CHAPTER FIVE
COMPUTER SECURITY
ADMINISTERING SECURITY
BY: SHEWANGIZAW LIULSEGED
SECURITY PLANNING
A security plan is a document that describes how an organization will address its
security needs.
Contents of a Security Plan
policy , indicating the goals of a computer security effort and the willingness of
the people involved to work to achieve those goals
current state , describing the status of security at the time of the plan
requirements, recommending ways to meet the security goals
recommended controls , mapping controls to the vulnerabilities
accountability , describing who is responsible for each security activity
timetable , identifying when different security functions are to be done
continuing attention , specifying a structure for periodically updating the
security plan
INPUTS TO THE SECURITY PLAN.
SECURITY PLANNING
the security planning process must allow customers or users to specify desired
functions, independent of the implementation.
The requirements should address all aspects of security: confidentiality, integrity, and
availability
make sure that the requirements have these characteristics:
Correctness: Are the requirements understandable? Are they stated without error?
Consistency: Are there any conflicting or ambiguous requirements?
Completeness: Are all possible situations addressed by the requirements?
Realism: Is it possible to implement what the requirements mandate ?
Need: Are the requirements unnecessarily restrictive ?
Verifiability: Can tests be written to demonstrate conclusively and objectively in
some way that will assess the degree to which the requirements are met?
RISK ANALYSIS
Good, effective security planning includes a careful risk analysis . A risk is a potential
problem that the system or its users may experience.
distinguish a risk from other project events by looking for three things:
A loss associated with an event .
The likelihood that the event will occur
The degree to which we can change the outcome
three strategies for dealing with risk:
1. avoiding the risk, by changing requirements for security or other system
characteristics
2. transferring the risk, by allocating the risk to other systems, people, organizations,
or assets; or by buying insurance to cover any financial loss should the risk become
a reality
3. assuming the risk, by accepting it, controlling it with available resources, and
preparing to deal with the loss if it occurs
CHARACTERISTICS OF A GOOD SECURITY
POLICY
Coverage -A security policy must be comprehensive: It must either apply to or
explicitly exclude all possible situations
Durability -A security policy must grow and adapt well. In large measure, it
will survive the system's growth and expansion without change
Realism -The policy must be realistic . That is, it must be possible to
implement the stated security requirements with existing technology
Usefulness -An obscure or incomplete security policy will not be implemented
properly, if at all. The policy must be written in language that can be read,
understood, and followed by anyone who must implement it or is affected by it
PHYSICAL SECURITY
Physical security is the term used to describe protection needed outside the
computer system.
Threat Control
Power loss Uninterruptible power supply-stores energy during normal operation so that it
can return the backup energy if power fails
Surge suppressor-
Human vandal-Theft Guard
Lock
Magnetic stripe card
Movement activated alarm
Special label
Etc.
Interception of sensitive Shredding-
information Overwriting magnetic data
Degaussing-
Protecting against emanation: tempest
CONTINGENCY PLANNING
Backup -is a copy of all or a part of a file to assist in reestablishing a lost file
revolving backups , in which the last several backups are kept. Each time a
backup is done, the oldest backup is replaced with the newest one.
selective backup , in which only files that have been changed (or created)
since the last backup are saved.
Offsite Backup -Keeping a backup version separate from the actual system
reduces the risk of its loss.
Networked Storage -Storage providers sell space in which you can store data
Cold Site- is a facility with power and cooling available, in which a
computing system can be installed to begin immediate operation
Hot site- is a computer facility with an installed and ready-to-run computing
system.
PHYSICAL SECURITY
Natural Disasters
• Earthquake, hurricane, flood, fire, storms, etc.
Environmental
Electrical
Brown/black outs, spikes, surges, sag, fault.
HVAC, air conditioning, humidity controls.
Electromagnetic Interference (EMI)
Theft
Internal, external
WHAT’S THE GOAL OF CYBERSECURITY?
Goals:
National Security: Service Availability
Protect Identity: Preserve Privacy
Economic Security: Ensure Integrity
Network Integrity:
A state in which the network performs its intended function in an unimpaired
manner, free from deliberate or inadvertent unauthorized manipulation of the
system.
Any questions?