Classification of security controls are always a problem.. Here is a quick chart for technology based safeguards that I came across while I was browsing risk presentations on the Internet. Credit for Jamie Sharp of Microsoft. Plain and simple:
Wednesday, August 29, 2007
Defense In Depth Technology Classification
In-house Security Operation or Managed Security Service Providers?
Q: You are the manager of the IT department of a medium to large sized company. Like any manager, you have a budget. You can never seem to get enough money from the C-level bosses above you, most of whom may not fully understand the importance of information security and compliance. Tough question.... do you hire/train employees to handle your network security, or do you outsource to a third-party (not unnecessarily off-shore)? What are some of the factors you would consider in each avenue? If you have been in this situation before, what are some of the lessons you have taken away?
A:
Hi Martin,
I think the question comes in two folds... Governing information security and operating information security should be perceived as different topics. I do believe that information security governance should be in-house. Regardless of the resources available, a company should determine what the risks are, and how the risks are addressed. That being said, usually it is much better choice to outsource information security operations. Here is a quick try to summarize the status:
Cons List Managed Security Operations (compared with in-house IT operations)
If data privacy is your main concern, the procedures may get complicated.
Pros List for Managed Security Operations (compared with in-house IT operations)
Segregation of duties. It is good to have a 3rd party for security
- yinal
Sunday, August 26, 2007
What do you use for an incident response console?
“Hi ....., We have been building information security management infrastructure for our customers at several sites. Incident response can be a part of several other tasks so it is hard to have a single console (incident response tasks listed @ http://www.cert.org/csirts/services.html). But in daily operation we do use SEM and ticketing consoles simultaneously. Depending on the reliability of the automatic correlation of events, you may even use a single ticketing console and dig down the events when needed. For me, the basic IR components are as follows: 1- Process Framework – You need a methodology for building the incident response system... Depending on your requirements, resources you may choose ISO 27001, ISACA, NIST based risk management models, or IETF, CERT, OGSF, type CSIRT procedures... Whatever you do, you need to define the incident response process well. There are a lot of resources, books, articles, guides on the technical and operational side. Let me know if you have any questions on that side. 2- Unified Log Collection and Event Correlation – Once you define your processes, it is time to choose the tools. If your infrastructure is not single vendor, you will need a centralized way of collection and correlating events... There is no silver bullet, but there are a lot of tools. Architecture wise you need to define agent based or agentless systems, remote log collectors, aggregation points, traffic forecasts, processing requirements etc. You may choose generic network management powerhouses like HP Openview, CA Unicenter, IBM Tivoli, Micromuse Netcool or specific security SEM players like RSA Envision, Arcsight, netforensics etc .. If you have homogeneous single vendor environment, Cisco Mars, Novell, Check Point Eventia, Symantec type solutions work as well. You do not need to spend big money on SEM if you have limited budget, there are open source log managers or low cost tools like what’s up. 3- Ticket Management/Escalation: For Incident Response, a solid ticketing system is very useful. Regardless of the SEM, NMC tools deployed, you need a helpdesk system. Gold standard is Remedy , but it is for the large enterprises with solid customization capabilities, once the events are correlated on SEM , and marked as incidents you can manage the whole escalation in your ticketing system. There are 1000s of alternatives for ticketing systems. You need to integrate the SEM systems with ticketing systems. 4- 3rd Party Communication and Integration: Messaging with other Computer Security Incident Response Team (CSIRT)s , private vulnerability research centers, managed security services providers, in the cloud vulnerability management services requires integration of your escalation procedures and tools, during the design phase At our own operation, we have built our own log collectors, agents, receivers, correlation engines, agent consoles, correlation and business rules engines because of the specific requirements of the operation, the main drivers were to have a single console for operators and increase efficiency, capacity and security. We still utilize Remedy for asset, change and issue management as well as regular escalation. Let me know if you have a specific question. Regards, - yinal ozkan”
When calculating information asset risk, does the formula C x I x A x (T xV) work?
Your answer was selected as a Good Answer
Your Public Answer:
“Hi ....., I agree with the previous comments. Quantitative risk calculation can only get serious when you define your input variables in details. The C x I x A x T x V formula you have mentioned will give you some numbers like any other combination based on your definition with availability vulnerability etc. but I do not recommend using this formula. You need to add the probability and the impact components of vulnerabilities for a better calculation (if they are not a part of your vulnerability definitions) If it is possible, I recommend using a proven risk management framework. Even in this scenario you need to set your definitions and customize the framework.
A good start address: http://wwwt.zhwin.ch/ui/swp/documents/risk_assessment_approaches_f_136894.pdf
Basically asset risk can be calculated with the answers of the following questions (from infosec handbook): What could happen? (What is the threat?) How bad could it be? (What is the impact or consequence?) How often might it happen? (What is the frequency?) How certain are the answers to the first three questions? (What is the degree of confidence?) Here is a more common approach that you can formulize your risk calculation at high level: Asset: Target of protection Asset Value (AV): Cost or replacement cost of your assets Exposure Factor (EF): Percentage of asset value that might be lost if things go wrong Single Loss Expectancy (SLE): Money lost if risk happens, SLE = Asset Value (AV) x Exposure Factor (EF) Annualized Rate of Occurrence (ARO): This is the frequency element of risk. (Number of repetitions of a risk factor in a unit of time/year), for example probability of a major flood vs. operator typing wrong password is different. The Annualized Loss Expectancy (ALE): When you multiply your expected loss with frequency you get the cost of risk on an asset over a 1 one year period, ALE = SLE x ARO A Google search on these keywords (ale aro sle) brings out several examples. As I have stated above, even the most quantitative method is relative but the attempt to normalize and measure risk is a very good start. Let me know if you have a specific question. regards, - yinal ozkan”
PKI & SAML / Strong Authentication / SOA?
Your answer was selected as a Good Answer
Your Public Answer:
“Hi ...., You have 2 paths to integrate your PKI system with your SOA environment. Option 1 : Get all the RFCs and a cool coder team and implement the security integration solution overlay. It is all RFC based and it is supposed to work. Option 2: Try one of the XML security gateways and check the built-in PKCS #10, X.509 v3, SAML functionality. This is probably a shorter but a more expensive way. As usual in-house development will be more customized when compared with 3rd party gateway. On the other side XML gateways offer a proven environment with good management options. You probably know the vendors but let me reiterate for other readers: Datapower (acquired by IBM) http://publibfp.boulder.ibm.com/epubs/pdf/22475620.pdf Reactivity:(acquired by Cisco) http://www.cisco.com/cdc_content_elements/acquisitions/reactivity/index2.html Forum Systems: http://forumsystems.com/papers/Sentry_Data_Sheet_Spring_2004.pdf Layer7: http://www.layer7tech.com/products/page.html?id=71 let me know if you have a specific question, regards, - yinal”
Is it irresponsible for law offices to use hosted email?
Your Public Answer:
“Hi ..., I think it is irresponsible for law offices to use insecure e-mail. Legally law offices should have secure messaging. The delivery type of the e-mail service from in-house facilities/ or from a remote hosted environment should not be the question. There are several cases where the law firms or financial institutions were liable for not maintaining secure e-mail operation at their own premises. A hosted option might be more secure based on existing security and privacy controls. Ask your hosting provider the following questions: 1- Who can access to my data? Do they all have background checks? 2- Do you have 3rd party security certifications/audits? (SAS-70 type II, ISO 27001 etc) What was the scope of audit/certification? What are the audit results? 3- What are the data retention/archiving/backup policies? What are your plans for BCP/DR? When was the last time you performed a test? What are the results? How long do you keep the backup copies? 4- Do you have a privacy policy at your facilities? 5- What are the existing security safeguards for securing my data? (Physical, access control, encryption etc) 6- How do you segregate my data from your other customers? 7- Where do you store my data? Where are your data centers? 8- Can I see the service level agreement? 9- Does your archiving solution support stringent e-mail regulations, specifically SEC 17a-4 requirements? Can I search my archived messages? The question list can be extended. If you cannot get satisfactory answers from your hosting provider, it is a better option to have e-mail in-house. Google will not answer most of the questions above so probably they are not a good enterprise partner at the moment. Expect to have a business level messaging service from Google as a follow-up to their Postini acquisition.(2 years?) Let me know if you have a specific question, regards, - yinal ozkan”
Internet based VPN services - what's available ?
Your answer was selected as Best Answer
Your Public Answer:
“Hi J..., Someday (and hopefully soon) several companies will figure out that using Internet based VPNs may solve several problems in a very cost-effective way. Managed Services is the logical way to go for small companies since it does not make sense to keep subject matter VPN experts on board for smaller companies. VPNs are the bloodlines for multi-office, inter-company, partner workflows and they must be managed properly. So I think your idea is a good call and developing an offering in this area does not suck. That being said, several companies called "Managed Security Services Providers - MSSPs" offer managed VPN services. (My current company being one of them). I am not sure about your definition about non-enterprise, but most of the MSSPs have solutions for SMB market. I have been working in MSSP market for the last 5 years. The usual suspects for MSSPs are, Telcos (e.g. BT, AT&T, Verizon, Orange, T-Systems etc), Global Outsourcing Providers (Wipro, HCL, Unisys, EDS etc..) , Security Vendors (Symantec, ISS/IBM, Specialists (Verisign, Cybertrust and Integralis) For go to market strategy you have 2 options on the low cost area. You either go with a vendor solution or develop your own. You have to be careful about low-cost of entry to market from the competitors. With vendor products (like Check Point, Juniper, Cisco, Fortinet, Nokia, Symantec) any company can come up with a solution but the solution will require a lot of CAPEX budget from the clients. SMBs usually do not like to pay in full in advance so it may make a sense to modify a Linux distro and deliver VPN solutions without paying to vendor, this may work since SMBs will not have ultra complex solutions. When you develop and deliver your own VPN solution you may have high margins. Managed Security Services is not just about products, I have written another long Q&A on linked in which might be helpful to build your service. http://www.linkedin.com/answers/technology/information-technology/information-security/TCH_ITS_ISC/13800-2070053 I also have several studies on why/when/how VPNs should be preferred over Telco WAN solutions. Let me know if you have any specific questions. Regards, - yinal ozkan”
Managed Security Services Market/Partners/Potential Contacts? (for Asia and Middle East region)
“Hi ... Here are my comments for your questions: 1- MSSP market is bullish. There is no way that all the companies will have subject matter experts for 3 shifts on all information security domains, even if they do, spending around $40M for the security management infrastructure will not make sense. It makes sense to work with someone who has expertise, 7x24 operations, and the infrastructure. I have several reports from 3rs parties with the same highlights. Also having 60% security does not mean any security, so that is more market share for MSSPs. Yes, I do think Asia and Middle East will be key enlargement areas for MSSPs where security is a part of daily life. The more operations get online, the more companies will demand certified 3rd parties for security. My company (Integralis) has been a long time household name in information security has invested key resources on MSS solutions and we have recently acquired a company in UAE to expand our MSSP operations in Middle East. Now we have operations in Dubai. We are actively looking at MSSP operations at Pacific Rim as well. 2- All the MSSPs should be interested (See my recent linkedin answers for active player names) . That being said, I do recommend getting in touch with Integralis Channel contacts. We do have several system integrators and Telco's co branding our MSSP offering. 3- Well, I do know hundreds of contacts :) but that is probably related with the position I am in. But we had conducted several market surveys in multiple countries, it looks like 15% of the survey groups are already outsourcing or ready to outsource, that percentage increase with certain technologies such as IPS and E-mail.. I do have a lot of resources, so let me know if you have any specific solutions, Regards, - yinal ozkan
Subscribe to:
Posts (Atom)