Risk management and asset identification in information security

¶ … Security

The following will look at case review questions based on the book known as Principles of Information Security by Michael E. Whitman. Chapters 4, 5, 6, and 7 were read through and case questions were given for each of these chapters. Case review question answers will be incorporated with material from the chapter reading that accompanies it.

Chapter 4's introduction has a scenario of a man known as Charlie. He is giving key reminders for everyone in the asset identification project. They are to complete their asset lists while keeping in mind certain priorities. It ties into the idea of chapter 4 which is known as risk management and identifying risks along with assessing them (Whitman and Mattord, 2011-page 116). It also explains how one can perpetuate risk control. Risk management itself refers to a process that identifies risk or vulnerabilities to the organization and taking steps to reduce the risks (Whitman and Mattord, 2001-page 116).

Three undertakings are attached to risk management and they are known as risk assessment, risk identification, and risk control. (Whitman and Mattord, 2011-page 116) As part of being an information security professional one needs a risk management strategy. Asset identification is a part of that strategy (Whitman and Mattord, 2011-page 116). When doing asset identification one should consider the following attributes such as people, data, and procedures.

(a)

Charlie did an organization of the work that was quite effective before the meeting with a little bit of flaws. He brings about the idea before the meeting is to begin that participation from all departments is needed. This shows that everyone is an equal to the company and it will not be that everything is to go through one department that controls all (Whitman and Mattord, 2011 Case Study Question page). The issues that should be covered by the work plan include addressing people and their positions. Everyone needs to know what their role will be in the work plan and they part they need to contribute (Whitman and Mattord, 2011-page 121). When sorting through this avoid names and stick with identifying the positions. Another thing the work plan should include is procedures (Whitman and Mattord, 2011-page 121). Procedures include the purpose of each task and how they are to be performed (Whitman and Mattord, 2011-page 121). They also include relationships between hardware and networking elements as well as software.

(b)

The company will get useful information from the team it has assembled. The information packets provided at the beginning of the meeting aim to give all of the information needed (Whitman and Mattord, 2011 Case Study question Page). This includes info on all the information technology risks faced by the organization such as fires and floods. Legal requirements faced in the industry and background articles are provided as well (Whitman and Mattord, pg 115).

(c)

Some attendees might resist the goals of a meeting if they feel like their department or position has nothing to do with any of the goals to be accomplished (Whitman and Mattord, 2011-page 115). For example in the chapter introduction with case of Charlie the manager of sales says something quite interesting (Whitman and Mattord, 2011-page 115). He says, "Why is my department here? Isn't security a problem for the IT department?" There is that sense of resistance already there as a result of not knowing things to come.

Key notes to make out of chapter 4 are that the goal of information security is to reduce risk which is the amount of risk that is not accounted for control applications and other risk management strategies to a level that is acceptable (Whitman and Mattord, 2011-page 164). One needs to also fully understand each threat that can be presented and the impact it can have on the organization (Whitman and Mattord, 2011-page 164). It also should be known on how each individual threat should be examined as a result of using a threat assessment process. It should be known that the goal of a risk assessment is the assignment of a risk score to represent the risk of a specific vulnerability.

Case Study Chapter 5

For the chapter 5 case study we see Charles sitting at his desk and answering an important email. He has a notepad ready and is prepared to make notes on what should be done in case his "nightmare" occurs (Whitman and Mattord, 2011 Case Study question). The case study asks on what should be written down on the notepad in order to address the situation and deal it with in a way that is effective and takes care of the problem completely (Whitman and Mattord, 2011 Case Study Question).

What he should keep in mind is known as a single comprehensive ISSP document. A single comprehensive ISSP document is centrally managed and controlled (Whitman and Mattord, 2011-page 176). It is known as an issue specific security policy and it aims to address specific areas of technology, it requires updates frequently, and contains a statement on the organizations position on a specific issue (Whitman and Mattord, 2011-page 176). It can cover topics such as email, internet use, use of personal equipment on company networks, and prohibition against hacking or testing in any form of organization security controls.

The ISSP document is what will give him the guidelines to follow for the contingency plan. Contingency plans prepare for action if any successful attack occurs (Whitman and Mattord, 2011-page 176). Many types of contingency plans exist such as business contingency plans and incident response plans.

(a)

The first thing that should be written on Charlie's list should be the rough draft of the business impact analysis. This is the assessment and examination of any impact that various problems can cause (Whitman and Mattord, 2011-page 209). Charlie should have written down all the problems that can occur and what their effect would be on the business if they were to happen. He will have the answers to the question on what to do now if an attack succeeds. For example what is to happen when an electric blackout occurs or if a malicious code attack occurs that is massive.

(b)

The other items that should be included are incident response planning, disaster recovery planning, and business continuity planning. Incident response planning includes the classification, identification, and response to an incident (Whitman and Mattord, 2011-page 212). It consists of four phases known as planning, detection, reaction, and recovery. Disaster recovery planning looks at crisis management procedures and recovery operations. It gives very detailed guidance in the event of a disaster (Whitman and Mattord, 2011-page 220) It establishes priorities and roles and responsibilities that are delineated. Everyone is to be aware of their expected actions in case of disaster (Whitman and Mattord, 2011-page 226). Business continuity will allow Charlie to have guidelines that allow the preparation of reestablishing business operations during disaster time. It has the steps the organization can take in order to function if business cannot be done at the main work site (Whitman and Mattord, 2011-page 226). There has to be a plan in motion that will allow the business to continue if certain things are unable as a result of disaster. There are a number of strategies that one can do to bring forth a continuation plan. Cost tends to be the determining factor.

Once Charlie has everything written down on the notepad he will have the model needed that will become the official contingency plan.

Case Study for Chapter 7

The chapter seven case scenario involves one known as Miller Harrison. He is still working down his attack protocol. The first two hosts go fine for his attack but then on the third host it stops. Miller attempts to restart the system and gets no response. He tries working the SLS firewall and nothing happens (Whitman and Mattord, 2011 Case Study Question). As it turns out he had been what is known as a black hole. That means that his IP address is one from which the SLS edge router would no longer accept any packets from. Therefore his attempt to attack the network has been shut down. (Whitman and Mattord, 2011 Case Study Question)

However how long will it be shut down for? Are there other possibilities that Miller can explore. However first thing is first. What is an intrusion according to IS? An intrusion is considered to occur when an attacker attempts to gain entry into and disrupt normal operations of an information system (Whitman and Mattord, 2011-page 283). Then there is intruder prevention. Some intrusion prevention activities consists of doing things such as writing and implementing information security policy, installing and testing technology based information security countermeasures and conducting and measuring the effectiveness of employee training (Whitman and Mattord, 2011-page 283). There is also intrusion detection and intrusion reaction.

Information security intrusion detection systems came about starting in the 1990s. Terminology associated with it includes terms such as site policy, site policy awareness, confidence value, and true attack stimulus (Whitman and Mattord, 2011-page 283). It can document any existing threat to the organization and it can prevent problem behaviors by increasing the perceived discovery risk (Whitman and Mattord, 2011-page 285). This means punishment for those who would attack the system or abuse it in any way. It can also detect attacks and any other security violation that would not be prevented by other security measures. It also serves to act as quality control for security design and administration.

What options are there for Miller then?

(a)

Miller can try to use what is known as a packet sniffer. In the wrong hands a packet sniffer can allow one to eavesdrop on network traffic. If he can get access to an open port he can use it to send commands to the computer system and try to get potential access to a server (Whitman and Mattord, 2011-page 328). This could allow him to exert control over the device. If he can also find a web server that links to the organization he could potentially run a "link" that can make an unrestricted internal link (Whitman and Mattord, 2011-page 331). He can use the now compromised network to attack the company.

As of late biometric technologies have been looked into as a way to encompass technological means that can measure one or more physical characteristics in order to verify identification and authorized access to the system (Whitman and Mattord, 2011). Biometric access control is based on the use of human characteristics to authenticate system identity. Biometric authentication technologies include iris print comparison of the supplicant's actual iris to a stored image, pal print comparison of a supplicants actual pal print to a stored palm print, and facial recognition using a digital camera in which the supplicants face is compared to a stored image (Whitman and Mattord, 2011-page 333). Among all of these characteristics only three human characteristics are considered unique. They are fingerprints, retina of the eye due to blood vessel pattern, and the iris of the eye (Whitman and Mattord, 2011-page 333). The iris of the eye features random patterns of features which include freckles, crypts, coronas, and vasculature. Evaluation for this technology is based on three criteria which are the false reject rate, the false accept rate, and the crossover error rate. It is considered to be one of the latest advancements in preventing system invasion and keeping up with security. Its full potential is still being examined as of today.

(b)

A system administrator can first look into what is known as wireless security tools. A wireless subnet connection can have many potential security holes despite being very convenient for the company (Whitman and Mattord, 2011-page 331). An organization that secures the wired network and leaves the wireless ones open can be open to attack. A security professional or system administrator should therefore first assess the wireless network risk. A wireless security toolkit can decrease that risk (Whitman and Mattord, 2011-page 331). It should include the ability to scan wireless host, the ability to sniff wireless traffic, and assess the level of privacy and confidentially. Top wireless tools comprise of Kismet which happens to be a ROBUST wireless sniffler (Whitman and Mattord, 2011-page 331 ). It also happens to be a network detector and an IDPS Airsnort also is one more tool. It has an 802.11 WEP encryption snapping tool. KisMac happens to be another tool as well. It is a GUI reactive wireless stumber used for Mac OS X (Whitman and Mattord, 2011-page 331). The administer can additionally look into the idea of biometric technology as mentioned above.

The drawback is that many of these effective biometric techniques are invasive to the human in a way (Whitman and Mattord, 2011-page 333). If the technology can be incorporated in a way that leaves one not feeling invaded more people will be open to it.

"Reference"

Whitman, M., & Mattord, H. (2011). Principles of Information Security (4th ed.). Cengage Learning.