Osborne How to Cheat at Managing Information Security

1. Auflage 2006
ISBN: 978-0-08-050828-3
Verlag: Elsevier Science & Techn.
Format: EPUB
Kopierschutz: 6 - ePub Watermark

E-Book, Englisch, 400 Seiten

This is the only book that covers all the topics that any budding security manager needs to know! This book is written for managers responsible for IT/Security departments from mall office environments up to enterprise networks.

These individuals do not need to know about every last bit and byte, but they need to have a solid understanding of all major, IT security issues to effectively manage their departments. This book is designed to cover both the basic concepts of security, non - technical principle and practices of security and provides basic information about the technical details of many of the products - real products, not just theory.

Written by a well known Chief Information Security Officer, this book gives the information security manager all the working knowledge needed to: . Design the organization chart of his new security organization . Design and implement policies and strategies . Navigate his way through jargon filled meetings . Understand the design flaws of his E-commerce and DMZ infrastructure

* A clearly defined guide to designing the organization chart of a new security organization and how to implement policies and strategies

* Navigate through jargon filled meetings with this handy aid

* Provides information on understanding the design flaws of E-commerce and DMZ infrastructure

Autoren/Hrsg.

Osborne, Mark

Inhaltsverzeichnis

1;Front Cover;1
2;How to Cheat at Managing Information Security;4
3;Copyright Page;5
4;Contents;12
5;Preface;24
6;Introduction;26
7;Chapter 1. The Security Organization;28
7.1;Anecdote;29
7.2;Introduction;29
7.3;Where Should Security Sit? Below the CEO, CTO, or CFO;33
7.4;Your Mission: If You Choose to Accept It;34
7.5;Role of the Security Function: What's in a Job?;34
7.6;The Hybrid Security Team: Back to Organizational Studies;39
7.7;What Makes a Good CISO?;44
7.8;Summary;45
8;Chapter 2. The Information Security Policy;46
8.1;Anecdote;47
8.2;Introduction;47
8.3;Policy, Strategy, and Standards: Business Theory;48
8.4;Back to Security;52
8.5;The Security Strategy and the Security Planning Process;52
8.6;Security Policy Revisited;13
8.7;Security Standards Revisited;63
8.8;Compliance and Enforcement;64
8.9;Summary;69
9;Chapter 3. Jargon, Principles, and Concepts;76
9.1;Anecdote;77
9.2;Introduction;77
9.3;CIA: Confidentiality, Integrity, and Availability;78
9.4;The Vulnerability Cycle;81
9.5;Types of Controls;83
9.6;Risk Analysis;85
9.7;AAA;90
9.8;Other Concepts You Need to Know;93
9.9;Generic Types of Attack;94
9.10;Summary;97
10;Chapter 4. Information Security Laws and Regulations;98
10.1;Anecdote;99
10.2;Introduction;100
10.3;U.K. Legislation;100
10.4;U.S. Legislation;109
10.5;Summary;113
11;Chapter 5. Information Security Standards and Audits;114
11.1;Anecdote;115
11.2;Introduction;116
11.3;ISO/IEC 27001:2005: What Now for BS 7799?;125
11.4;PAS 56;126
11.5;FIPS 140-2;129
11.6;Common Criteria Certification;130
11.7;Types of Audit;131
11.8;Summary;137
12;Chapter 6. Interviews, Bosses, and Staff;138
12.1;Anecdote;139
12.2;Introduction;139
12.3;Bosses;147
12.4;Worst Employees;149
12.5;Summary;149
13;Chapter 7. Infrastructure Security;150
13.1;Anecdote;151
13.2;Introduction;151
13.3;E-commerce;160
13.4;Just Checking;167
13.5;Summary;167
14;Chapter 8. Firewalls;170
14.1;Anecdote;171
14.2;Introduction;171
14.3;Firewall Structure and Design;174
14.4;Other Types of Firewalls;184
14.5;Commercial Firewalls;185
14.6;Summary;201
15;Chapter 9. Intrusion Detection Systems: Theory;202
15.1;Anecdote;203
15.2;Introduction;204
15.3;Why Bother with an IDS?;205
15.4;NIDS in Your Hair;208
15.5;For the Technically Minded;226
15.6;Summary;231
16;Chapter 10. Intrusion Detection Systems: In Practice;232
16.1;Anecdote;233
16.2;Introduction: Tricks, Tips, and Techniques;233
16.3;IDS Deployment Methodology;240
16.4;Selection;242
16.5;Deployment;243
16.6;Information Management;252
16.7;Incident Response and Crisis Management;254
16.8;Test and Tune;258
16.9;Summary;261
17;Chapter 11. Intrusion Prevention and Protection;262
17.1;Anecdote;263
17.2;Introduction;264
17.3;What Is an IPS?;264
17.4;Active Response: What Can an IPS Do?;265
17.5;A Quick Tour of IPS Implementations;266
17.6;Example Deployments;274
17.7;Summary;281
18;Chapter 12. Network Penetration Testing;282
18.1;Anecdote;283
18.2;Introduction;284
18.3;Types of Penetration Testing;285
18.4;Network Penetration Testing;286
18.5;Controls and the Paperwork You Need;301
18.6;What's the Difference between a Pen Test and Hacking?;303
18.7;Summary;307
19;Chapter 13. Application Security Flaws and Application Testing;308
19.1;Anecdote;309
19.2;Introduction;309
19.3;Configuration Management;311
19.4;Unvalidated Input;312
19.5;Bad Identity Control;322
19.6;Fixing Things;325
19.7;For the More Technically Minded;326
19.8;Summary;329
20;Index;330

Leseproben

Chapter 1 The Security Organization
The purpose of this chapter is to: ¦ Review typical positions of the information security function and the benefits of each ¦ Define the role of the security function ¦ Discuss the qualities of a good CISO Anecdote
To be a chief information security officer (CISO), you must demonstrate certain key qualities to an employer. At the interview for my last position, I sat down, miscalculating the touch-down so the arm of the chair slid neatly into my pants pocket with a ripping sound. My Top-Shelf consultancy suite was now complete with air-conditioning. I immediately announced, “I’ve ripped my trousers”—so my interviewers would know the exact source of the sound that had so obviously come from my seat. Then I said, “Now you can see that I’m not talking out of the seat of my pants. Now that’s the voice of experience! Introduction
No two organizations are the same; they are always different culturally and in terms of size, industrial sector, and staff. Consequently, there is no right (but probably plenty of wrong) answer to the question, “Where should we position the head of security and the security team(s) in an organization?” Separation of the position of the operational security teams away from the head of security is often a purposeful and commercial decision. This chapter reviews how organizations, both big and small, set up their security functions. It is based on my observations gained during 10 years experience in security consulting at both a strategic and a technical detailed level to many of the United Kingdom’s leading blue–chip companies. I have never seen this subject covered in any textbook or manual. Where to Put the Security Team
Figure 1.1 shows a typical firm with a number of potential positions for the security function. We will analyze the pros and cons of each position to answer the age-old question, where should information security sit? Figure 1.1 An Information Security Organization’s Hierarchy of Personnel Where Should Security Sit? Below the IT Director Report
The most common position for the CISO and the security function is reporting up through the IT director or the head of computer operations. Certainly the latter organizational structure is common in small firms where there is no regulatory requirement for security. If the company is regulated or even quoted on an exchange, the authorities may encourage a more elevated position. Strangely enough, it is also common in more visionary firms that have had a security team for 20 years—perhaps because the team evolved from a solid team of Resource Access Control Facility (RACF) administrators (RACF is security software for IBM mainframes)! Visit any organization with this structure and you will, within a very short time, recognize these benefits and failings. Pros Advantages of positioning the security team below the IT director include: ¦ The information security function will not receive much “outsider resistance” when it makes IT decisions, simply because it is part of the computer department. Therefore, it isn’t “external” interference. ¦ Operational computer security tasks (firewall installs, router access lists, and the like) will tend to be carried out by the team rather than by producing a specification for another team to execute. As a result, the team will become acknowledged local experts. ¦ Technical security staff can be allowed to specialize and work closely with other technical areas. Therefore, not only will there be skill transfer, but relationships should generally be better. Cons Disadvantages of positioning the security team below the IT director report include: ¦ Security will not have a powerful voice. ¦ Security will probably be under-funded. ¦ Security will not be independent; it will always be seen as taking the easiest route for the IT department. Typically, because of the low-ranking positions and the fact that it is embedded in the IT department, the focus will tend to be on computer security rather than information security. Business risk techniques to assess loss and impact will tend not to play a key role. Obviously, in some situations this positioning will not be a big disadvantage. One of the largest U.K. banks is organized exactly in this manner. But when you are a direct report to an IT director who is responsible for 5,000 people and you have over 100 security staff reporting to you, you probably won’t feel that your punch lacks power. Similarly, if the organization has nearly all its problems within the IT department and IT is the core business (such as with an Internet company), placement here could be a significant advantage. Generally, however, good all-round risk management cannot prosper in this layout. The scope of the role will allow the security function to manage digital and computer security very effectively, but influence over information risk management for nondigital assets may be advisory at best. This fact will have significant drawbacks at times (such as in the security of paper files), but computing is ubiquitous these days, so the influence of the role may still be considerable. As discussed later in the chapter, sound partnering with other departments may reduce this drawback considerably. Where Should Security Sit? Below the Head of Audit
Another far from ideal place to position a security team is to have it report to the head of the audit function. In my experience, this is where security teams are often dumped when they grow up and move from being a subdepartment of the computing department to having a wider scope. But if you have any sort of life, you don’t want to spend it with auditors, I promise you. Pros Advantages of positioning the security team below the head of auditing include: ¦ The team is independent from the computer department. ¦ The team will benefit from “whole business” governance mandate of the audit department. If the accounts team members are sharing passwords and you catch them, they will no longer excuse it by saying, “Oh, it’s just IT.” ¦ Your boss (the head of auditing) will insist that you take a holistic information security approach rather than just apply computer security. ¦ The security team will have powerful friends such as regulators or the audit committee. Cons Disadvantages of positioning the security team below the head of auditing include: ¦ Nobody is ever pleased to see an auditor. The team will tend to be perceived as judgmental and reactive, not proactive fixers or problem solvers. ¦ Auditors are often jacks-of-all-trades, not uncommonly struggling technically to do the jobs they do. The team will never be recognized as subject matter experts. Where Should Security Sit? Below the CEO, CTO, or CFO
Placing security below the CEO, CTO, or CFO is the best of all the basic positions. This reporting position ensures that other departments will take notice of your findings, yet it is independent from any operational department. Pros Advantages of positioning the security team below the CEO/CTO/CFO include: ¦ The security team is endowed with power. ¦ It is independent. ¦ The position is high enough to have a “whole business” remit. ¦ It shows everyone that your organization is taking security seriously. Cons Disadvantages of positioning the security team below the CEO/CTO/CFO include: ¦ The security team will be accused of being in an ivory tower (but so what). ¦ The security team will find it hard to look into the IT director’s business and organization. Your Mission: If You Choose to Accept It
So what does a good security team do? What are the team’s objectives? The answers to these questions will change from organization to organization, dependent on the particular information security strategy. The factors that may influence the answers, detailed at length in the next chapter, include legal requirements, regulatory requirements, and supplier and customer information security requirements. This section describes the common activities of an information security department. Role of the Security Function:...