System Security Basics. Information System Security The protection of information systems against...

System Security Basics

Information System Security

• The protection of information systems against unauthorized access to or modification of information, whether in storage, processing, or transit, and against the denial of service to authorized users, including those measures necessary to detect, document, and counter such threats.

Fortress Model

• Watch towers to detect threat

• Protection by:– Moat– Outer Wall– Inner Wall of Keep

• Draw bridge and Gate – controlled access

Fortress model for defense

1. Critical information

2. Physical protection

3. Operation system hardening

4. Information access

5. External access

1. Critical Information

• Data categorization– Public– Internal– Confidential– Secret

• Application hardening

2. Physical Protection

• Physical environment– Geographical location– Social environment– Building construction

• Physical controls

• Communications

• Surveillance

3. Operation Systems Hardening

• Security configuration

• Anti-malware

• File system– Encrypting File System

• ADDS security

• System redundancy

4. Information Access

• User identification

• Security policies

• Resources access

• Role base access control

• Access auditing

• Digital rights management

5. External Access

• Perimeter network

• VPN/ RRAS (Routing and Remote Access)

• SSTP (Secure Socket Tunneling Protocol)

• PKI

• Identity federation

• NAP (Network Access Protection)

Polices, Procedures & Awareness

Data

Application

Host

Internal Network

Perimeter

The Microsoft Model

Things to do

• Identify who enter your system

• Provide the user with the appropriate access right

• Identify the person modifying the data is authorized to do so

• Guarantee the confidentiality of information

• Guarantee the availability of information

Things to do

• Ensure the integrity of the information

• Monitor the activities of the system

• Audit security events

• Put in administrative procedures to ensure the system is secure

System composition

• File server/ Print server/ Fax server

• Web server

• Application server

• DNS server

• DHCP server

• Domain controller

• Terminal server

System composition

• Email server

• RADIUS server

• VPN server

• Certificate server

• UDDI server

• Network policy and access server

• Gateway/ Firewall/ Switch

• And users