When he/she receives the
cryptographic protection schemes message and its digest, he/she
➔ Example: making it hard to independently computes the digest of
find a piece of text that the received message and ensures that
generates a given hash the digest computed is the same as the
- Accurate integrity check tool digest sent with the message (Figure
- Calculate a hash value from the entire 5.17).
or whole input message ● Figure 5.17 - Verifying Message Integrity
- Output is always at fixed same length, Using a Hash Function
even if the input message is of
variable length
- Example: Hash function: Password
Encryption
 - Was employed by NIST to replace
3DES during 2001

● Advantages of symmetric key systems

(over asymmetric)
- Shorter keys and can be easily
remembered
- Less complicated and used less
7.2 Symmetric Key Cryptographic Systems processing power than an asymmetric
key
➔ ideally suited for bulk data
encryption
● Disadvantages of symmetric key systems
- Major: key distribution, particularly in
eCommerce environments where
customers are unknown, untrusted
entities
● Symmetric key cryptographic systems are - Additional: cannot be used to sign
based on a symmetric encryption algorithm, electronic documents or messages,
which uses a secret key to encrypt the due to the fact that the mechanism
plaintext to the ciphertext and the same key to placed on a shared secret by at least
decrypt the ciphertext to the corresponding two parts
plaintext.
● In this case, the key is said to be symmetric
7.3 Public (Asymmetric) Key Cryptographic
because the encryption key is the same as the
Systems
decryption key
● Data Encryption Standard (DES): most
common symmetric key cryptographic system
- Based on a public algorithm approved
by the NIST
- employs 56 bits (plus 8 bits for parity
checking)
- withdrawn by NIST because its entire
key space is prone to brute force
weakness by a moderately large
system within a relatively short period
INTRODUCTION
of time
● Triple DES or 3DES: extension of DES; ● Two keys work together as a pair, they
- applies DES 3x its data block are inversely related based on a
- were proposed to extend the DES mathematical inteqer factorization
while maintaining backward ● One of the keys is private and the other
compatibility
is publicly-disclosed
● Encryption works by feedinq the public
● Advanced Encryption Standard (AES):
key of the recipient to the underlyinq
replaced DES;
- Public algorithm that supports keys alqorithm, where the resultinq
with 128 to 256 bits in size ciphertext can be decoded usinq the
 private key
● The private key avoids requirement of
the owner’s key pair to share the
private information and their
communication

1.) QUANTUM CRYPTOGRAPHY

● Quantum cryptoqraphy: possibility to use
quantum computing (computer technoloqy
based on quantum theory) for ● In most practical implementation of digital
cryptographic purposes signature schemes, the public key or
● Quantum Key Distribution (QKD) schemes: symmetric key system is never applied to the
allow distribution of a shared encryption whole document as it would take a lot of
key between two parties, processing power to calculate the signed
○ can detect unauthorized party data
● Instead, a digest or pre-hashed is first derived
eavesdropping
from the document to be signed usinq a
○ Most important application
hashing function/algorithm. Then, the public
● Quantum computing: easily breaks the
key algorithm is applied to the digest (encrypt
security schemes
process using the sender’s private key) in
○ Postquantum encryption order to produce an encoded key of data that
algorithms solve the problem and is a digital signature, sent alongside the
are resistant to quantum attacks document
● To authenticate the sender (as the originator
2.) DIGITAL SIGNATURES of the document), the hashing
● Public Key systems: the underlying function/algorithm is applied by the recipient
upon receiving the message and the resulting
algorithm should work even if private key
digest or post-hash is compared with the
is used for encryption and public key is
decrypted key using the sender’s public key
for decryption ● In case of a match, the receiver can conclude
● Digital signature: authenticates origin of that a document was actually signed by the
the encoded message owner of the public key
○ Even if found counter-intuitive, a
public key system would realize
this digital signature scheme Digital signature schemes ensure:

○ Nonrepudiation/Non-denial:
a. Data integrity: changes in plaintext message
because the private key is known will result in failed computing of the same
only by the owner of the key pair, hash value or digest
one can ensure that if a ciphertext - Any chanqe to the plaintext messaqe
is correctly decrypted using a will result in the recipient failinq to
public key, the owner of the public compute the same document
key cannot deny having performed b. Authentication: document is ensured to be
the encryption process sent by the sender since only the sender has
the private key
- Recipient can ensure that the
 document has been sent by the plain a) TRANSPORT LAYER SECURITY
sender, because only the plain sender ● Transport layer security (TLS): a
has the private key cryptographic protocol that provides secure
c. Nonrepudiation: sender cannot later deny communications on the Internet
generating the document
○ Is a connection-layered protocol
partly used for communications
3. DIGITAL ENVELOPE
between browsers and web servers
● Digital envelope: electronic container used ● TLS provides endpoint authentication, aside
to protect data or a message through the from communication privacy
use of encryption data authentication ○ TLS allows client-server application
○ Similar to a digital signature communication in a way designed to
● Message is encrypted using symmetric prevent eavesdropping, tampering,
encryption; code or key to decode and messaqe forgery
message is secured using public b) IP SECURITY
(asymmetric) key encryption ● IP security or IPSec: used to secure
○ A more convenient option for communications at IP level among two or
encryption more hosts, subnets, or hosts & subnets
● Combination of encrypted message and ○ This IP layer packet security protocol
encrypted secret key establishes VPNs via transport and
7.4 Applications of Cryptographic Systems tunnel-mode encryption models
● Sender uses digital certificates for
INTRODUCTION authentication
○ The connection is made secure by
● Asymmetric and symmetric systems can be
combined to leverage on each system’s supporting the generation,
peculiarity authentication, and distribution of
● Common scheme: encrypt data using a SAs and those of the cryptographic
symmetric algorithm with the secret key which keys
is randomly generated, then the secret key is ● Security Associations (SAs): define the
encrypted using an asymmetric algorithm security parameters that should be applied
○ It allows the secure distribution between communicating parties as
among those parties who access encryption algorithms, keys, lifespan of keys,
among the encrypted data
etc.
● Benefits: Secure communication; speed of
● Digital Certificates: authenticates the web
symmetric systems and ease of key
credentials that of the sender and lets the
distribution of asymmetric systems
recipient of an encrypted message know
● Creating secret key is effortless; hence, this
can be employed to a limited amount of data that the data is from a trusted source or a
after which a new secret key can be chosen sender who claims to be one
○ limit malicious third-party to decrypt ○ Is issued by a certification authority
the whole set of data, because they (CA)
would be required to attack multiple ○ Used to install signatures and
secret keys message encryption
c) SECURE SHELL ● Creates layer between hardware and guest
● Secure Shell (SSH): a client-server program OSs, to manage their processing and memory
that opens a secure and encrypted shell resources on the host
session from Internet for remote logon ● Management console: often provides
● SSH uses strong cryptography to protect data administrative access in managing the
(passwords, binary files, and administrative virtualized system
commands) transmitted between systems ● Data centers in many other organizations use
○ Similar to a VPN virtualization techniques to create an
● SSH is implemented to validate credentials abstraction of the physical hardware and
between two parties by validating each make large pools of logical resources
other’s credentials using digital certificates consisting of:
● SSH is useful in replacing Telnet and 1) CPUs
implemented at the application layer 2) Memory
○ as opposed to operating at the
3) Disks
network layer, like that of the IT
4) File Storage
Security implementation
5) Applications
d) SECURE MULTIPURPOSE INTERNET 6) Networking
MAIL EXTENSIONS (S/MIME) - the approach enables greater availability of
Secure Multipurpose Internet Mail Extensions resources to the user base
(S/MIME):
● MAIN FOCUS: to enable a single physical
● A standard secure email protocol
computing environment to run multiple
● Authenticates identity of sender and
logical, yet independent systems of the same
receiver
kind
● Verifies integrity of message
● Most common use: operational efficiency —
● Ensures privacy of a message’s content,
uses existing hardware more efficiently by
including the attachments
placing greater loads on each computer
● Second use: using full virtualization of
Chapter 8: desktops enables end-users to have one
computer hosting multiple OSs, if needed to
VIRTUALIZED ENVIRONMENTS support various dependent OS applications
● Further use: an IT organization can better
control deployed OSs, to ensure that they
Introduction
meet the organization’s security requirements
VIRTUALIZATION ○ Security threat and respective contro
requirements are dynamic
● Provides an enterprise with significant ● Virtual desktop images can be changed to
opportunities to; respond to new threats
● Increases efficiency and decreases costs
in IT operations
● Introduces additional risk; a high-level
virtualization allows multiple OSs to coexist ELEMENTS OF A VIRTUALIZED COMPUTING
in the same physical server or host in ENVIRONMENT
isolation of one another
a. Server or other hardware parts
b. Virtualization hypervisor: a piece of guest OS that provides utilities to control
computer software, firmware, or hardware that virtualization, while in a guest OS
creates/runs the virtual machine environment; - Ability to share files with the host OS
“HOST“ 3. Containerization: containers include the
● HYPERVISOR: a hardware virtualiz ation application and its dependencies but share
technique that allows multiple guest
the kernel with the other containers;
operating systems or OSs to run on a
● Containers run as an isolated
single whole system at the same time
process in user space on the host
- the guest OS shares the hardware
of the host computer, such that operating system
each OS appears to have its own
processor, memory, and other
hardware resources
- AKA Virtual Machine Manager
(VMM)
- The hypervisor installed in the
server hardware consults the guest
operating system running on the
host machine. ● Bare metal: hypervisor runs directly on the
- Main job is to cater to the needs of underlying hardware without a Host OS
the guest operating system & ● Hosted: the hypervisor runs on top of the host
effectively manage it, such that the OS
instances of multiple operating
systems do not interrupt with one
Advantages and Disadvantages of Virtualization
another
c. Guest machine: virtual environmental Advantages Disadvantages
elements residing in the computer on
which a hypervisor host machine has been
-Server hardware costs -Inadequate
installed may decrease for both confiquration of the host
1. OS server builds and server could create
2. Switches maintenance vulnerabilities that affect
3. Routers not only the host, but
-Multiple OSs can also the quests
4. Firewalls, etc.
share processinq
capacity and storaqe -Exploits vulnerabilities
METHODS OF DEPLOYING A VIRTUALIZED
that often goes to Within the host’s
ENVIRONMENT configuration, or a
waste in traditional
servers, thereby denial-Of-service
1. Bare metal/native virtualization: attack against the host,
reducinq operatinq
hypervisor runs directly on the underlying costs could affect all of the
hardware, without a host OS; host’s quests
-The physical footprint
2. Hosted virtualization: hypervisor runs on of servers may - A compromise of the
top of the host OS (Windows, Linux, or decrease within the management console
MAC OS) data center
could qrant
● Its architecture has an additional layer of -A single host can have unapproved
software (virtualization application) in the multiple versions of the administrative access
same OS, or even to the host’s quests
different OSs, to
facilitate testing of -Performance issues of
applications for the host’s own OS
● To determine whether the enterprise has
performance could impact each of
considered the applicable risk in its decision
differences the host’s quests
to adopt, implement, and maintain this
-Creation of duplicate technology
copies in alternate -Data could leak
● Risks must be managed effectively; the host
locations can support between quests if
in a virtualized environment represents a
business continuity memory is not released
potential, single-point of failure in the system
and allocated by the
efforts ○ A successful attack on the host could
host in a controlled
-Application support result in a compromise that is larger in
manner
personnel can have both scope and impact
-Insecure protocols for
multiple versions of the
remote access to the PRINCIPLES AND GOOD PRACTICES FOR A
same OS, or even
management console VIRTUALIZED ENVIRONMENT
different OSs, on a
and quests could result
sinqle host to more ● To address the risks, an enterprise can often
in exposure of
easily support users implement or adapt the same principles and
administrative
operating in different good practices for a virtualized server
credentials
environments environment, that it will use for a server form
- a single machine can a. Strong physical and logical access controls,
house a multitier especially over the host and its management
network in an console
b. Sound configuration management practices
educational lab
and system hardening for the host including:
environment without
i. Patching
costly reconfigurations
ii. Antivirus
of physical equipment
iii. Limited services
iv. Logging
-smaller organizations v. Appropriate permission
that had performed vi. Other configuration settings
tests in the production c. Appropriate network segregation including the
environment may be avoidance of virtual machines in the DMZ and
better able to set up the placement of management tools on a
logically separate, separate network segment
d. Strong change management practices
cost-effective
development & test
Key Risk Areas
environments
-if set up correctly, a ● Migrating computer resources to virtualized
well-built, single access environment DOES NOT change the threats
control on the host can plane for most of the system’s vulnerabilities
provide tighter control and threats
for the host’s multiple ○ If a service has inherent vulnerabilities
on a physical server/network products
guests
and it is migrated to a virtualized
 server, the server remains vulnerable contents of random­access
to exploitations memory (RAM) at the time the
● The use of virtualization: increase in likelihood snapshot was taken; include
of attacks due to additional virtual sensitive information that was
environment attack paths (vectors; hypervisor no stored on the drive itself
configuration or security flaws, memory 4. Absence of hypervisor controls in hosted
leakage, etc.) virtualization: anyone who can launch an
application on host OS can run hypervisor
● In contrast to bare-metal installations,
hosted virtualization products rarely
HIGH-LEVEL RISKS IN VIRTUALIZED SYSTEMS have hypervisor access controls
● The only access control to address
(representative of the majority of virtualized systems in
this is whether someone can log into
use)
the host OS
1. Rootkits on the host: installing themselves as
Typical Controls
a hypervisor below the OS enables
interception of operations of any of the guest An IS auditor should understand the following
OS (logging password entry, etc.) concepts:
a. Antivirus may not detect this because
the malware runs below the entire OS a. Securely configure hypervisors and guest
2. Improper configuration of hypervisor images (OS & networks) according to industry
partitioning resources: standards
a. CPU ● Apply hardening to these virtual
b. Memory components, as closely as one would
c. disk space do to a physical server (switch,
d. Storage firewall, or other
- Leads to unauthorized access b. Protect hypervisor communications on a
to resources, wherein one dedicated management network
guest OS injecting malware to ● Management communications carry
another or placing malware on a trusted network, should be
code into another guest OS encrypted and encryption should
memory encapsulate the management traffic
3. Guest tools: this mechanism enable guest OS c. Patch the hypervisor, as the vendor releases
to access files, directories, the copy­paste the fixes
buffer, and other resources on the host OS or d. Synchronize the virtualized infrastructure to
another guest OS trusted authoritative timeserver
- this functionality can inadvertently e. Disconnect unused physical hardware from
provide attack paths (vector) for the host system
malware or allow an attacker to gain f. Disable all hypervisor services (flipboard or file
access to particular resources sharing between guest OS or host OS), unless
- snapshots or images of test needed
environments containing sensitive g. Enable host inspection capabilities to monitor
data (password, personal data, etc.) security of each guest OS
make a physical hardware h. Enable host inspection capabilities to monitor
- Snapshots are a holder of security of activities occurring between guest
risks than images because the OSs
snapshots contain the
 ● Of special focus is communications in a
non-virtualized environment carried and
monitored over networks by network security
controls such as:
○ Network firewalls
○ Security appliances
○ Network IDPS sensor
I. Use file integrity monitoring of the hypervisor
to monitor for signs of compromise

REFERENCES:
ISACA. (2019). CISA review manual (27th ed.).

Prepared By:
Krishia Angeles
Justine Angela Cureg
Marian Martina Firme
Jyruenth Llausas
Pam Porciuncula
Jenny Rose Villegas
Nicole Vinuya