IT security assessments in hybrid network infrastructures

¶ … IT Security Assessments (Process of matching security policies against the architecture of the system in order to measure compliance

The systems security assessment is the method of creating a security policy that would be complimentary to the architecture of the system and the method would allow for the measure of compliance. Security assessments are activities that belong to the phase of the design cycle, and that is because it is very difficult to assess the risk of a system that is already functioning. Assessing risk alone does not make the process true. The issues of costs, and the types of security architecture and many other necessities that are outside the actual security measures need to be considered because they come into play. (Ramachandran, 2002) There is also the complexities of the networks itself to consider. Modern internet-based systems have created hybrid network configuration that brings the problems of scalability. One type of hybrid network is the integration of mobile wireless networks and the internet.

The primary network in the case of the internet and other networking is the grid. It is defined as a combination of hardware and software created infrastructure that provides a platform for dependable, consistent and inexpensive access to high end computing capabilities. There is thus resource sharing and the types of grids are cluster, enterprise, and global grids. (Merkow; Breithaupt, 2005) While the entire grid may thus be given a security system, each administrative domain must also have its own protocol to suit the type it is and also integrate to the grid. Certification of the domains as with the GSI and X509 certificates was the earlier known solution for authentication. (Douligeris; Serpanos, 2007)

This system thus incorporated is the basis of secure layered protocols for different types of communication. When the LAN and internet went worldwide, the grid security had to be reconsidered. The second type of grid uses the stand-alone mobile networks with infrastructure wireless networks which can be seen in the merging of cellular and wireless networks is a type of hybrid network where cellular features are mixed with adhoc connectivity to create a composite network that carries both the features. (Belding-Royer; Agha; Pujolle, 2005)

In any case the network device security is the most important part of any security infrastructure. The growing networks and inclusion of more and more new networked devices has caused increase of nodes most of which are not amenable to high security protocols like printers -- those which are network enabled have insecure default configurations. Most security problems begin with the routers which are the first device that is targeted for an attack. Compromise of these devices will make the entire network infrastructure weak or will be a way for attackers to cause a 'man-in-the-middle attacks' which may include rerouting traffic, information gathering and denial of service. (Andress, 2003) There are many criteria for the analysis of the security scenario.

Security Assessment

The problems of security begin with the expansion of networking and in the beginning of the millennium the growth in demand for networks was huge and the system relied on the packet-switched data communications networks which were based on the "protocol layering" concept -- that is rules, or protocols being used in a stack fashion and based on what was defined as the "end-to-end network" both of which created the internet. The main element in this system is the IP address that is found in the "logical layers and the modern use of network protocols centered on the IP address." (Whitt, 2004)

In the networking the emphasis always is on the 'Network Layers.' The modern network thus consists of many additional features including wireless transmissions, telephony, internet, and mobile networks. The amalgamation of all the services in a single device such as mobile phones for example has caused vast changes in the way the operations are carried out in the communication sector. The first method is the use of the 'Federal Information Technology Security Assessment Framework' championed by the 'National Institute for Standards and Technology -- NIST' and this method helps in the security assessment by evaluating the threats against and vulnerabilities within the assets of the system. It is also used to certify all implemented security controls as adequate or other grades like 'completely secure or meeting acceptable levels of risk' and so on. (Ramachandran, 2002)

Major Methods

These criteria are met in the international protocol called the TSEC where the evaluation begins with the network concept itself. In the TSEC, thus each component is evaluated individually as against the TSEC rating systems from Division D. Division D. has minimal protection to class C2 controlled protection and have many intermittent classes in between where C. stands for discretionary protection, C1, for discretionary security protection, C2 for controlled access and object reuse protection and so on. (Contesti; Andre; Waxvik; Henry; Goins, 2007)

There cannot be any change to these basic concepts in the model and the changes that the 'International Common Criteria' for information technology security evaluation has brought in do not affect the existing systems because by verifying the certification of the components that are used, it can be seen if the system is robust. It also states if the system is ideal for the network security required -- e.g. more for the bank, lesser for a library. In this system the e NIST Security Assessment Framework described in [NIST00] is the ideal solution to most type of security networks because the methods consist of multiple modules that provide security to all aspects of the network. (Ramachandran, 2002)

The five levels begin with establishing a documented security policy to cover all aspects of security management. This would incorporate the details of all ace methods and procedures, the methods of operations, the collection of procedures, exact technology to be used that may include the hard ware software and vendor criteria, and the goal sets for the implementation of the security. The NIST00 also at the second level is where the process of implementation of the security is created. And the procedures are properly documented. Following this at Level 3, the stock is taken of the already implemented or existing systems and controls that can be used in the process or those systems that the organizations must ensure implementation of their security procedures. (Ramachandran, 2002)

The important system is the method of making the end user proficient in handling the system procedures and understanding the safety protocols and procedures that calls for some level of for security skills which must meet an assessment and the deficient training needs is documented. Going further in level 4; the final test and review of all the procedures and controls is done. There are regression procedures for testing security in the presence of system evolution and from here the final level namely the Level 5 is reached where a 'Fully Integrated Procedures and Controls' are seen to become viable. In other words the system at this stage has an implemented security controls and external security resources that completely protect the system architecture. (Ramachandran, 2002) The economics of the system is shown by the Security Assessment that shows dependencies and the method of regression testing of security as the system.

Estimation:

The systems security flows from a security policy based on the architecture of the system and the method of measuring of compliance. Most internet and WAN and LAN systems are today hybrid network configurations with a set of systems with the general system functioning within the units and passing data into the grid and outside. Thus a compromise of the system either from the external -- extra net access or internal system access can bring down the entire security infrastructure. All networks today have more than the traditional data passing and incorporate many features of telephony and communication that has brought more risks. The e NIST Security Assessment Framework described in [NIST00] has been considered and is found to be an ideal solution to most type of security networks.