Lakhasly

Preventive Information Assurance Tools o Content Filters o Cryptographic Protocols and Tools o Firewalls o Proxy Servers o Public Key Infrastructure o Virtual Private Networks Preventive Information Assurance Tools Content Filters o Content filters control the access of end users to portions of the Internet.Patch Management o Patch management requires performing planned and timely system patches to maintain operational efficiency and effectiveness, mitigate information security vulnerabilities, and maintain the stability of IT systems.Preventive Information Assurance Tools Network Intrusion Prevention System o NIPS can be problematic if they are configured incorrectly or if they are unable to detect legitimate changes to an organization 's network o As noted, they are preventive devices and can often automatically shut off traffic or redirect it based on the rules provided to it. This can cause unplanned outages and confusion if NIPS configuration and modification is not part of an organization 's change management and configuration management process.o The most successful implementations of content filters contain a process through which users can request web sites be unblocked after it has been analyzed to determine whether it should be opened for use Preventive Information Assurance Tools Cryptographic Protocols and Tools o Cryptography is a technique for hiding information by transforming it so that only authorized individuals can access it in its original form.Organizations may choose to use network intrusion detection systems (NIDSs) instead of NIPS because of the disruptions NIPS may create Preventive Information Assurance Tools Proxy Servers o Proxy servers act as an intermediary between clients and the Internet by allowing clients to make indirect connections to other network services through them.o Sources of change: o Alliances and partnerships o Business market demands o Competitive markets o Operational issues o Regulations changes Change Management and Configuration Management 2/2 o Configuration management controls hardware, software, and their associated documentation.Proxy servers can be configured to require authentication of the end user, restricting communication to a defined set of protocols, applying access control restrictions, and carrying out auditing and logging.Preventive Information Assurance Tools Network Intrusion Prevention System There are two types of network intrusion prevention systems: Content based used to detect attacks, the contents of the network packets are checked for distinctive sequences called signatures.The strongest VPN solutions use multifactor authentication and have their cryptography certified by independent parties such as the U.S. National Institute of Standards and Technology's Cryptographic Module Validation Program (CVMP).Content filters may be used to change employees' productivity and to increase an organization's information assurance profile by reducing user access to web sites that have no organizational value, improper content, or malicious code.SSL and TLS are preferred information security protocols in web environments, while IPSec protocols are preferred for implementing virtual private networks (VPNs).Additionally, firewalls are often multifunction devices that may also contain solutions for remote users to connect to an organization's intranet and web content filtering.PKI enables a secure method for exchanging confidential information over unsecured networks and is the de facto standard for implementing trust online.Preventive Information Assurance Controls Backup Change Management and Configuration Management IT Support Media Controls and Documentation Patch Management Backup o An organization should have a policy on what to back up (data, software, and hardware), when to back up (depending on the frequency of changes that occur), and how to back up (the process of backup).o Examples of protocols that implement network services include Secure Sockets Layer (SSL), Transport Layer Security (TLS), and IP Security (IPSec) protocols.Proxy Vs VPN Preventive Information Assurance Tools Public Key Infrastructure o The use of public key infrastructure (PKI) implementation is growing worldwide.o A successful and effective patch management program combines well-defined processes, effective software, and training into a strategic program for assessing, obtaining, testing, and deploying patches.o Encryption techniques for hosts range from encryption of the entire hard disk, database encryption, selective folder (group of files) encryption, or individual file encryption.o Access control policies may be implemented in the firewall and are important for controlling information traffic and movement from public accessible networks to private networks but they are not solver for all problems.Preventive Information Assurance Tools Network Intrusion Prevention System oA network intrusion prevention system (NIPS) inspects network traffic based on organizational information assurance policy and configuration.Various types of VPN protocols are IPSec, SSL, Point-to-Point Tunneling Protocol (PPTP), and others.Organizations should be vigilant and do preimplementation research about key management and types of encryption algorithms used and their strengths before employing any VPN technology.o Note that there are limitations in firewalls because they can only inspect and filter the traffic that flows through them; they cannot protect from internal threats unless appropriately implemented.Preventive Information Assurance Tools Proxy Servers o Care should be used with proxy servers since they can be used to disguise sources of traffic (anonymized).Preventive Information Assurance Tools Public Key Infrastructure o A common way of associating public keys with their owners is to use digital certificates.In PKI, user credentials take the form of a digital certificate, think of it as an electronic passport.o One in five companies (19 per cent) that suffered a malicious data breach was infiltrated due to stolen or compromised credentials, increasing the average total cost of a breach for these companies by nearly $1 million to $4.77 million.Going out of favour due to the lowering in costs associated with disk-based backup o Cloud backup: This utilizing a service like Amazon Web Services to provide backup services versus an internal backup mechanism.Preventive Information Assurance Tools Cryptographic Protocols and Tools Preventive Information Assurance Tools Firewalls o Firewalls act as a primary control for information assurance technology.This system uses application content, behavior, and context, and not IP addresses or ports, to formulate decisions on access control.o A digital certificate is an electronic message that links a public key to the name of the owner in a secure way by using a trusted third party, known as a certificate authority (CA), that guarantees the relationship.o Certificates may be published and stored in public directories such as an LDAP server.Preventive Information Assurance Tools Virtual Private Networks o A virtual private network is a secure network that uses a public network (usually the Internet) to allow users to interconnect.A VPN provides costeffective solutions to organizations spread over wide areas.Although a firewall protects network assets, organizational systems will be at a higher risk of compromise if patch management is implemented inappropriately.o For example, a financial system will typically provide data to human resources and external business partners o Is the information synced or replicated across multiple servers?Organizations should track all changes to configuration items throughout the life cycle of the components and system with tracking records.Configuration management is closely related to asset management it represents the detailed configuration information for each identified asset.Configuration is also closely related to contingency planning because restored systems must comply with configuration baseline standards.Cryptographic tools also provide confidentiality, integrity, and nonrepudiation protection as defined by the MSR model discussed earlier.o Firewalls are widely used throughout organizations; however, recently there has been an increase in the usage of personal firewalls.It may reduce the exploitation of a network with its capability to manage network packets and identify attacks.An anomaly -based NIPS may be used to prevent denial of service (DOS) attacks by monitoring and learning normal network behavior.Preventive Information Assurance Controls o Network and computing environments constantly change.o Disk backup: Because the storage is not linear, such as tape, individual files can be directly accessed allowing for faster recovery times.o The information security professional must make take care when reviewing the cloud backup provider contract ensuring that the backup provider meets all of the information security requirements for the business' information.These tools allow network administrators to block access selectively to certain types of web sites based on predefined local policy.The simplest form of a proxy server is called a gateway.With faster growth of e-commerce, ebusiness, and e-government applications, the adoption of PKI has increased in recent years.Authentication using PKI technology means proving one's identity by proving knowledge of the associated private key (as indeed the owner of that private key).o IPSec uses the Internet Key Exchange (IKE) protocol to exchange certificates as part of the key exchange procedure.It uses cryptographic means (encryption) to provide secure communications on public networks.Various out-ofthe-box VPN solutions are readily available.Organizations need to ensure that proper mechanisms exist to complement the use of technology.The full suite of preventive information assurance mechanisms that can be used follows.It is thus critical that restoration and integrity tests are performed frequently.Change Management and Configuration Management 1/2 o If an organization is to remain competitive, it should be prepared to change continuously since the environment is not static.Common practices for an effective patch management include the following: standardized patch management policies, procedures, and tools.They may be implemented as hardware, software, or a combination of both. They exist at the host (desktop, user level) and the network or server level.PKI provides a secure electronic business environment.o According to Norton, the average recovery cost from a common data breach is estimated at $3.86 million.Human error was the cause of 23 per cent of breaches, and system glitches (25 per cent), were at an average total cost of $4.27 million.Types of storage options o Virtual machine snapshot: This type of backup makes a point in time copy of a virtual machine disk file.o Tape backup: Liner storage mechanism used for long-term archival storage.o Organizations should not implement configuration management without having a change management process in place.They can also be used to cache web content.The same Norton research found that it can take companies, on average, 196 days to identify a data breach.The backup process should be fully supported by the baseline process.o Backing up systems is important, but more important is the correct restoration of the backup.This can be used to restore a virtual machine to a particular point in time.It provides a higher capacity and speed than tape.All others are denied access since they cannot decrypt the information.Another good practice is to document each restoration step.Refer to Chapter 25 for more information on backup and related matters.Questions you should ask your IT organization regarding the information's location o Is the information shared with multiple information systems?It is part of configuration management.o How is the information backed up?

Preventive
Information
Assurance Tools
• Content Filters
• Cryptographic Protocols and
Tools
• Firewalls
• Proxy Servers
• Public Key Infrastructure
• Virtual Private Networks
Preventive Information Assurance Tools
Content Filters
• Content filters control the access of end users to portions of the
Internet. These tools allow network administrators to
block access selectively to certain types of web sites
based on predefined local policy. Content filters may be used
to change employees’ productivity and to increase an
organization’s information assurance profile by reducing user
access to web sites that have no organizational value, improper
content, or malicious code.
• The most successful implementations of content filters contain a
process through which users can request web sites be unblocked
after it has been analyzed to determine whether it should be
opened for use
Preventive Information Assurance Tools
Cryptographic Protocols and Tools
• Cryptography is a technique for hiding information by transforming it
so that only authorized individuals can access it in its original form.
All others are denied access since they cannot decrypt the
information. Cryptographic tools also provide confidentiality,
integrity, and nonrepudiation protection as defined by the MSR
model discussed earlier.
• Encryption techniques for hosts range from encryption of the entire
hard disk, database encryption, selective folder (group of files)
encryption, or individual file encryption.
• Examples of protocols that implement network services include
Secure Sockets Layer (SSL), Transport Layer Security (TLS), and IP
Security (IPSec) protocols. SSL and TLS are preferred information
security protocols in web environments, while IPSec protocols are
preferred for implementing virtual private networks (VPNs).
Preventive Information Assurance
Tools
Cryptographic Protocols and Tools
Preventive Information Assurance Tools
Firewalls
• Firewalls act as a primary control for information assurance
technology. They may be implemented as hardware, software,
or a combination of both. They exist at the host (desktop, user
level) and the network or server level.
• Access control policies may be implemented in the firewall
and are important for controlling information traffic and
movement from public accessible networks to private
networks but they are not solver for all problems.
• Firewalls are widely used throughout organizations; however,
recently there has been an increase in the usage of personal
firewalls.
• Note that there are limitations in firewalls because they can
only inspect and filter the traffic that flows through them;
they cannot protect from internal threats unless appropriately
implemented. Additionally, firewalls are often multifunction
devices that may also contain solutions for remote users to
connect to an organization’s intranet and web content
filtering.
Preventive Information Assurance Tools
Network Intrusion Prevention System
•A network intrusion prevention system (NIPS)
inspects network traffic based on organizational
information assurance policy and configuration. It
may reduce the exploitation of a network with its
capability to manage network packets and identify
attacks. This system uses application content,
behavior, and context, and not IP addresses or
ports, to formulate decisions on access control.
Preventive
Information
Assurance
Tools
Network
Intrusion
Prevention
System
There are two types of
network intrusion
prevention systems:
Content based used to
detect attacks, the
contents of the network
packets are checked for
distinctive sequences
called signatures.
An anomaly
-based NIPS
may be used to prevent
denial of service (DOS)
attacks by monitoring
and learning normal
network behavior.
Preventive
Information
Assurance
Tools
Network
Intrusion
Prevention
System
• NIPS can be problematic if they are configured
incorrectly or if they are unable to detect
legitimate changes to an organization
’s
network
• As noted, they are preventive devices and can
often automatically shut off traffic or redirect it
based on the rules provided to it. This can
cause unplanned outages and confusion if NIPS
configuration and modification is not part of an
organization
’s change management and
configuration management process.
Organizations may choose to use network
intrusion detection systems (NIDSs) instead
of NIPS because of the disruptions NIPS
may create
Preventive Information Assurance Tools
Proxy Servers
• Proxy servers act as an intermediary
between clients and the Internet by
allowing clients to make indirect
connections to other network services
through them. Proxy servers can be
configured to require authentication of
the end user, restricting communication
to a defined set of protocols, applying
access control restrictions, and carrying
out auditing and logging.
Preventive Information Assurance Tools
Proxy Servers
• Care should be used with proxy servers since
they can be used to disguise sources of traffic
(anonymized). The simplest form of a proxy
server is called a gateway. They can also be used
to cache web content.
Proxy Vs VPN
Preventive Information Assurance Tools
Public Key Infrastructure
• The use of public key infrastructure (PKI)
implementation is growing worldwide. PKI
enables a secure method for exchanging
confidential information over unsecured
networks and is the de facto standard for
implementing trust online. PKI provides a
secure electronic business environment.
With faster growth of e-commerce, ebusiness, and e-government applications,
the adoption of PKI has increased in recent
years.
Preventive Information Assurance Tools
Public Key Infrastructure
• A common way of associating public keys with their owners is to use
digital certificates. In PKI, user credentials take the form of a digital
certificate, think of it as an electronic passport.
• A digital certificate is an electronic message that links a public key to the
name of the owner in a secure way by using a trusted third party, known
as a certificate authority (CA), that guarantees the relationship.
Authentication using PKI technology means proving one’s identity by
proving knowledge of the associated private key (as indeed the owner of
that private key).
• Certificates may be published and stored in public directories such as an
LDAP server.
• IPSec uses the Internet Key Exchange (IKE) protocol to exchange
certificates as part of the key exchange procedure.
Preventive Information Assurance Tools
Virtual Private Networks
• A virtual private network is a secure network that uses
a public network (usually the Internet) to allow users
to interconnect. It uses cryptographic means
(encryption) to provide secure communications on
public networks. Various types of VPN protocols are
IPSec, SSL, Point-to-Point Tunneling Protocol (PPTP),
and others. A VPN provides costeffective solutions to
organizations spread over wide areas. Various out-ofthe-box VPN solutions are readily available.
Organizations should be vigilant and do preimplementation research about key management and
types of encryption algorithms used and their
strengths before employing any VPN technology. The
strongest VPN solutions use multifactor
authentication and have their cryptography certified
by independent parties such as the U.S. National
Institute of Standards and Technology’s Cryptographic
Module Validation Program (CVMP).
Preventive Information
Assurance Controls
• Network and computing environments constantly
change. Organizations need to ensure that proper
mechanisms exist to complement the use of technology.
Although a firewall protects network assets,
organizational systems will be at a higher risk of
compromise if patch management is implemented
inappropriately. The full suite of preventive information
assurance mechanisms that can be used follows.
• According to Norton, the average recovery cost from a common data breach is estimated at $3.86
million. The same Norton research found that it can take companies, on average, 196 days to identify a
data breach.
• One in five companies (19 per cent) that suffered a malicious data breach was infiltrated due to stolen or
compromised credentials, increasing the average total cost of a breach for these companies by nearly $1
million to $4.77 million. Human error was the cause of 23 per cent of breaches, and system glitches
(25 per cent), were at an average total cost of $4.27 million.
Preventive Information Assurance Controls
Backup
Change Management and Configuration Management
IT Support
Media Controls and Documentation
Patch Management
Backup
• An organization should have a policy on what
to back up (data, software, and hardware),
when to back up (depending on the
frequency of changes that occur), and how to
back up (the process of backup). The backup
process should be fully supported by the
baseline process.
• Backing up systems is important, but more
important is the correct restoration of the
backup. It is thus critical that restoration and
integrity tests are performed frequently.
Another good practice is to document each
restoration step. Refer to Chapter 25 for
more information on backup and related
matters.
Types of storage options
• Virtual machine snapshot: This type of backup makes a point in time copy of a virtual machine
disk file. This can be used to restore a virtual machine to a particular point in time.
• Disk backup: Because the storage is not linear, such as tape, individual files can be directly
accessed allowing for faster recovery times. It provides a higher capacity and speed than tape.
• Tape backup: Liner storage mechanism used for long-term archival storage. Going out of favour
due to the lowering in costs associated with disk-based backup
• Cloud backup: This utilizing a service like Amazon Web Services to provide backup services
versus an internal backup mechanism.
• The information security professional must make take care when reviewing the cloud backup
provider contract ensuring that the backup provider meets all of the information security
requirements for the business' information.
Questions you should
ask your IT organization
regarding the
information's location
• Is the information shared with
multiple information systems?
• For example, a financial system
will typically provide data to
human resources and external
business partners
• Is the information synced or replicated
across multiple servers?
• How is the information backed up?
Change
Management and
Configuration
Management 1/2
• If an organization is to remain competitive, it should be prepared to
change continuously since the environment is not static.
• Sources of change:
• Alliances and partnerships
• Business market demands
• Competitive markets
• Operational issues
• Regulations changes
Change
Management and
Configuration
Management 2/2
• Configuration management controls hardware, software, and their associated
documentation. Organizations should track all changes to configuration items
throughout the life cycle of the components and system with tracking records.
Configuration management is closely related to asset management it represents
the detailed configuration information for each identified asset. Configuration is
also closely related to contingency planning because restored systems must
comply with configuration baseline standards.
• Organizations should not implement configuration management without having a
change management process in place.
Patch Management
• Patch management requires performing planned and timely system patches to
maintain operational efficiency and effectiveness, mitigate information security
vulnerabilities, and maintain the stability of IT systems. It is part of configuration
management.
• A successful and effective patch management program combines well-defined
processes, effective software, and training into a strategic program for assessing,
obtaining, testing, and deploying patches. Common practices for an effective patch
management include the following: standardized patch management policies,
procedures, and tools.
Patch Management Process
• A good patch management policy should contain provisions for patch deployment,
describing how and when new patches should be applied to the organization and an
acceptable “discovery-to-patch” timeframe.
• Establishing dedicated resources
• Monitoring and identifying relevant vulnerabilities and patches
• Identifying risk in applying a patch
• Testing a patch before installing