Generally Accepted Principles and Practices for Securing Information Technology Systems
Generally Accepted Principles and Practices for Securing Information Technology Systems (GASSP), also known as NIST SP 800-14, are based on the Organization for Economic Co-operation and Development’(OECD) Guidelines for the Security of Information Systems, which were created in 1992 by a group of international experts.
An example of importance of NIST Special Edition (SP) 800-14 can be a case with Twitter, when this service was hacked by 18 years old man, who used an automated password –guesser on users’ accounts. This would not happen if Twitter’s administrators confined a number of rapid-fire log-in attempts. The hacker could used the password –guesser only because Twitter allowed unlimited number of log in efforts. “Weak Password Brings ‘Happiness’ to Twitter Hacker” (http://www.wired.com/threatlevel/2009/01/professed-twitt/ ). NIST (SP) 800-14 clearly says about necessity of limitation of log-on attempts (3.11.2 Authentication (3.11 Identification and Authentication)). The fault rests not only on Twitter, but also with users who used easy to guess passwords. The software the hacker used pick up the passwords from a special dictionary, and if users would create complicated passwords, they would not come to harm.
NIST SP 800-14 consists of 8 principles and more than 14 controls and practices. According to the GASSP, the principles address computer security from a very high-level viewpoint (developing computer security programs and policy etc), whereas the practices guide organizations on the types of controls, objectives and procedures that compromise an effective IT security.
The mentioned above 8 principles are:
1) Computer Security Supports the Mission of the Organization
The purpose of computer security is to protect an organization's valuable resources, such as information, hardware, and software.
2) Computer Security is an Integral Element of Sound Management
Information and IT systems are critical assets supporting the mission of an organization.
3) Computer Security Should Be Cost-Effective
The costs and benefits of security should be carefully examined in both monetary and nonmonetary terms to ensure that the cost of controls does not exceed expected benefits.
4) Systems Owners Have Security Responsibilities Outside Their Own
Organizations
If a system has external users, its owners have a responsibility to share appropriate knowledge about the existence and general extent of security measures so that other users can be confident that the system is adequately secure.
5) Computer Security Responsibilities and Accountability Should Be Made
Explicit
The responsibility and accountability of owners, providers, and users of IT systems and other parties concerned with the security of IT systems should be explicit.
6) Computer Security Requires a Comprehensive and Integrated Approach
Providing effective computer security requires a comprehensive approach that considers a variety of areas both within and outside of the computer security field. This comprehensive approach extends throughout the entire information life cycle.
7) Computer Security Should Be Periodically Reassessed
Changes in the Principles and Practices for Securing IT Systems system or the environment can create new vulnerabilities. Strict adherence to procedures is rare and procedures become outdated over time. These issues make it necessary to reassess periodically the security of IT systems.
8) Computer Security is constrained by Societal Factors
The ability of security to support the mission of an organization may be limited by various factors, such as social issues.
The ability of security to support the mission of an organization may be limited by various factors, such as social issues.
Common IT Security Practices
1. Policy
| 1. Program Policy (should: ) | 1) Create and Define a Computer Security Program 2) Set Organizational Strategic Directions 3) Assign Responsibilities 4) Address Compliance Issues |
| 2. Issue-Specific Policy (should: ) | 1) Address Specific Areas 2) Be Updated Frequently 3) Contain an Issue Statement |
| 4) System-Specific Policy (should: ) | 1) Focus on Decisions 2) Be Made by Management Official 3) Vary From System to System 4) Be Expressed as Rules |
| 5) All Policies (should be) | 1) Supplemented 2) Visible 3) Supported by Management 4) Consistent |
2. Program Management
| 1. Central Security Program (should have the following) | 1) Stable Program Management Function 2) Existence of Policy 3) Published Mission and Functions Statement 4) Long-Term Computer Security Strategies 5) Compliance Program 6) Intraorganizational Liaison 7) Liaison with External Groups |
| 2. System-Level Program (should have the following) | 1) System-Specific Security Policy 2) Life Cycle Management 3) Appropriate Integration with System Operations |
3. Risk Management
| 1. Risk Assessment (is comprised of three basic activities) | 1) Determine the Assessment's Scope and Methodology 2) Collecting and Analyzing Data 3) Interpreting Risk Assessment Results |
| 2. Risk Mitigation | 1) Select Safeguards 2) Accept Residual Risk 3) Implementing Controls and Monitoring Effectiveness |
| 4) Uncertainty Analysis | An uncertainty analysis should be performed and documented so that the risk management results can be used knowledgeably |
5) Life Cycle Planning
| 1. Security Plan | 1) Prepare a Security Plan |
| 2) Initiation Phase | 1) Conduct a Sensitivity Assessment |
| 2) Development/Acquisition Phase | 1) Determine Security Requirements 2) Incorporate Security Requirements Into Specifications 3) Obtain the System and Related Security Activities |
| 4) Implementation Phase | 1) Install/Turn-On Controls 2) Security Testing 3) Accreditation |
| 4) Operation/Maintenance Phase (The following items should be considered) | 1) Security Operations and Administration 2) Operational Assurance 3) Audits and Monitoring |
| 4) Disposal Phase (The following items should be considered) | 1) Information 2) Media Sanitization. |
3) Personnel/User Issues
| 1. Staffing | 1) Position Definition | a) Separation of duties |
| b) Least privilege | ||
| 2)Determining Position Sensitivity 3) Employee Training and Awareness | ||
| 2. User Administration | 1) User Account Management 2) Audit and Management Reviews 3) Detecting Unauthorized/Illegal Activities 4) Friendly Termination 5) Unfriendly Termination | |
4) Preparing for Contingencies and Disasters
| 1. Business Plan | 1) Identify Functions and Priorities |
| 2. Identify Resources | 1) Analyze Resources Needed 2) Overlap of Areas 3) Common Resources Used 4) Time Frame Needed |
| 3. Develop Scenarios | 1) Identify Possible Scenarios 2) Address Each Resource |
| 4. Develop Strategies | 1) Emergency Response 2) Recovery 3) Resumption 4) Implementation |
| 5. Test and Revise Plan | 1) Keep Current 2) Test |
5) Computer Security Incident Handling
| 1. Uses of a Capability (Should be used) | 1) Provide Ability to Respond Quickly and Effectively 2) Contain and Repair Damage From Incidents 3) Prevent Future Damage |
| 2. Characteristics (should have the following characteristics) | 1) Understanding of the Constituency It Will Serve 2) Educated Constituency 3) Centralized Communications 4) Expertise in the Requisite Technologies 5) Ability to Communicate Effectively 6) Links to Other Groups |
6) Awareness and Training
| Awareness and Training | 1) Identify Program Scope, Goals, and Objectives 2) Identify Training Staff 3) Identify Target Audiences 4) Motivate Management and Employees 5) Administer the Program 6) Maintain the Program 7) Evaluate the Program |
7) Security Considerations in Computer Support and Operations
1) User Support
2) Software Support
3) Configuration Management.
4) Backups
5) Media Controls
6) Documentation
7) Maintenance
8) Standardized Log-on Banner
8) Physical and Environmental Security
1) Physical Access Controls
2) Fire Safety Factors
3) Failure of Supporting Utilities
4) Structural Collapse
5) Plumbing Leaks
6) Interception of Data
7) Mobile and Portable Systems
9) Identification and Authentication
| 1. Identification | 1) Unique Identification 2) Correlate Actions to Users 3) Maintenance of User IDs 4) Inactive User IDs |
| 2. Authentication | 1) Require Users to Authenticate 2) Restrict Access to Authentication Data 3) Secure Transmission of Authentication Data 4) Limit Log-on Attempts 5) Secure Authentication Data as it is Entered 6) Administer Data Properly |
| 3. Passwords | 1) Specify Required Attributes 2) Change Frequently 3) Train Users |
| 4. Advanced Authentication (organizations should train users in the following: ) | 1) How to Use 2) Why it is Used |
10) Logical Access Control
| 1. Access Criteria | 1) Identity (user ID 2) Roles 3) Location 4) Time 5) Transaction 6) Service Constraints 7) Access Modes |
| 2. Access Control Mechanisms | 1) Access control lists (ACLs) 2) Constrained User Interfaces 3) Encryption 4) Port Protection Devices 5) Secure Gateways/Firewalls 6) Host-Based Authentication |
13. Audit Trails (Audit trails should be used for the following : )
1) Individual Accountability
2) Reconstruction of Events
3) Intrusion Detection
4) Problem Identification
| 1. Contents of Audit Trail Records (In general, an event record should specify: ) | 1) Type of Event 2) When the Event Occurred 3) User ID Associated With the Event 4) Program or Command Used to Initiate the Event |
| 2. Audit Trail Security (The following precautions should be taken: ) | 1) Control Online Audit Logs 2) Separation of Duties 3) Protect Confidentiality |
| 3. Audit Trail Reviews (The following should be considered when reviewing audit trails: ) | 1) Recognize Normal Activity 2) Contain a Search Capability 3) Follow-up Reviews 4) Develop Review Guidelines 5) Automated Tools |
| Keystroke Monitoring (If keystroke monitoring is used in audit trails, organizations should) | 1) Have Written Policy 2) Notify Users |
14.Cryptography
(Several important issues should be considered when designing, implementing, and integrating cryptography in an IT system):
1) Select Design and Implementation Standards
2) Decide on Hardware vs. Software Implementations
3) Manage Keys
4) Secure Cryptographic Modules
5) Comply with Export Rules
No comments:
Post a Comment