Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
201
From the moment the system account is created, its administration
begins, as well as logging and analysis of user actions. The environment in
which the user works, his job responsibilities, etc. gradually change. All this
requires a corresponding change in privileges. Technical difficulties arise
from temporary movements of the user, performance of duties in place of
an employee who has gone on vacation, and other circumstances when
authority must first be granted and then taken back after some time. During
such periods, the user’s activity profile changes dramatically, which creates
difficulties in identifying suspicious situations. A certain amount of care
should be taken when issuing new permanent authorizations, not forgetting
to eliminate old access rights.
Liquidation of a user’s system account, especially in the event of a
conflict between an employee and an organization, should be done as
quickly as possible (ideally, simultaneously with notification of punishment
or dismissal). It is also possible to physically restrict access to the
workplace. Of course, if an employee quits, he needs to take over all of his
computer equipment and, in particular, cryptographic keys if encryption
tools were used.
Adjacent to employee management is the administration of people
working under a contract (for example, specialists from a supplier company
helping to launch a new system). In accordance with the principle of
minimizing privileges, they should allocate only as many rights as necessary
and withdraw those rights immediately at the end of the contract. The
problem, however, is that at the initial stage of implementation, “external”
employees will administer “local” ones, and not vice versa. Here, the
qualifications of the organization’s personnel, their ability to learn quickly,
as well as the prompt delivery of training courses come to the fore. The
principles for choosing business partners are also important.
Sometimes external organizations accept critical components of a
computer system, such as network equipment, for maintenance and
administration. Administration is often performed remotely. Generally
speaking, this creates additional vulnerabilities in the system, which must
be compensated for by increased control of remote access tools or, again, by
training your own employees.
202
Physical protection
The security of an information system depends on the environment in
which it operates. It is necessary to take measures to protect buildings and
surrounding areas, supporting infrastructure, computer equipment, and
storage media.
The basic principle of physical protection, compliance with which
should be constantly monitored, is formulated as “continuity of protection
in space and time.” Previously, we looked at the concept of a danger
window. For physical protection, such windows should not exist. Directions
of physical protection:
• physical access control;
• fire safety measures;
• protection of supporting infrastructure;
• protection against data interception;
• protection of mobile systems.
Physical access control measures allow you to control and, if
necessary, restrict the entry and exit of employees and visitors. The entire
building of an organization can be controlled, as well as individual rooms,
for example those where servers, communication equipment, etc. are
located.
When designing and implementing physical access control measures,
it is advisable to use an object-based approach. First, a security perimeter is
determined that limits the controlled territory. At this level of detail, it is
important to think through the external interface of the organization — the
order of entry/exit of staff and visitors, bringing in/out of equipment.
Everything that is not included in the external interface must be
encapsulated, that is, protected from illegal penetration.
Secondly, the controlled territory is decomposed, (sub)objects and
connections (passages) between them are identified. With such deeper
detail, the most critical from a security point of view should be identified
among the subobjects and given special attention. The decomposition must
be semantically justified, ensuring the distinction between heterogeneous
203
entities, such as equipment of different owners or personnel working with
data of varying degrees of criticality.
It is necessary that, if possible, visitors do not have direct access to
computers or, in extreme cases, ensure that monitor screens and printers are
not visible from windows and doors. It is necessary that visitors can be
distinguished from employees by their appearance.
Physical access controls include security guards, doors with locks,
partitions, cameras, motion sensors and much more. To select the optimal
(according to the cost/effectiveness criterion) means, it is advisable to
conduct a risk analysis (we will return to this later). In addition, it makes
sense to periodically monitor the emergence of technical innovations in this
area, trying to automate physical protection as much as possible.
We note the need to install fire alarms and automatic fire extinguishing
equipment. Supporting infrastructure includes electrical, water and heat
supply systems, air conditioning and communications. When placing
computers, you should take into account the location of water and sewer
pipes and try to stay away from them. Employees should know where to go
when leaks are detected.
Data interception can be carried out in a variety of ways. An attacker
can spy on the monitor screen, read packets transmitted over the network,
analyze side electromagnetic radiation and interference (SEMRI), etc. We
can only rely on the widespread use of cryptography (which, however, in
our country is associated with many technical and legislative problems), try
to expand the controlled area as much as possible by staying in a quiet
mansion, away from other houses, try to control the communication lines
(for example, enclose them in an inflatable shell with puncture detection),
but the most reasonable thing is probably to try to realize that for
commercial systems, ensuring confidentiality is still not the main task.
Mobile and laptop computers are tempting targets for theft. They are
often left unattended, in a car or at work, and it is not difficult to steal such
a computer. Every now and then the media report that some British
intelligence officer or American military man has lost movable property in
204
this way. We strongly recommend encrypting the data on the hard drives of
such computers.
Generally speaking, a risk analysis should be performed when
selecting physical protective equipment. Thus, when deciding to purchase
an uninterruptible power supply, it is necessary to take into account the
quality of the power supply in the building occupied by the organization
(however, it will almost certainly turn out to be poor), the nature and
duration of power failures, the cost of available sources and possible losses
from accidents (breakdown of equipment, suspension of the organization’s
work and so on.).
At the same time, in many cases the solutions are obvious. Fire safety
measures are mandatory for all organizations. The cost of implementing
many measures (for example, installing a regular lock on the door of a server
room) is either small or, although noticeable, is still clearly less than the
possible damage. In particular, it makes sense to back up large databases
regularly.
Maintenance
Next, we will consider a number of measures aimed at maintaining the
performance of information systems. This is where the greatest danger lies.
Unintentional mistakes by system administrators and users threaten to
damage equipment, destroy programs and data; at best, they create security
holes that make threats possible.
Underestimating safety factors in everyday work is the Achilles heel
of many organizations. Expensive security features are meaningless if they
are poorly documented, conflict with other software, and the system
administrator password has not been changed since installation.
The following areas of daily activity can be distinguished:
1) user support;
2) software support;
3) configuration management;
4) backup;
205
5) media management;
6) documentation;
7) routine maintenance.
User support primarily involves providing advice and assistance in
solving various types of problems. Sometimes organizations create a special
“help desk” for this purpose, but more often the system administrator
discourages users. It is very important to be able to identify problems related
to information security in a stream of questions. Thus, many difficulties for
users working on personal computers may be the result of virus infection. It
is advisable to record user questions in order to identify their common
mistakes and issue reminders with recommendations for common situations.
Software support is one of the most important means of ensuring
information integrity. First of all, you need to keep track of what software
is installed on your computers. If users install programs at their own
discretion, this can lead to infection with viruses, as well as the emergence
of utilities that bypass protection measures. It is also likely that the
“independent activities” of users will gradually lead to chaos on their
computers, and the system administrator will have to correct the situation.
The second aspect of software support is control over the absence of
unauthorized changes to programs and access rights to them. This also
includes support for reference copies of software systems. Control is
typically achieved through a combination of physical and logical access
controls, as well as the use of verification and integrity utilities.
Configuration management allows you to control and record changes
made to the software configuration. First of all, you need to insure yourself
against accidental or ill-conceived modifications, and be able to at least
return to a previous, working version. Committing changes will make it easy
to restore the current version after a disaster.
The best way to reduce errors in routine work is to automate it as much
as possible. Automation and security depend on each other; the one who
cares primarily about making his task easier actually creates an information
security regime in an optimal way.
206
Backup is necessary to restore programs and data after disasters. And
here it is advisable to automate the work, at a minimum by creating a
computer schedule for creating full and incremental copies, and, at a
maximum, by using the appropriate software products. It is also necessary
to arrange for the placement of copies in a safe place, protected from
unauthorized access, fires, leaks, that is, from anything that could lead to
theft or damage to the media. It is advisable to have several copies of backup
copies and store some of them off-site, thus protecting against major
accidents and similar incidents. From time to time, for test purposes, you
should check the possibility of restoring information from copies.
Media management is necessary to provide physical security and
accounting for floppy disks, tapes, printed output, etc. Media management
must ensure the confidentiality, integrity, and availability of information
stored outside computer systems. Physical protection here means not only
repelling unauthorized access attempts, but also protection from harmful
environmental influences (heat, cold, moisture, magnetism). Media
management must span the entire lifecycle, from procurement to
decommissioning.
Documentation is an integral part of information security. Almost
everything is documented in the form of documents — from the security
policy to the media log. It is important that the documentation is up-to-date
and reflects the current state of affairs, and in a consistent manner.
Confidentiality requirements apply to the storage of some documents
(containing, for example, an analysis of system vulnerabilities and threats),
while others, such as a disaster recovery plan, are subject to integrity and
availability requirements (in a critical situation, the plan must be found and
read).
Routine maintenance is a very serious safety hazard. An employee
performing routine maintenance receives exclusive access to the system, and
in practice it is very difficult to control exactly what actions he performs. This
is where the degree of trust in those doing the work comes to the fore.
207
Responding to Security Violations
The security program adopted by the organization must provide a set
of operational measures aimed at detecting and neutralizing violations of the
information security regime. It is important that in such cases the sequence
of actions is planned in advance, since measures need to be taken urgently
and in a coordinated manner.
Response to security breaches has three main goals:
1) localization of the incident and reduction of harm caused;
2) identification of the violator;
3) prevention of repeated violations.
The organization must have a person available 24 hours a day (in
person, by telephone, pager or email) who is responsible for responding to
violations. Everyone should know the coordinates of this person and contact
him at the first sign of danger. In general, just like in case of a fire, you need
to know where to call and what to do before the fire brigade arrives.
Often the requirement to localize an incident and reduce harm comes
into conflict with the desire to identify the offender. In an organization’s
safety incident, the actions taken during an incident must be prioritized in
advance. The priority scale might look like this:
• protection of people’s life and health;
• protection of secret and/or critical data;
• protection of other data, including private, scientific and
management information;
• preventing damage to systems;
• minimizing the damage caused to computing resources.
Identification of an incident is accompanied by clarification of its scale
and possible consequences, and for effective counteraction it is important to
correctly determine its boundaries. In addition, assessing potential impacts
will help set priorities when allocating resources to respond.
To find the violator, you need to find out in advance the contact
coordinates of the network service provider and agree with him on the very
possibility and procedure for performing the appropriate actions. To prevent
208
repeated violations, it is necessary to analyze each incident, identify the
causes, and accumulate statistics. What are the sources of malware? Which
users tend to choose weak passwords? The results of the analysis should
answer such questions.
It is necessary to monitor the emergence of new vulnerabilities and
eliminate the danger windows associated with them as quickly as possible.
Someone in the organization must oversee this process, take short-term
measures, and adjust the security program to take long-term measures.
Hostile actions, be it an attack by external attackers or the revenge of
an offended employee, must be foreseen in advance. There is no substitute
for a pre-designed restoration plan. The incident response sections of the
security policy should cover the following topics:
• review (goals pursued by the security policy in terms of response to
incidents);
• assessment (how serious the event is);
• notification (who should be notified about it);
• response measures (what should be done in response);
• legal aspect (what are the legal consequences of what happened);
• recording documentation (what should be recorded before, during
and after the incident).
When it is certain that a security breach has occurred, the appropriate
personnel should be notified. To keep events under control from both a
technical and emotional point of view, it is very important who is notified
and how.
Any message about an incident must be intelligible, any phrase must
be clear, accurate and complete. Attempting to hide certain issues by
providing false or incomplete information can not only hinder an effective
response, but also lead to a worsening situation.
Measures taken to combat the violation can be divided into main
categories:
• containment;
• liquidation;
• recovery;
• analysis.
209
The purpose of deterrence is to limit the area under attack. For
example, stopping the spread of a worm on the network as quickly as
possible.
When the task of containment is solved, liquidation can begin.
Software tools (in particular, antivirus packages) will help with this.
After the attack is eliminated, it is time for recovery, i.e., bringing the
system back to normal. At a minimum, the following actions should be
taken:
1) re-register system assets, i.e. carefully check the condition of the
systems;
2) incorporate lessons learned from the incident into a revised security
program to ensure that a similar breach does not occur again;
3) carry out a new risk analysis taking into account the information
received;
4) begin an investigation against those responsible for the incident, if
deemed necessary.
Removing all the vulnerabilities that made a security breach possible
is not easy, but it is necessary. The key here is to understand the mechanism
of invasion.
When restoring, you may have to return to the initial state of the system
and then configure it. To make it easier to deal with even this worst-case
scenario, it is advisable to keep a record of the initial settings and any
changes made.
Analysis is one of the most important stages of incident response, yet
it is almost always forgotten. It is important because it allows all those
involved to learn lessons so that they can act more effectively in similar
situations in the future.
You need to get answers to at least the following questions:
1. What exactly happened and when?
2. How well did the staff perform?
3. What urgent information was needed first and what contributed to
its speedy receipt?
4. What should you do differently next time?
210
After restoring a system, vulnerabilities or even traps often remain.
During the analysis phase, the system must be thoroughly examined to
identify problems missed during recovery. As a starting point, it is wise to
use security control software.
It is advisable to document all the details associated with the incident:
how it was discovered, remediation procedures, monitoring procedures, and
lessons learned. Detailed documentation ultimately leads to time savings
and allows you to assess the extent of damage caused.
Remediation planning
No organization is immune from serious accidents caused by natural
causes, malicious actions, negligence or incompetence. At the same time,
every organization has functions that management considers critical and
must be performed no matter what. Planning restoration work allows you to
prepare for accidents, reduce damage from them and maintain the ability to
function at least to a minimum extent.
Note that information security measures can be divided into three
groups, depending on whether they are aimed at preventing, detecting or
eliminating the consequences of attacks. Most measures are precautionary
in nature. Operational analysis of registration information and some aspects
of response to violations (the so-called active audit) serve to detect and repel
attacks. Restoration planning obviously falls into the last of the three groups
listed.
The restoration planning process can be divided into the following
stages:
1) identifying critical functions of the organization, setting priorities;
2) identification of resources necessary to perform critical functions;
3) determining the list of possible accidents;
4) development of a strategy for restoration work;
5) preparation for the implementation of the chosen strategy;
6) checking the strategy.
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]