Добавил:
ivanov666
Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз:
Предмет:
Файл:Information protection in digital communication systems. Textbook
.pdf
241
To prevent access to the local network using the resources of public
servers, it is recommended to connect public servers in front of the firewall
as shown in Fig. 6.8, b. This method has higher security for the local
network, but a lower level of security for public servers.
Internet
Router
Firewall
LAN
Public services
Internet
Router
Firewall
LAN
Public services
а б
Fig. 6.8. Options for installing ME into the network:
a — simple inclusion of ME;
b — connecting the ME with the removal of public servers
Excursion into WWW technology. WWW is a client-server
technology based on the HTTP application protocol. It contains two types
of messages: requests from the client to the server and responses from the
server to the client. The TCP protocol is used to transmit messages; the
standard HTTP server port is 80.
Obviously, not all WWW information resources can be open to public
viewing. In order to restrict access to any resource, client authentication is
used, i.e., the client must provide a username and password before its
password can be serviced by the HTTP server.
The mail service (e-mail) uses the SMTP (Simple Mail Transfer
Protocol) and POP3 (Post Office Protocol) protocols.
The main purpose of the SMTP protocol is the reliable and efficient
delivery of electronic mail messages. SMTP is a fairly independent system and
only requires a reliable communication channel. The environment for SMTP
can be a separate local network, a system of networks, or the entire Internet.
242
SMTP is based on the following communication model: in response to
a user request, the sending mail program establishes a two-way connection
with the receiving program (TCP, port 25). The recipient can be a final or
intermediate destination. SMTP commands are generated by the sender and
sent to the recipient. Each command must be sent and received.
In some small Internet sites, it may not be practical to support the
Message Transport System (MTS). The workstation may not have sufficient
resources to ensure continuous operation of the SMTP server. It is too
expensive for home computers to maintain a connection to the Internet
around the clock.
POP3 provides email access to small nodes and personal computers.
This protocol provides host access to the underlying mail server. POP3
receives and erases email messages. When a computer client user wants to
send a message, he establishes an SMTP connection with the mail server
directly and sends everything he needs through it. In this case, the POP3
server is not necessarily a mail server. At the initial moment, the computer
POP3 server listens to TCP port 110. If the computer client wants to use the
services of the POP3 server, it establishes a TCP connection with it. Once
the connection is established, the POP3 server sends a notification to the
client, and the session enters the authorization phase. After this, commands
and responses can be exchanged.
With the goal of protecting the assets of the organization’s internal
network, and also not loading the firewall, we will install a screen after
public services.
The information protection system at the “perimeter” level, in addition
to the firewall, includes the following security services (Security services):
1) automated administrator workstation;
2) anti-virus gateway;
3) system security audit server;
4) means of adaptive security management ANS (Adaptive Network
Security) and attack detection IDS (Intrusion Detection System);
5) mail checking tools, etc.
The distributed database service acts as an internal service.
243
Dividing the network into segments is achieved through a switch
(Switch), through which access/denial is also carried out:
• from one local segment to another;
• from the internal network to internal services (for example, to a
distributed enterprise database);
• from the internal network to public services;
• from the internal network to the Internet.
Thanks to the switch, you can set any security policy.
The described structure of the organization’s information network is
presented in Fig. 6.9.
Public services
Internet
Modem
Router
Hub
Security services
(Firewall, IDS,… )
Mail Server
Web Server
FTP Server
………
Other services
Switch
Segment 2
Segment 1
Segment N
………
IDS
Fig. 6.9. Enterprise information network security model
244
6.6. STANDARD SECURITY POLICY FOR A SMALL
AND MEDIUM BUSINESS — SET OF DOCUMENTS
AND INSTRUCTIONS
For the enterprise information network security model presented in the
previous paragraph (Fig. 6.9), you must provide:
• standard security policy;
• standard documents and instructions;
• basic means, methods and elements of information security.
6.6.1. Typical Security Policy
A typical security policy was developed for an organization that has
access to the Internet and has resources that need access from the Internet.
Network Security
Access from the Internet to the company’s corporate network.
Access to the internal network from outside is prohibited.
Access to the firewall from outside is prohibited.
Access to the following services: anti-virus gateway, system security
audit server, adaptive security management and attack detection tools, mail
checking tools, is prohibited from outside.
Access to WWW, FTP, e-mail services from outside is permitted
according to the following rules:
1) for WWW service:
• external access is allowed to everyone only to port 80;
• WWW server administrator access is allowed only from the
administrative management segment when going through the
authentication/identification procedure on the firewall;
2) for e-mail server:
• access from the company’s internal network to the POP3 service is
allowed via port 110;
245
• access from the company's internal network to the SMTP service via
port 25 is allowed.
Firewall. The Firewall is administered only locally from the
automated workstation of the network administrator (the administration
procedure is possible after authentication/identification by the user
(administrator)). Anti-virus programs and necessary patches are regularly
installed and updated, and the most secure operating system configuration
is maintained.
Adaptive security controls. The security analysis system (Internet
Scanner) is administered locally from the network administrator’s
automated workstation. Analysis of comprehensive and/or selective tests of
operating systems, application software used, router, firewall, all servers,
etc. is carried out by the security administrator regularly (once a week).
IDS attack detection system is used to automatically reconfigure the
firewall in case of detection of attacks. The service controls all incoming
traffic from the Internet.
Logging tools. Special files are maintained:
• the firewall records in a log file all requests and communication
attempts (successful and unsuccessful) from the corporate network and to
the corporate network;
• the attack detection system remembers all attacks and suspicious
activities (also in a log file);
• the Web service stores information about all visitors (log file);
• the security administrator must maintain a file containing
information about all changes and attempts to change information in the log
files of previous services.
Switch:
• access from all network segments to the Internet is allowed without
restrictions;
• access from user networks to administrator networks (management,
security) is prohibited.
Local security. Aimed at protecting every computer on the network.
Anti-virus control. Must be performed on all workstations.
246
Protection against UA. It is necessary to install an anti-tampering
system, which should control and limit access to each workstation and
server. The system should:
• require a password at boot to identify a simple user;
• block access to setup of all workstations and servers for all users
except the administrator;
• block the computer if the user has left his place.
Cryptographic data protection. Company employees must save
information, starting with the “strictly confidential” level (see clause 6.2),
on a special crypto disk.
Personal firewall protection. All workstations must be protected by a
personal firewall (implemented in software).
Data backup. It is mandatory for users to back up important data on
personal computers to the company’s internal data server.
Access logging. When a user has local access to a workstation (an
administrator to servers), a log file of his visits is maintained (all successful
and unsuccessful login attempts are logged).
Physical Security
All security and data services must be located in a separate room,
access to which is limited to administrators (who have a key or magnetic
card to this room).
It is necessary to introduce a separate security administrator position;
all changes in systems will be made by the IT administrator and the security
administrator in pairs (the password is divided into two parts: one segment
per specialist).
The room should be equipped with forced ventilation and fire
protection (semi-automatic or automatic), possibly with video surveillance
of the actions of administrators.
It is necessary to control the flow of company employees and visitors
(either using special passes or magnetic cards).
247
6.6.2. Standard documents and instructions
In accordance with the recommendations of the British Standard BS
7799:1995, we will include the following sections in the document
characterizing the organization’s security policy:
1. Introductory section.
2. Organizational section.
3. Classification.
4. Staff section.
5. Section of instructions and requirements for ensuring the company’s
internal information security.
Compliance with the four-level model for ensuring the security of an
enterprise information network. The first three sections correspond to the
administrative level of information protection, the fourth section
corresponds to the procedural level, and the fifth section of documents
corresponds to the software and hardware level.
It was previously said that the SP consists of two (three) levels; the
larger the enterprise, the more complex the policy structure. For small and
medium-sized businesses, it is enough to provide a two-level structure of
the security policy; let’s call the upper level “administrative” and the lower
level “technical”. Thus, the “administrative” section will include documents
from the introductory, organizational, classification and staffing sections.
The “technical” section will cover a set of rules, instructions and
requirements for ensuring the information security of an organization.
Introductory section
The position of the enterprise administration on the issue of protecting
information assets. Reliable functioning of the enterprise information
computer network is part of the production process. Protecting an
enterprise’s information assets is essential.
248
Typical enterprise goals in the field of information security. The
priority goal of any enterprise is to ensure the integrity, confidentiality, and
availability of information. For private purposes:
• following economic feasibility in choosing protective measures;
• ensuring accountability of all user actions with information resources
and analysis of registration information, etc.
Organizational section
This section includes a description of all user groups related to work
in the field of information security. In principle, this formulation can be
interpreted in different ways, since each network user is in one way or
another responsible for some part of the production of information with
which he works. In this context, this document can be considered as a
provision on the categorization of users of an automated system.
This document may also contain provisions for categorizing resources.
Regulations on the categorization of AS users.
The AS includes the following user groups:
1. Administrators group. It includes information technology and
security administrators. Administrators have full access to AS resources for
its administration.
2. Group Top managers. The group includes: company president,
general director, technical director, deputies, etc.
3. Group Employees. The group includes all company employees
(economists, accountants, HR employees, ...).
Each user group has different access rights to information of different
privacy levels. The level of secrecy is determined by the regulations on the
categorization of the organization’s resources.
Regulations on the categorization of resources.
The company introduces the following levels of information secrecy
categories:
• publicly available;
• confidential;
249
• strictly confidential;
• secret.
Company employees are strictly prohibited from disclosing
information to anyone, starting from the “confidential” level.
Public information is information that has already been published in
the media, as well as on the company’s website. The decision to assign
“Public” status is made by the CEO or CTO.
Confidential information in the company is any internal information
of the company (official, staff, ...).
Strictly confidential information in the company is:
• commercial information (texts of contracts and agreements with
partners and clients);
• technical information (texts of reports, technical specifications,
significant documents, products, licensing keys, etc.).
The decision to give the status of “Strictly Confidential” to
commercial information is made by the General Director. The decision to
assign “Strictly Confidential” status to technical information is made by the
technical director.
Procedure for handling information subject to protection. The
following information activities must be clearly described and classified:
1) copying;
2) storage;
3) transmission by mail, fax, e-mail;
4) voice transmission, including mobile phones, voice mail;
5) destruction.
1. Information at the “publicly available” level. Access, copying and
any transfer of information at this level is not limited. Destruction of
information is possible only by its owner.
2. “Confidential” level information. Subject to protection from
unauthorized access using access control means.
This information can be accessed by company employees locally and
remotely. Remote access from the corporate network is carried out without
250
the use of traffic encryption. Remote access from the Internet is carried out
using traffic encryption tools.
Access to “confidential” level information is provided by categories
of users: Administrators, Top Managers, Employees.
Copying and any transfer of information at this level is limited to the
perimeter of the company. Destruction of information is possible only by its
owner.
3. Information at the “strictly confidential” level. Subject to protection
from unauthorized access using access control and cryptographic protection.
Remote access from the corporate network is carried out using traffic
encryption. Remote access of employees from the Internet is carried out
using traffic encryption tools. Copying and any transfer of information at
this level is possible only within the company and only to authorized
persons. Destruction of information is possible only by its owner.
Only the security administrator and the IT administrator have the right
to delete information at the “secret” level (the password is divided into two
parts between them) with the permission of CTO.
Access to “strictly confidential” level information is provided by
categories of users: Top managers, Employees (with the permission of the
technical director).
4. Information of the “secret” level is subject to protection from
unauthorized access, cryptographic protection and mandatory access
logging.
Remote access from the corporate network is carried out using traffic
encryption. Remote access from the Internet is prohibited. Copying and any
transfer of information at this level is possible only within the company and
only to authorized persons. Destruction of information is possible only by
its owner.
Only the security administrator and the IT administrator have the right
to delete information at the “secret” level (the password is divided into two
parts between them) with the permission of those. director.
Access to “strictly confidential” level information is provided by
categories of users: Top managers.
Соседние файлы в предмете [НЕСОРТИРОВАННОЕ]