Operations Security

“Controls over the hardware in a computing facility, over the data media used, and over the operators using these resources.”

C.I.A. as affected by Operations Controls

Confidentiality: affect sensitivity & secrecy

Integrity: how well implementation directly affects

accuracy & authenticity Availability:

affect system’s level of fault tolerance and recovery capability

Controls & Protections

Controls used to protect hardware, software, & media from

Threats in environment Internal or External Intruders Operators inappropriately accessing

resources

Categories of Controls Preventative Controls are designed to

lower amount & impact of unintentional errors Prevent unauthorized intruders from entering EX: prenumbered forms & data validation

Detective Controls To detect an error once it has occurred After the fact

Corrective (or Recovery) Controls Implemented to mitigate the loss Restoring data

Categories of Controls (conti) Deterrent Controls

Encourage compliance, complement other controls

Application Controls Designed into software to minimize & detect

irregularities Transaction Controls

Input Controls Processing Controls Output Controls Change Controls Test Controls

TCSEC “Orange Book” Controls

D: Minimal ProtectionC: Discretionary ProtectionC1: Discretionary Security ProtectionC2: Controlled Access ProtectionB: Mandatory ProtectionB1:Labeled Security ProtectionB2: Structured ProtectionB3: Security DomainsA1: Verified Protection

Orange Book Defines assurance requirements for secure

computer operations Assurance: level of confidence that security

policy has been correctly implemented

Two types: Operational: basic features & architecture Life cycle: controls & standards used in

operations & maintenance

Orange Book: Covert Channel Analysis

Channel: info transfer path Covert channel: path that violates security

policy Covert storage channel Covert timing channel TCSEC B2: must protect against, must

perform analysis for all storage channels TCSEC B3 & A1: must protect against both

types of convert channels

Orange Book:Trusted Facility Management Assignment of a specific individual to

administer secruity related system functions

Must take auditable action before being able to assume admin role

B2: System must support separate operator & system admin roles

B3: Must clearly identify functions of security admin

Orange Book:Separation of Duties Assignment of parts of task to different

personnel No one person with total control == no one

person that can completely compromise system

“Two man control” Three distinct system admin roles

System admin Security admin Enhanced operator

Orange Book:Rotation of Duties

Limit amount of time any individual performs the same security related duties

Orange Book:Trusted Recovery

Required only in B3 & A1 level systems System failure == serious security risk

Security bypassed while not fully functional Ex: System crash while sensitive data

written to disk before ACL changed Hierarchical Recovery Types

Manual Recovery Automated Recovery of single failure Automated Recovery without undue loss

Modes of Operation Dedicated Mode

Each user with any access has a valid personnel clearance, formal access approval (with signed non disclosure), & a valid “need to know” all info

System-High Mode All above except need to know some info

Compartmental Mode Need to know only info they have direct access to

Multilevel Mode Some do not have valid clearance for all info but have

clearance & need to know for info they will have access to

Change Control Manages process of tracking & approving

changes Identify, control, audit Insure changes not diminish sys sec Document all changes Primary functions of change control

Change implemented in orderly manner -- test Inform user base of change Analyze effect of the change Reduce negative impact of change

Procedures for Change Control

1. Applying to introduce change2. Approval of change3. Cataloging intended change4. Testing change5. Scheduling & implementing change6. Reporting change to management

Configuration Management More formalized for highly sec system Configuration Managers

Identify & document each functional & physical config item

Personally assure approval for and manage all config changes

Record & report status of changes Audit system config for unknown changes

Configuration Control Board

Administrative Controls More to do with human than hardware or

software Personnel Security

Employment screening / background chk Mandatory vacations Job action warnings & terminations

Separation of duties & responsibilities Least Privilege Need to know Change control Record retention & documentation control

Least Privilege

Separate levels of access based on job function

Three basic levels Read Only Read/Write: only to data copied from

original location Access Change: original location

Operations Job Functions

Computer Operator Operations analyst Job control analyst Production Scheduler Production Control Analyst Tape Librarian

Others Record Retention concerns

Data remanence Info on media after it has been erased

Due care & Due Diligence Legal, governmental, & simple good business

practices

Documentation Control Security plans, risk analysis, security policy, etc

Operations Controls

Day-to-day procedures to protect Most important aspects of (details follow):

Resource protection Hardware controls Software controls Privileged-entity controls Media controls Physical access controls

Resource Protection Protect from loss or compromise Hardware

Lan Hardware, Storage Media, Processing Systems, Standalone Computers, Printers, etc

Software Program Libraries & Source, Vendor Software,

O/S & Utilities Data

Backup Data, User Data Files, Password Files, Operating data directories, Sys logs

Hardware Controls

Hardware maintenance Maintenance accounts

Disabled until needed Preset, widely known ids & passwords

Diagnostic port controls Ports for trouble shooting

Hardware physical controls

Software Controls

What software used on system Licensed software only

Anti-virus management Software testing Software utilities Safe software storage Backup controls

Privileged-Entity Controls

Oversight of personnel with “special” access to systems

Examples of special access Lower level system commands Special operational parameters System control programs

Media Controls Media Security

Logging, Access Control, & Proper Disposal Overwriting: a pattern, its compliment, then

another pattern (0011, 1100, 1010) Degaussing & Destruction

Media Viability Controls Protect viability of media used Marking, Handling, Storage, Orig. Quality

Media Librarian

Physical Access Controls Hardware

Control of comm. Equip, storage media, printed logs & reports

Software Control of backup files, system logs, production apps,

sensitive/critical data Some personnel need special physical access

It department personnel, Cleaning Staff, Maintenance personnel, third-party contractors, consultants, temp staff

Supervision Physical piggybacking – 2nd person follows 1st through

door (man trap)

Monitoring & Auditing “Reviewing an operational system to see

that controls, both manual & automated, are functioning effectively & correctly”

Are technical features being bypassed Are required procedures being followed Is there evidence of abnormal computer

usage

Monitoring

Looking for: Illegal software installing Hardware faults & error states Operational events for abnormalities

Techniques Intrusion detection Penetration testing Violation analysis

Intrusion Detection & Violation Analysis Sampling traffic patterns Look for activities above clipping level Clipping Level & Profile based anomaly detection

Baseline of user activity considered “normal” Enables ignoring normal user errors When exceeded violation report filed Also used for variance detection

Looking for Repetitive mistakes, individuals exceeding their

authority, too many people with restricted access, patterns showing serious intrusion attempts

Penetration Testing Attempting to access a system from

outside normal Technology based

Scanning & probing Demon Dialing / War Driving Sniffing

Personnel Oriented Dumpster Diving Social Engineering

Auditing Checking for internal & external

compliance Patterns of abnormal use Audit these functions

Backup controls System & transaction controls Data library procedures & center security Systems development standards Contingency plans

Audit Trails Enables tracing a transaction’s history Enforcement of accountability Audit Logs should record

Transaction date & time, who processed it, & where Any security events relating to transaction Any commands (with options) executed by user All identification & authorization attempts Any files or other resources accessed

Auditor should look for Amendments to production jobs Production job returns Computer operator practices

Security Goals of Audit Mechanism

Allow review of patterns of access to individual objects

Allow discovery of repeated attempts to bypass security mechanisms

Find use of privileges by user greater than they should have

An additional form of user assurance that attempt to bypass security will be caught

Audit Logs

Prevent log file from being altered

Protect availability of log during event

Protect logging media from destruction or damage

Benefits of Auditing & Problem Management

Enhancement of risk assessment program

Enhancement of internal readiness & communications

Personnel Security Training Reduced failures to manageable level Prevent (re)occurrence of problem Mitigate impact of violation

Threats Event that if realized can cause damage to system Accidental Loss

Operator errors Transaction processing errors

Inappropriate activities Inappropriate content Waste of corporate resources Sexual or racial harassment Abuse of privileges

Illegal Computer Operations Eavesdropping Fraud, Theft, Sabotage External Attack

Vulnerabilities & Attacks Traffic / Trend analysis

Analyze data characteristics & pattern rather than content

Stop by: padding message, sending noise, covert channel analysis

Maintenance Accounts Data-Scavenging Attacks

Keyboard attacks & Laboratory Attacks Initial Program Load vulnerabilities

Single user mode, boot sequence, bios, CD Social Engineering Network Address Hijacking