Chapter 5

 Physical security is an important part of organization security which helps organization faces and solves natural environment threats, supply system threats, man-made threats and politically motivated threats.

 How to make a plan:

A very good physical and environment security summary link:
http://it.med.miami.edu/x2230.xml

Chapter 4

4.1 System Architecture

4.2 Computer Architecture

ISO/IEC 42010: 2007: International guidelines of creating and maintaining system architectures

CPU: computer’s brain

ALU: logical and math part of CPU

Register: memory

Control unit: controlling and collection data and order and sending them to CPU

General registers: ALU’s “scratch pad”

Special registers: special and important data storage

Program counter: memory address

Stack: communicate instructions and data to each other

Program status word: the variable that indicates to the CPU what mode instruction need to be carried out in.

User mode: protection mode

Kernel mode: confidence mode

Address bus: connection between processing component and memory segment used to communicate the physical memory address

Data bus: connection between processing component and memory segment used to transmit data

Symmetric mode multiprocessing: two or more CPU work in one mode

Asymmetric mode multiprocessing: two or more CPU work in different mode

4.3 Operating System:

Processes enter and exit different states

A process table contains process status data that the CPU requires:

Process one code executed, moving process one’s status data into CPU, CPU work process one, Process two code executed, moving process one’s status data back to process table, moving process two’s status data into CPU, CPU work process two

Thread management:

4.4 Type of Memory:

Random Access Memory (RAM): temporary storage

Read-Only Memory (ROM): if the data put in ROM, it won’t be change

Cache Memory: high-speed writing and reading memory

4.5 Input and Output Device Management and CPU Architecture:

Programmable I/O: if using programmable I/O, it means CPU sent data to I/O and check if it is ready to accept more data.

Interrupt-Drive I/O: if using interrupt-Drive I/O, it means CPU stop one activity and to process other program.

I/O using DMA: work without CPU

Premapped I/O and fully mapped I/O: system trust premapped, and it doesn’t trust fully very much.

CPU Architecture:

Models è Programming language è Operating system (OS) è Instruction set architecture è Microarchitecture è Hardware

4.6 Operating System Architectures:

Layered operating system: User applications (User space) è I/O management (kernel) è Message interpreter (kernel) è Memory management (kernel) è Processor allocation and process scheduling (kernel) è Hard ware; and the hardware sent information back.

Monolithic: all operating system in kernel mode.

Microkernel: core operating system processes run in kernel mode and the remaining ones run in user mode

Hybrid microkernel: all operating system processes run in kernel mode

47 System security modes:

Bell-LaPadula model: it has the simple security, *-property rul, the strong star property rule

Biba model: the simple intergrity axiom, the #-integrity axiom,

Clark-Wilson model: subject only access object, separation duties, auditing is required

Information flow model: information just work under its security policy

Noninterference model: built-in system, outside can’t join it

Brewer and Nash model: Chinese wall

Chapter 3

3.1 Access Control: security control between users and system.

Access: information exchange between object and subject. Subjects use objects.

Security Principles: availability (useful, can be used), integrity (not fragment), confidentiality (security).

3.2 Identification (Who you are) è Authentication (proving who you are) è Authorization (telling you what sources you can use) è Sources è Accountability (monitoring user)

Organizing all of this stuff (rules): 1. Family tree structure; 2. unique name with specific attributes; 3. Attributes are decided by defined schema; 4. Distinguished names.

Web management:

Password management: 1. Password Synchronization (Complexity); 2. Self-Service Password Reset (customers reset password by themselves); 3. Assisted Password Reset (using ID, email, phone number, question, and fingerprint to reset password).

Single sign-on technology: Kerberos, SESAME, Security domains, Directory, and Thin clients.

3.3 Access control models:

a. Discretionary access control (which source you can have depend who you are and what be allowed)

b. Mandatory access control (depending on what security level you are)

c. Role- based access control (Limited hierarchies and general hierarchies; depending on who you are and what’s your job)

3.4 Access control techniques:

Access control matrix: relationship between subjects and objects

Access control list: which subjects can be access by objects

Capability table: which objects can be use by subjects

Content-based access: bases access decisions on the sensitivity of the data

Context-based access: bases access decisions on the state of the situation

Restricted interface: user’s environment limits

Rule-based access: control subjects’ access

3.5 Access control administration (centralized access control administration, RADUIS, TACACS, and Diameter):

AAA: Authentication (PAP, CHAP, EAP; End-to-end protection; Replay attack protection)

         Authorization (Redirects, secure proxies, relays, and brokers; state reconciliation; unsolicited disconnect; reauthorization on demand)

         Accounting (reporting, roaming operations accounting, event monitoring)

3.6 Access control layers:

a. Administrative controls: policy and procedures; personnel controls; supervisory structure; security-awareness training, testing

b. Physical controls: network segregation; perimeter security; computer controls; work area separation; data backups; cabling; control zone

c. Technical controls: system access; network architecture; network access; encryption and protocols; auditing

3.7 Accountability

Remember:

Store the audits security; control the size of logs; protected logs; training people check logs in right ways; only administrators can delete logs; logs have high level security

3.8 IDS types:

Signature-based: pattern matching; continuously updated; can’t identify new attacks; (two types) Pattern matching and Stateful matching

Anomaly-based: it know what is “normal environment;” detect new attacks; behavior or heuristic; (three types) Statistical anomaly-based, Protocol anomaly-base, and Traffic anomaly-based

Rule-based: IF/THEN rule; artificial intelligence; high requirement of software and hardware; can’t detect new attacks

Directed study chapter 2 Fall 2014

2.1 Security objectives:

 a. Availability: reliability and timely access to data and resources.

 b. Integrity: accuracy and reliability of information and system.

 c. Confidentiality: necessary level of secrecy at each junction of data.

 2.3 a. Layered model:

              Fence, Locked external doors, closed-circuit TV, security guard, locked internal doors, locked server room, physically secured computers.

   b. Technical controls:

              Firewalls, intrusion detection system, intrusion prevention systems, antimalware, access control, encryption.

2.3 a. Layered model:

              Fence, Locked external doors, closed-circuit TV, security guard, locked internal doors, locked server room, physically secured computers.

   b. Technical controls:

              Firewalls, intrusion detection system, intrusion prevention systems, antimalware, access control, encryption.
 c. The open group architecture framework (TOGAF):(Business activities) choice (data) decide (App) use (technology)

 d. NIST: business drive information and decide standards; information decide system; system choice data and also give feedback to business; data support hardware, software and communications
 e. CobiT: IT sources ==> plan and company ==> achieve goals ==> payment ==> control and evaluate ==> IT sources.
 f. PDCA sycle:
Plan ==> processing ==> control and evaluate ==> solve problems ==> new plan

Coso: control environment, risk assessment, control activeties, information and communication, monitoring.

2.5 Risk: physical damage, human interaction, equipment malfunction, inside and outside attacks, misuse of data, loss of data, application error.

IRM policy: team, risk level, identification of risk, connection between organization’s strategic and IRM policy, IRM’s duty in organization, internal control, the change of staff behavior and resource allocation, budgets, main purpose.

2.6 Main goals of risk analysis:

       a. Identify the value of assets

       b. Vulnerabilities and threats

       c. Quantify the threat

       d. Budgets

2.7 NIST: system characterization, threat identification, vulnerability identification, control analysis, likelihood determination, impact analysis, risk determination, control recommendations, results documentation.

Risk management of NIST:
(1) system check, (2) find threat, (3) find vulnerability, (4) control threat, (5)likelihood determination, (6) analysis, (7) make sure risk, (8) recommendations, (9) results

2.8  Functionality and effectiveness: **(P95 - 95 table 2-10)**

2.9 Four ways of handing risk: transfer, avoid, reduce, and accept.

2.10 Security Policy:

       a. Business objectives drive the policy creation

       b. Easily to understand

       c. Can be used in all of business processes and functions

       d. Legal

       e. Changing with company development

       f. Daily control

       g. Easy to research

       h. Foresight

       i. Professional level

       j. Regularly manage policy

2.11 Classifications levels:
Public: no bad affection for company
Sensitive: need be protect.
Private: employees' personal information,no good for share.
Confidential: The most important thing.
Unclassified: can be publicized
SBU: no sharing information
Secret: Serious damage if disclosed
Top secret: you won't never want to tell others.

2.12 Layers of Responsibility

       a. Board of directors (control the fulfillment of the corporation’s charter)

       b. Executive management (“C” people’s duty is daily management) and security    steering committee (“C” people and technology supporter)

       c. Audit committee (you need they pay)

       d. Data owner, data custodian, system owner, security administrator, security analyst, application owner, Change control analyst, data analyst, data analyst,        process owner, solution provider (technician and supervisor, they are basis      layer)

       e. User, product line manager and auditor (they are user)