Separation of Duties and Collusion

Separation of Duties 

Separation of Duties is an important security concept in which critical, significant, and sensitive work tasks are divided among several individual administrators or high-level operators.

Separation of Duties serves two function

1. Principle of least privilege: According to this principle, users needs to be given access to only those resource that is essential to carry out task under job responsibilities.

2. Protection against collusion: Collusion is the occurrence of negative activity undertaken by two or more people for the purposes of fraud, theft, or espionage.

How is collusion prevented with separation of duties?

• Deterrence effect. The chance that they might get caught will discourage them.
• Collusion is difficult and increases risk to the initiator prior to the commission of the act.

Candidate Screening and Hiring

Screening is based on sensitivity and classification defined by the Job Description. Screening includes following activities

• Background checks, 
• Reference checks, 
• Candidate’s work and education verification
• Security clearance validation
• Interviewing colleagues, neighbors, and friends; 
• Checking policy and government records; 
• Verifying identity through fingerprints, 
• Driver’s license, and birth certificate; 
• Polygraph test, drug testing, 
• Personality testing

SDLC and Security Requirements

Software Development Lifecycle (SDLC)

• Requirements gathering Determine why to create this software, what the software will do, and for whom the software will be created. Security/Privacy risk assessment, Risk-level acceptance, Informational, functional, and behavioral requirements
• Design Deals with how the software will accomplish the goals identified, which are encapsulated into a functional design. Attack surface analysis, Threat modeling
• Development Programming software code to meet specifications laid out in the design phase and integrating that code with existing systems and/or libraries. Automated CASE tools, Static analysis
• Testing/validation Verifying and validating software to ensure that the software works as planned and that goals are met. Dynamic analysis, Fuzzing, Manual, Unit, integration, acceptance, regression
• Release/maintenance Deploying the software and then ensuring that it is properly configured, patched, and monitored. Final security review.

Software Security Requirements Gathering

Security should be integrated at the earliest stage of the lifecycle instead of trying to do it later, which will increase costs and risks and may result in redesign or rework. It is much easier to identify potential security issues in the very beginning than to try and fix them later. Therefore, requirement gathering phase is the most important in ensuring security in SDLC process.

Software security requirements fall into two categories. 

• Requirements for the software's security functions (such as cryptographic and user authentication functions)
• Requirements for the software's properties and behaviors

Types of Security Requirements:

CIA triad and the AAA model, are the core foundational concepts in security requirements

• Confidentiality: how the system prevents the disclosure of information.
• Integrity: how the system protects data from unauthorized access.
• Availability: access to the system by authorized personnel.
• Authentication: process of determining the identity of a user. Three methods can be used to authenticate a user: Something you know (ex: password, pin code). Something you have (ex: token, card). Something you are (ex: biometrics mechanisms).
• Authorization: process of applying access control rules to a user process to determine if a particular user process can access an object.
• Accounting (auditing): records historical events on a system.

These core software security concepts are used to build out a security requirements matrix that includes general, operational, and other security requirements.

• General:
• Session management: design and implementation of controls to ensure that the communications channels are secured from unauthorized access and disruption of communications.
• Exception management: the process of handling any errors that could appear during the system execution.
• Configuration management: identification and management of the configuration items (initialization parameters, connection strings, paths, keys).
• Operational:
• Deployment Environment: Identify and capture pertinent requirements about the environment in which the software will be deployed. -
• Archiving: Identify the regulatory and business requirement for business continuity
• Anti-piracy: Identify requirements for code obfuscation, code signing, anti-tampering, and IP protection mechanisms.
• Other:
• Sequencing and Timing: Identify sequencing and timing requirements to protect against race conditions of Time of Check/Time of Use (TOC/TOU) attacks.
• International: Factor in any international requirements that include both legal and technological requirements
• Procurement: Evaluate and communicate requirements if purchased.

Reference: Mike Chapel, (ISC)2 Official CISSP Guide, 8th Edition

Threat Modeling

An ultimate goal of threat modeling is to prioritize the potential threats against an organization’s assets.

Threat modeling is the security process where potential threats are identified, categorized, and analyzed. This process identifies the potential harm, the probability of occurrence, the priority of concern and the means to eradicate or reduce the threat.

Microsoft uses a Security Development Lifecycle (SDL) process to consider and implement security at each stage of a product’s development. This supports the motto of “Secure by Design, Secure by Default, Secure in Deployment and Communication” (also known as SD3+C). It has two goals in mind with this process:

• To reduce the number of security-related design and coding defects 

• To reduce the severity of any remaining defects. 
In other words, it attempts to reduce vulnerabilities and reduce the impact of any vulnerability that remain. 

The overall result is reduced risk. 


There are two approach to threat modeling. Proactive and Reactive.

• A proactive approach (also known as defensive approach) takes place during the early stages of systems development, specifically during initial design and specifications establishment. This method is based on predicting threats and designing in specific defenses during the coding and crafting process, rather than relying on post-deployment updates and patches. 

• A reactive approach (also known as the adversarial approach) takes place after a product has been created and deployed. This deployment could be in a test or laboratory environment or to the general marketplace. This technique of threat modeling is the core concept behind ethical hacking, penetration testing, source code review, and fuzz testing. 


Identifying Threats

• Focused on Assets: This method uses asset valuation results and attempts to identify threats to the valuable assets.
• Focused on Attackers: This method identifies potential attackers and can identify the threats they represent based on the attacker’s goals. A challenge with this approach is that new attackers can appear that weren’t previously considered a threat.
• Focused on Software: This method identifies potential threats against the software. Specifically, most organizations have a web presence, and many create their own web pages. Fancy web pages drive more traffic, but they also require more sophisticated programming and present additional threats. 

Analyzing Threats

There are two methods to analyze threats to an organization.

• Determining and Diagramming Potential Attacks: This is a process of crafting an architecture diagram, where the elements involved in a transaction along with indication of data flow and privilege boundaries are identified. This diagram helps to detail the functions and purpose of each element of a business task, development process, or work activity.
• Performing Reduction Analysis: This is a process of decomposing the application, system, or environment. The purpose of this task is to gain a greater understanding of the logic of the product as well as its interactions with external elements. Five key concepts need to be identified:
• Trust Boundaries Any location where the level of trust or security changes 

• Data Flow Paths The movement of data between locations 

• Input Points Locations where external input is received 

• Privileged Operations Any activity that requires greater privileges than of a standard user account or process, typically required to make system changes or alter security 

• Details about Security Stance and Approach The declaration of the security policy, security foundations, and security assumptions 


Categorize and Prioritize Threats

To categorize and prioritize threat the first step is to fully document the threats. In this documentation, you should define the means, target, and consequences of a threat. After documentation, rank or rate the threats. This can be accomplished using a wide range of techniques, such as Probability × Damage Potential ranking, high/medium/low rating, or the DREAD system. 


DREAD

The DREAD is a rating system that is designed to provide a flexible rating solution that is based on the answers to five main questions about each threat: 


• Damage potential: How severe is the damage likely to be if the threat is realized? 

• Reproducibility: How complicated is it for attackers to reproduce the exploit? 

• Exploitability: How hard is it to perform the attack? 

• Affected users: How many users are likely to be affected by the attack (as a percentage)? 

• Discoverability: How hard is it for an attacker to discover the weakness? 


Reference: Mike Chappel, (ISC)2 CISSP Official Guide, 8th edition

Concepts of Computer Forensics

Some examples of modern cybercrime

• child pornography; 
• fraud; 
• terrorism; 
• extortion; 
• cyberstalking; 
• money laundering; 
• forgery;
• identify theft etc.

Cybercrime investigations heavily relies upon digital evidences such as
Media Analysis

• Magnetic media (e.g., hard disks, tapes)
• Optical media (e.g., compact discs (CDs), digital versatile discs (DVDs), Blu-ray discs)
• Memory (e.g., random-access memory (RAM), solid-state storage)

Network analysis

• Intrusion detection and prevention system logs   
• Network flow data captured by a flow monitoring system
• Packet captures deliberately collected during an incident
• Logs from firewalls and other network security devices

Software Analysis

• In some cases, when malicious insiders are suspected, the forensic analyst may be asked to conduct a review of software code, looking for back doors, logic bombs, or other security vulnerabilities.
• In other cases, forensic analysts may be asked to review and interpret the log files from application or database servers, seeking other signs of malicious activity, such as SQL injection attacks, privilege escalations, or other application attacks.

Hardware/Embedded Device Analysis

• Personal computers
• Smartphones
• Tablet computers
• Embedded computers in cars, security systems, and other devices

Computer forensics can be defined as gathering and analyzing data in a manner as free from distortion or bias as possible, to reconstruct data or what has happened in the past on a system. Thus, the ultimate goal of a forensic investigation is to identify, analyze, reconstruct past events or activities, and to present admissible evidence to court. There are basically three criteria for an evidence to be admissible to court

• The evidence must be relevant to determining a fact.
• The fact that the evidence seeks to determine must be material (that is, related) to the case.
• The evidence must be competent, meaning it must have been obtained legally. Evidence that results from an illegal search would be inadmissible because it is not competent.

Forensic investigators use forensic tools and follow appropriate procedures to collect, preserve, analyze, and report admissible evidence to court providing his or her critical judgments of exactly what has happened. It is very important to prove that evidence presented to court has never been modified.

How evidence was collected, stored, and analyzed? could potentially taint digital evidence. Example: suppose you copy a file using Linux command CP. This results in modification of files' time of access, accidentally tainting the evidence.

Where are evidence collected from?
Basically everywhere. Data can be in one of the three states:

• At rest, which means stored in a computer drive, the Cloud, or a USB drive, etc, a mobile phone; 
• data in use, which means data is in a computer's memory currently in use; 
• data in transit, which means moving through a network.

It is to be noted that the tool to collect/analyze data at rest are different from tools used for data in transit. Moreover, there are tools and technologies, called anti-digital forensics or ADF, which are designed to thwart discovery of such information. The main aim of ADF is to erase, obfuscase, or manipulate digital data, which makes forensic investigation much more difficult, time-consuming, and/or virtually impossible.
Example:

• renaming files by changing file extensions; 
• data hiding by associating good blocks with the bad block inodes; 
• overwriting data and metadata, sometimes called wiping; 
• hide or obfuscating data through steganography, cryptography, and other methods.

CISSP: Data Classification

Data Classification

• Primary means by which data is protected based on its need for secrecy, sensitivity, or confidentiality. 
• To determine how much effort, money, and resources are allocated to protect the data and control access to it. 
• To provide security mechanisms for storing, processing, and transferring data. 
• Addresses how data is removed from a system and destroyed.
• Process of organizing items, objects, subjects, and so on into groups, categories, or collections with similarities. Similarities could include value, cost, sensitivity, risk, vulnerability, power, privilege, possible levels of loss or damage, or need to know.
• Primary objective is to formalize and stratify the process of securing data based on assigned labels of importance and sensitivity.

The following are benefits of using a data classification scheme:

• It demonstrates an organization’s commitment to protecting valuable resources and assets.
• It assists in identifying those assets that are most critical or valuable to the organization.
• It lends credence to the selection of protection mechanisms.
• It is often required for regulatory compliance or legal restrictions.
• It helps to define access levels, types of authorized uses, and parameters for declassification and/or destruction of resources that are no longer valuable.
• It helps with data lifecycle management which in part is the storage length (retention), usage, and destruction of the data.

Data classification is based on

• Usefulness/Timeliness/Value/Cost/Maturity/Age/Lifetime of the data
• Association with personnel
• Data disclosure damage assessment (how disclosure of data would affect the organization)
• Data modification damage assessment (how modification of data would affect the organization)
• National security implications of the data
• Authorized access to the data (who has access to the data)
• Restriction from the data (who is restricted from the data)
• Maintenance and monitoring of the data (who should maintain and monitor the data)
• Storage of the data

Phases/Steps to data classification

1. Identify the custodian, and define their responsibilities.
2. Specify the evaluation criteria of how the information will be classified and labeled.
3. Classify and label each resource. (The owner conducts this step, but supervisor reviews it)
4. Document any exceptions to the classification policy that are discovered, and integrate them into the evaluation criteria.
5. Select the security controls that will be applied to each classification level to provide the necessary level of protection.
6. Specify the procedures for declassifyingresources and the procedures for transferring custody of a resource to an external entity.
7. Create an awareness program to instruct all personnel about the classification system.

Government/Military classification

• Top secret highest level of classification. The unauthorized disclosure will have drastic effects and cause grave damage to national security. Top-secret data is compartmentalized on a need-to-know basis; a user could have top-secret clearance and have access to no data until the user has a need to know.
• Secret is used for data of a restricted nature. The unauthorized disclosure will have significant effects and cause critical damage to national security.
• Confidential is used for data of a sensitive, proprietary, or highly valuable nature. The unauthorized disclosure will have noticeable effects and cause serious damage to national security.
• Sensitive But Unclassified (SBU) is used for data that is for internal use or for office use only (FOUO). Protects information that could violate the privacy rights of individuals.
• Unclassified is used for data that is neither sensitive nor classified.

Private/Business Sector

• Confidential This is used for data that is extremely sensitive and for internal use only. A significant negative impact could occur for a company if confidential data is disclosed. Sometimes labeled as proprietary. If proprietary data is disclosed, it can have drastic effects on the competitive edge of an organization.
• Private is used for data that is of a private or personal nature and intended for internal use only. If disclosed a significant negative impact could occur for the company/individuals.
• Sensitive is used for data that is more classified than public data. A negative impact could occur for the company if sensitive data is disclosed.
• Public is the lowest level of classification. This is used for all data that does not fit in one of the higher classifications. Its disclosure does not have a serious negative impact on the organization.

Confidential and private data in a commercial business/private sector classification scheme both require roughly the same level of security protection. The real difference between the two labels is that confidential data is company data whereas private data is data related to individuals, such as medical data.

Reference
Mike Chapple. (ISC)2 CISSP Certified Information Systems Security Professional Official Study Guide.

CISSP: Security Governance

Security Governance

• Collection of practices to support, define, and direct the security efforts of an organization
• Common goal is to maintain business processes while striving toward growth and resiliency

Alignment of Security Function

Security management planning ensures proper creation, implementation, and enforcement of a security policy. It is a responsibility of upper management and most effective ways to tackle is to use a top-down approach. That is, senior management is responsible for initiating and defining policies for the organization.

Elements of security management planning

• Define security roles;
• Prescribe how security will be managed, who will be responsible for security, and how security will be tested for effectiveness;
• Develop security policies;
• Perform risk analysis; and
• Require security education for employees.

The best security plan is only possible by approval from senior management. 

Developing and implementing a security policy is evidence of due care and due diligence on the part of senior management.

A security management planning team should develop three types of plan

• Strategic Plan is long-term fairly stable, usually of 3-5 years and includes risk assessment. It defines organization’s security purpose, helps to understand security function, and align it to the goals, mission, and objectives of the organization.
• Tactical Plan is a midterm plan that provides details to accomplish goals of strategic plan. It is useful for about a year. E.g. project plans, acquisition plans, hiring plans, budget plans, maintenance plans, support plans, and system development plans.
• Operational Plan is based on the strategic and tactical plans and is a short-term, highly detailed plan valid for a short time (monthly or quarterly). It dictates how to accomplish the various goals of the organization and includes resource allotments, budgetary requirements, staffing assignments, scheduling, and step-by-step or implementation procedures. E.g. training plans, system deployment plans, and product design plans.

Organizational Processes

Security governance needs to address every aspect of an organization including processes of acquisitions, divestitures, and governance committees. 

Risks in acquisitions and mergers

• information disclosure, 
• data loss, 
• downtime, or 
• failure to achieve return on investment (ROI)

Therefore, a healthy dose of security oversight and increased scrutiny is often essential to reduce the likelihood of losses during such a period of transformation.

Change Control Management

Another important aspect of security management is change control management.

Change can introduce loopholes, overlaps, missing objects, and oversights that can lead to new vulnerabilities. Managing change usually involves extensive planning, testing, logging, auditing, and monitoring of activities related to security controls and mechanisms.

Goals/requirements of change management

• Ensure that any change does not lead to reduced or compromised security
• Implement changes in a monitored and orderly manner. Changes are always controlled.
• A formalized testing process is included to verify that a change produces expected results.
• All changes can be reversed (also known as backout or rollback plans/procedures).
• Users are informed of changes before they occur to prevent loss of productivity.
• The effects of changes are systematically analyzed to determine whether security or business processes are negatively affected.
• The negative impact of changes on capabilities, functionality, and performance is minimized.
• Changes are reviewed and approved by a Change Advisory Board (CAB).

Reference
Mike Chapple. (ISC)2 CISSP Certified Information Systems Security Professional Official Study Guide.