CHAPTER 4 SECURITY IMPLEMENTATION & MANAGEMENT

CHAPTER 4
ADMINISTERING SECURITY
I. Security planning:
Contents of security planning:
A security plan identifies and organizes the security activities for a computing system. The plan
is both a description of the current situation and a plan for improvement. Every security plan
must address seven issues.
1. Policy, indicating the goals of a computer security effort and the willingness of the people
involved to work to achieve those goals.
2. Current state, describing the status of security at the time of the plan.
3. Requirements, recommending ways to meet the security goals.
4. Recommended controls, mapping controls to the vulnerabilities identified in the policy and
requirements.
5. Accountability, describing who is responsible for each security activity.
6. Timetable, identifying when different security functions are to be done.
7. Continuing attention, specifying a structure for periodically updating the security plan.

1. Policy:
The policy statement should specify the following:
™ The organization's goals on security. For example, should the system protect data from
leakage to outsiders, protect against loss of data due to physical disaster, protect the data's
integrity, or protect against loss of business when computing resources fail?
What is the higher priority: serving customers or securing data?
™ Where the responsibility for security lies. For example, should the responsibility rest with
a small computer security group, with each employee, or with relevant managers?
™ The organization's commitment to security. For example, who provides security support
for staff, and where does security fit into the organization's structure?

2. Current Security Status:

To be able to plan for security, an organization must understand the vulnerabilities to which it
may be exposed. The organization can determine the vulnerabilities by performing a risk
analysis: a careful investigation of the system, its environment, and the things that might go
wrong. The risk analysis forms the basis for describing the current status of security. The status
can be expressed as a listing of organizational assets, the security threats to the assets, and the
controls in place to protect the assets.

3. Requirements:
The heart of the security plan is its set of security requirements: functional or performance
demands placed on a system to ensure a desired level of security. The requirements are usually
derived from organizational needs. Sometimes these needs include the need to conform to

1 | COMPILED BY: DR. AZATH HUSSAIN 

 
CHAPTER 4 SECURITY IMPLEMENTATION & MANAGEMENT
specific security requirements imposed from outside, such as by a government agency or a
commercial standard.

4. Recommended Controls:
The security requirements lay out the system's needs in terms of what should be protected. The
security plan must also recommend what controls should be incorporated into the system to meet
those requirements.

5. Responsibility for Implementation:

A section of the security plan should identify which people are responsible for implementing the
security requirements. This documentation assists those who must coordinate their individual
responsibilities with those of other developers. At the same time, the plan makes explicit who is
accountable should some requirement not be met or some vulnerability not be addressed. That is,
the plan notes who is responsible for implementing controls when a new vulnerability is
discovered or a new kind of asset is introduced.

People building, using, and maintaining the system play many roles. Each role can take some
responsibility for one or more aspects of security. Consider, for example, the groups listed here.
Personal computer users may be responsible for the security of their own machines.
Alternatively, the security plan may designate one person or group to be coordinator of personal
computer security. Project leaders may be responsible for the security of data and computations.

6. Timetable:
A comprehensive security plan cannot be executed instantly. The security plan includes a
timetable that shows how and when the elements of the plan will be performed. These dates also
give milestones so that management can track the progress of implementation.

7. Continuing Attention:
Good intentions are not enough when it comes to security. We must not only take care in
defining requirements and controls, but we must also find ways for evaluating a system's security
to be sure that the system is as secure as we intend it to be. Thus, the security plan must call for
reviewing the security situation periodically. As users, data, and equipment change, new
exposures may develop. In addition, the current means of control may become obsolete or
ineffective (such as when faster processor times enable attackers to break an encryption
algorithm). The inventory of objects and the list of controls should periodically be scrutinized
and updated, and risk analysis performed anew.

Security Planning Team Members:

Security in operating systems and networks requires the cooperation of the systems
administration staff. Program security measures can be understood and recommended by
applications programmers. Physical security controls are implemented by those responsible for
general physical security, both against human attacks and natural disasters. Finally, because

2 | COMPILED BY: DR. AZATH HUSSAIN 

 
CHAPTER 4 SECURITY IMPLEMENTATION & MANAGEMENT
controls affect system users, the plan should incorporate users' views, especially with regard to
usability and the general desirability of controls.

Thus, no matter how it is organized, a security planning team should represent each of the
following groups.
™ Computer hardware group
™ System administrators
™ Systems programmers
™ Applications programmers
™ Data entry personnel
™ Physical security personnel
™ Representative users

In some cases, a group can be adequately represented by someone who is consulted at

appropriate times, rather than a committee member from each possible constituency being
enlisted.

Assuring Commitment To a security plan:

After the plan is written, it must be accepted and its recommendations carried out. Acceptance by
the organization is key; a plan that has no organizational commitment is simply a plan that
collects dust on the shelf. Commitment to the plan means that security functions will be
implemented and security activities carried out.

Three groups of people must contribute to making the plan a success.

1. The planning team must be sensitive to the needs of each group affected by the plan.
2. Those affected by the security recommendations must understand what the plan means
for the way they will use the system and perform their business activities. In particular,
they must see how what they do can affect other users and other systems.
3. Management must be committed to using and enforcing the security aspects of the
system.

Business Continuity Plan:

A business continuity plan documents how a business will continue to function during a
computer security incident. An ordinary security plan covers computer security during normal
times and deals with protecting against a wide range of vulnerabilities from the usual sources.

A business continuity plan deals with situations having two characteristics:

1. Catastrophic situations, in which all or a major part of a computing capability is
suddenly unavailable.
2. Long duration, in which the outage is expected to last for so long that business will
suffer.

3 | COMPILED BY: DR. AZATH HUSSAIN 

 
CHAPTER 4 SECURITY IMPLEMENTATION & MANAGEMENT
There are many situations in which a business continuity plan would be helpful. Here are some
examples that typify what you might find in reading your daily newspaper:
™ A fire destroys a company's entire network.
™ A seemingly permanent failure of a critical software component renders the computing
system unusable.
™ A business must deal with the abrupt failure of its supplier of electricity,
telecommunications, network access, or other critical service.
™ A flood prevents the essential network support staff from getting to the operations center.
™ The key to coping with such disasters is advance planning and preparation, identifying
activities that will keep a business viable when the computing technology is disabled. The
steps in business continuity planning are these:
o Assess the business impact of a crisis.
o Develop a strategy to control impact.
o Develop and implement a plan for the strategy

Incident response plan:

Incident response Plan should be
™ define what constitutes an incident
™ identify who is responsible for taking charge of the situation
™ describe the plan of action

II. Risk Analysis:

We distinguish a risk from other project events by looking for three things,
1. A loss associated with an event. The event must generate a negative effect: compromised
security, lost time, and diminished quality, lost money, lost control, lost understanding, and so
on. This loss is called the risk impact.
2. The likelihood that the event will occur. The probability of occurrence associated with each
risk is measured from 0 (impossible) to 1 (certain). When the risk probability is 1, we say we
have a problem.
3. The degree to which we can change the outcome. We must determine what, if anything, we
can do to avoid the impact or at least reduce its effects. Risk control involves a set of actions to
reduce or eliminate the risk.

We usually want to weigh the pros and cons of different actions we can take to address each risk.
To that end, we can quantify the effects of a risk by multiplying the risk impact by the risk
probability, yielding the risk exposure. For example, if the likelihood of virus attack is 0.3 and
the cost to clean up the affected files is $10,000, then the risk exposure is $3,000. So we can use
a calculation like this one to decide that a virus checker is worth an investment of $100, since it
will prevent a much larger potential loss. Clearly, risk probabilities can change over time, so it is
important to track them and plan for events accordingly.

4 | COMPILED BY: DR. AZATH HUSSAIN 

 
CHAPTER 4 SECURITY IMPLEMENTATION & MANAGEMENT
Risk is inevitable in life: Crossing the street is risky but that does not keep us from doing it. We
can identify, limit, avoid, or transfer risk but we can seldom eliminate it. In general, we have
three strategies for dealing with risk:
1. Avoiding the risk, by changing requirements for security or other system characteristics
2. Transferring the risk, by allocating the risk to other systems, people, organizations, or assets;
or by buying insurance to cover any financial loss should the risk become a reality
3. Assuming the risk, by accepting it, controlling it with available resources, and preparing to
deal with the loss if it occurs
Thus, costs are associated not only with the risk's potential impact but also with reducing it. Risk
leverage is the difference in risk exposure divided by the cost of reducing the risk. In other
words, risk leverage is

Steps of a Risk Analysis:

Risk analysis is performed in many different contexts; for example, environmental and health
risks are analyzed for activities such as building dams, disposing of nuclear waste, or changing a
manufacturing process. Risk analysis for security is adapted from more general management
practices, placing special emphasis on the kinds of problems likely to arise from security issues.
By following well-defined steps, we can analyze the security risks in a computing system.

The basic steps of risk analysis are listed below.

1. Identify assets.
2. Determine vulnerabilities.
3. Estimate likelihood of exploitation.
4. Compute expected annual loss.
5. Survey applicable controls and their costs.
6. Project annual savings of control.

Arguments For and against risk analysis:

Risk analysis is a well-known planning tool, used often by auditors, accountants, and managers.
In many situations, such as obtaining approval for new drugs, new power plants, and new
medical devices, a risk analysis is required by law in many countries. There are many good
reasons to perform a risk analysis in preparation for creating a security plan.

™ Improve awareness. Discussing issues of security can raise the general level of interest
and concern among developers and users. Especially when the user population has little
expertise in computing, the risk analysis can educate users about the role security plays in
protecting functions and data that are essential to user operations and products.
™ Relate security mission to management objectives. Security is often perceived as a
financial drain for no gain. Management does not always see that security helps balance
harm and control costs. Identify assets, vulnerabilities, and controls. Some organizations
are unaware of their computing assets, their value to the organization, and the

5 | COMPILED BY: DR. AZATH HUSSAIN 

 
CHAPTER 4 SECURITY IMPLEMENTATION & MANAGEMENT
vulnerabilities associated with those assets. A systematic analysis produces a
comprehensive list of assets, valuations, and risks.
™ Improve basis for decisions. A security manager can present an argument such as "I
think we need a firewall here" or "I think we should use token-based authentication
instead of passwords." Risk analysis augments the manager's judgment as a basis for the
decision. Justify expenditures for security. Some security mechanisms appear to be very
expensive and without obvious benefit. A risk analysis can help identify instances where
it is worth the expense to implement a major security mechanism. Justification is often
derived from examining the much larger risks of not spending for security.

III. Organizational Security Policies:

A security policy is a high-level management document to inform all users of the goals of and
constraints on using a system. A policy document is written in broad enough terms that it does
not change frequently. The information security policy is the foundation upon which all
protection efforts are built. It should be a visible representation of priorities of the entire
organization, definitively stating underlying assumptions that drive security activities. The policy
should articulate senior management's decisions regarding security as well as asserting
management's commitment to security. To be effective, the policy must be understood by
everyone as the product of a directive from an authoritative and influential person at the top of
the organization.

Purpose:
Security policies are used for several purposes, including the following:
™ recognizing sensitive information assets
™ clarifying security responsibilities
™ promoting awareness for existing employees
™ guiding new employees

Audience:
A security policy addresses several different audiences with different expectations. That is, each
group users, owners, and beneficiaries uses the security policy in important but different ways.

Users
Users legitimately expect a certain degree of confidentiality, integrity, and continuous
availability in the computing resources provided to them. Although the degree varies with the
situation, a security policy should reaffirm a commitment to this requirement for service. Users
also need to know and appreciate what is considered acceptable use of their computers, data, and
programs. For users, a security policy should define acceptable use.

6 | COMPILED BY: DR. AZATH HUSSAIN 

 
CHAPTER 4 SECURITY IMPLEMENTATION & MANAGEMENT
Owners
Each piece of computing equipment is owned by someone, and the owner may not be a system
user. An owner provides the equipment to users for a purpose, such as to further education,
support commerce, or enhance productivity. A security policy should also reflect the
expectations and needs of owners.

Beneficiaries
A business has paying customers or clients; they are beneficiaries of the products and services
offered by that business. At the same time, the general public may benefit in several ways: as a
source of employment or by provision of infrastructure.

Contents:
A security policy must identify its audiences: the beneficiaries, users, and owners. The policy
should describe the nature of each audience and their security goals. Several other sections are
required, including the purpose of the computing system, the resources needing protection, and
the nature of the protection to be supplied.
™ Purpose
™ Protected resources
™ Nature of protection

Characteristics of a Good Security Policy:

If a security policy is written poorly, it cannot guide the developers and users in providing
appropriate security mechanisms to protect important assets. Certain characteristics make a
security policy a good one.
™ Durability
™ Realism
™ Usefulness

IV. Physical security

Physical security is the term used to describe protection needed outside the computer system.
Typical physical security controls include guards, locks, and fences to deter direct attacks. In
addition, there are other kinds of protection against less direct disasters, such as floods and
power outages; these, too, are part of physical security.

Natural Disasters:
It is impossible to prevent natural disasters, but through careful planning it is possible to reduce
the damage they inflict. Some measures can be taken to reduce their impact. Because many of
these perils cannot be prevented or predicted, controls focus on limiting possible damage and
recovering quickly from a disaster. Issues to be considered include the need for offsite backups,
the cost of replacing equipment, the speed with which equipment can be replaced, the need for
available computing power, and the cost or difficulty of replacing data and programs.

7 | COMPILED BY: DR. AZATH HUSSAIN 

 
CHAPTER 4 SECURITY IMPLEMENTATION & MANAGEMENT
Some of them are
™ Flood
™ Fire
™ Other natural disasters

Power loss:
Computers need their food electricity and they require a constant, pure supply of it. With a direct
power loss, all computation ceases immediately. Because of possible damage to media by sudden
loss of power, many disk drives monitor the power level and quickly retract the recording head if
power fails. For certain time-critical applications, loss of service from the system is intolerable;
in these cases, alternative complete power supplies must be instantly available.

Human vandals:
Because computers and their media are sensitive to a variety of disruptions, a vandal can destroy
hardware, software, and data. Human attackers may be disgruntled employees, bored operators,
saboteurs, people seeking excitement, or unwitting bumblers. If physical access is easy to obtain,
crude attacks using axes or bricks can be very effective. One man recently shot a computer that
he claimed had been in the shop for repairs many times without success.

Physical attacks by unskilled vandals are often easy to prevent; a guard can stop someone
approaching a computer installation with a threatening or dangerous object. When physical
access is difficult, more subtle attacks can be tried, resulting in quite serious damage. People
with only some sophisticated knowledge of a system can short-circuit a computer with a car key
or disable a disk drive with a paper clip. These items are not likely to attract attention until the
attack is completed.
™ Unauthorized access and use
™ Theft
™ Preventing access
™ Preventing portability
™ Detecting theft

Interception of Sensitive Information:

When disposing of a draft copy of a confidential report containing its sales strategies for the next
five years, a company wants to be especially sure that the report is not reconstructable by one of
its competitors. When the report exists only as hard copy, destroying the report is
straightforward, usually accomplished by shredding or burning. But when the report exists
digitally, destruction is more problematic. There may be many copies of the report in digital and
paper form and in many locations (including on the computer and on storage media).

8 | COMPILED BY: DR. AZATH HUSSAIN 

 
CHAPTER 4 SECURITY IMPLEMENTATION & MANAGEMENT

There may also be copies in backups and archived in e-mail files. Here, we look at several ways
to dispose of sensitive information. They are
™ Shredding
™ Overwriting magnetic data
™ Degaussing
™ Protecting against Emanation

Contingency Planning:
The key to successful recovery is adequate preparation. Seldom does a crisis destroy
irreplaceable equipment; most computing systems personal computers to mainframes are
standard, off-the-shelf systems that can be easily replaced. Data and locally developed programs
are more vulnerable because they cannot be quickly substituted from another source. Let us look
what to do after a crisis occurs.

™ Back-up
™ Off-site backup
™ Network storage
™ Cold site
™ Hot site

Physical security backup:

We have to protect the facility against many sorts of disasters, from weather to chemical spills
and vehicle crashes to explosions. It is impossible to predict what will occur or when. The
physical security manager has to consider all assets and a wide range of harm. Malicious humans
seeking physical access are a different category of threat agent. The primary physical controls
are strength and duplication. Strength means overlapping controls implementing a defense-in-
depth approach so that if one control fails, the next one will protect. People who built ancient
castles practiced this philosophy with moats, walls, drawbridges, and arrow slits. Duplication
means eliminating single points of failure. Redundant copies of data protect against harm to one
copy from any cause. Spare hardware components protect against failures.

9 | COMPILED BY: DR. AZATH HUSSAIN 

 
CHAPTER 4 SECURITY IMPLEMENTATION & MANAGEMENT

V. LEGAL, PRIVACY, AND ETHIAL ISSUES IN COMPUTER SECURITY

™ Program and data protection by patents, copyrights, and trademarks

™ Computer crime
™ Privacy
™ Ethical analysis of computer security situations

Protecting Programs and Data

Copyrights, patents, and trade secrets are legal devices that can protect computers, programs and
data. Here how each of these forms are originally designed to be used and how each is currently
used in computing are described.
Copyrights: Copyrights are designed to protect the expression of ideas. Thus it is applicable to a
creative work, such as story, photographs, song or pencil sketch. The right to copy an expression
of an idea is protected by copyright. The idea of copyright is to allow regular and free exchange
of ideas. Copyright gives the author the exclusive right to make copies of the expression and sell
them in public. That is, only the author can sell the copies of the author’s book.

Patents:
Patents are unlike copyrights in that they protect inventions, tangible objects, or ways to make
them, not works of the mind. The distinction between patents and copyrights is that patents were
intended to apply to the results of science, technology, and engineering, where as copyrights are
meant to cover works in the arts, literature, and written in the scholarship. A Patent is designed to
protect the device or process for carrying out an idea itself.

Trade Secrets:
A trade secret is unlike a patent and copyright in that it must kept secret. The information has
value only as secret, and an infringer is one who divulges the secret. Once divulged, the
information usually cannot be made secret. A trade secret is information that gives one company
a competitive edge over others. For example the formula of a soft drink is a trade secret, as is a
mailing list of customer or information about a product due to be announced in a few months.

Computer Crime:
Crimes involving computers are an area of the law that is even less clear than the other areas.
Computer crime consider why new laws are needed to address some of its problems.

Issues in computer crime are

™ Rules of property
™ Rules of evidence
™ Threats to integrity and confidentiality
™ Value of data
™ Acceptance of computer terminology

10 | COMPILED BY: DR. AZATH HUSSAIN 

 
CHAPTER 4 SECURITY IMPLEMENTATION & MANAGEMENT

Why Computer crime is hard to define?

Some people in the legal process do not understand computers and computing, so crimes
involving computers are not always treated properly. Main reasons are
1. Lack of understanding
2. Lack of physical evidence
3. Lack of recognition assets
4. Lack of political impacts
5. Complexity of case
6. Juveniles

Privacy:
In particular, we want to investigate the privacy of sensitive data about the user. The user should
be protected against the system’s misuse of the private data and the system’s failure to protect its
user’s private data against outside attack and disclosure. This is termed as privacy in computer
ethics.

Ethical Issues in Computer Security:

The primary purpose of this section is to explore some of ethical issues associated with computer
security and to show how ethics functions as a control.
*********************************************************************************** 

11 | COMPILED BY: DR. AZATH HUSSAIN