Sign in or 
Share this
Chapter 2 - Security Model - Security Threats
In order to secure a site or organization, the first thing to know is where the security threats exist, how these threats are exploited, and what the financial ramifications are for each of these threats. The primary step in addressing security threats is to conduct and periodically repeat an information security risk evaluation that identifies your critical information assets (e.g., systems, networks, and data), threats to critical assets, asset vulnerabilities, and risks.
A security assessment should include the following elements:
Create a list of all vendors including PeopleSoft who has supplied software and hardware for the deployed system. Then for each vendor and their hardware/software create a list of known vulnerabilities. This list provides a list of “known” issues and security concerns, and at a minimum these should be addressed. This might include applying patches, identifying workarounds and implementing them during deployment.
The list of known vulnerabilities and the results of the security assessment will provide your organization with a remediation roadmap for improving the security posture of your PeopleSoft environment. It is crucial to actually implement the fixes, patches, and recommended security infrastructure improvements. In many cases, significant improvements in overall security can be achieved with minimal levels of effort (man-hours) or costs. In short, action IS a requirement. Failure to implement remediations or address discovered vulnerabilities and risks will leave your entire infrastructure at risk.
Defense-in-depth is a practical strategy for achieving information security (often called information assurance) in today’s highly networked environments. It is a “best practices” strategy in that it relies on the intelligent application of techniques and technologies that exist today. The strategy recommends a balance between the protection capability and cost, performance, and operational considerations. It’s also important to resist detrimental effects from non-malicious events such as fire, flood, power outages and user error.
The defense-in-depth approach builds mutually supporting layers of defense to reduce vulnerabilities, and to assist an organization in its efforts to protect against, detect, and react to as many attacks as possible. The construction of mutually supporting layers of defense inhibits the ability of an adversary who penetrates or breaks down one defensive layer to promptly encounter another, and another, until the attack is ultimately thwarted. To protect against different attack methods, it’s important to employ corresponding security measures. The weakness of one security measure should be compensated for by the strength of another.
To effectively resist attacks against its information and information systems, an organization needs to characterize its adversaries, their potential motivations, and their classes of attack. Potential adversaries might include nation states, terrorists, criminal elements, hackers, or corporate competitors. Their motivations might include intelligence gathering, theft of intellectual property, denial of service, embarrassment, or just pride in exploiting a notable target. Their classes of attack might include passive monitoring of communications, active network attacks, close-in attacks, exploitation of insiders, and attacks through the industry providers of information technology resources.
The goal of implementing a security model is to provide information security and protection (assurance). This goal is realized when information and information systems are protected against such attacks through the application of security services discussd previously in the chapter: such as availability, integrity, authentication, confidentiality, and nonrepudiation. The application of these services should be based on the Protect, Detect, and React paradigm. This means that in addition to incorporating protection mechanisms, organizations should expect attacks, and employ attack detection tools and procedures that enable them to react to and recover from these attacks.
An important principle of the defense-in-depth strategy is that achieving information assurance requires a balanced focus on three primary elements: people, technology, and operations. These areas of attention correlate very well to the three primary elements of the “defense in depth” approach to security :
Defense-in-Depth Summary
The key aspects of defense-in-depth are that it’s layered, comprehensive, tested and proven, flexible rather than brittle, and that it requires knowledge and skill. While it is impossible to anticipate every contingency, developing a well-rounded information security plan can help to dissuade all but the most determined attackers. With proper auditing systems such as audit logs, intrusion detection systems, and other mechanisms, incident response staff will have the right tools to determine what happened should a successful attack take place. Finally, keep in mind that maintaining confidentiality, integrity, and availability of information requires significant resources, time, and money. Security is not something that can be dropped in place and forgotten.
Having a defense-in-depth approach in mind, securing your PeopleSoft environment requires you to implement a combination of security mechanisms and controls. These security mechanisms and controls will touch on many facets of the PeopleSoft environment. Be sure to address the following areas:
A security assessment should include the following elements:
- Identify the adverse impacts when risks to critical assets are realized including: financial, reputation, market position, time/productivity, and so on.
- Quantify the financial impact to the greatest extent possible.
- Develop and implement a risk mitigation plan resulting from the evaluation, and keep it updated.
- Ensure that there are regular review and management of the risks to critical information assets.
Create a list of all vendors including PeopleSoft who has supplied software and hardware for the deployed system. Then for each vendor and their hardware/software create a list of known vulnerabilities. This list provides a list of “known” issues and security concerns, and at a minimum these should be addressed. This might include applying patches, identifying workarounds and implementing them during deployment.
The list of known vulnerabilities and the results of the security assessment will provide your organization with a remediation roadmap for improving the security posture of your PeopleSoft environment. It is crucial to actually implement the fixes, patches, and recommended security infrastructure improvements. In many cases, significant improvements in overall security can be achieved with minimal levels of effort (man-hours) or costs. In short, action IS a requirement. Failure to implement remediations or address discovered vulnerabilities and risks will leave your entire infrastructure at risk.
Defense-in-depth is a practical strategy for achieving information security (often called information assurance) in today’s highly networked environments. It is a “best practices” strategy in that it relies on the intelligent application of techniques and technologies that exist today. The strategy recommends a balance between the protection capability and cost, performance, and operational considerations. It’s also important to resist detrimental effects from non-malicious events such as fire, flood, power outages and user error.
The defense-in-depth approach builds mutually supporting layers of defense to reduce vulnerabilities, and to assist an organization in its efforts to protect against, detect, and react to as many attacks as possible. The construction of mutually supporting layers of defense inhibits the ability of an adversary who penetrates or breaks down one defensive layer to promptly encounter another, and another, until the attack is ultimately thwarted. To protect against different attack methods, it’s important to employ corresponding security measures. The weakness of one security measure should be compensated for by the strength of another.
To effectively resist attacks against its information and information systems, an organization needs to characterize its adversaries, their potential motivations, and their classes of attack. Potential adversaries might include nation states, terrorists, criminal elements, hackers, or corporate competitors. Their motivations might include intelligence gathering, theft of intellectual property, denial of service, embarrassment, or just pride in exploiting a notable target. Their classes of attack might include passive monitoring of communications, active network attacks, close-in attacks, exploitation of insiders, and attacks through the industry providers of information technology resources.
The goal of implementing a security model is to provide information security and protection (assurance). This goal is realized when information and information systems are protected against such attacks through the application of security services discussd previously in the chapter: such as availability, integrity, authentication, confidentiality, and nonrepudiation. The application of these services should be based on the Protect, Detect, and React paradigm. This means that in addition to incorporating protection mechanisms, organizations should expect attacks, and employ attack detection tools and procedures that enable them to react to and recover from these attacks.
An important principle of the defense-in-depth strategy is that achieving information assurance requires a balanced focus on three primary elements: people, technology, and operations. These areas of attention correlate very well to the three primary elements of the “defense in depth” approach to security :
- People. Achieving information assurance begins with a commitment by senior management (typically at the Chief Information Officer level) based on a clear understanding of the perceived threat. This must be followed through with effective information assurance policies and procedures, assignment of roles and responsibilities, commitment of resources, training of critical personnel (e.g. users and system administrators), and personal accountability. This includes the establishment of physical security and personnel security measures to control and monitor access to facilities and critical elements of the Information Technology environment.
- Technology. Today, a wide range of technologies is available for providing information assurance services and for detecting intrusions. To insure that the right technologies are procured and deployed, an organization should establish effective policies and processes for technology acquisition. These should include: a security policy, information assurance principles, system level information assurance architectures and standards, criteria for needed information assurance products, acquisition of products that have been validated by a reputable third party, configuration guidance, and processes for assessing the risk of the integrated systems.
- Operations. The operations element focuses on all the activities required to sustain an organization’s security posture on a day-to-day basis. These include:
|
The key aspects of defense-in-depth are that it’s layered, comprehensive, tested and proven, flexible rather than brittle, and that it requires knowledge and skill. While it is impossible to anticipate every contingency, developing a well-rounded information security plan can help to dissuade all but the most determined attackers. With proper auditing systems such as audit logs, intrusion detection systems, and other mechanisms, incident response staff will have the right tools to determine what happened should a successful attack take place. Finally, keep in mind that maintaining confidentiality, integrity, and availability of information requires significant resources, time, and money. Security is not something that can be dropped in place and forgotten.
Having a defense-in-depth approach in mind, securing your PeopleSoft environment requires you to implement a combination of security mechanisms and controls. These security mechanisms and controls will touch on many facets of the PeopleSoft environment. Be sure to address the following areas:
- Organization Security:
|
- Operations Security:
|
- Infrastructure Security:
|
- Application Security:
|
gregkelly |
Latest page update: made by gregkelly
, Feb 16 2009, 7:59 PM EST
(about this update
About This Update
Edited by gregkelly
1 word added 2 words deleted view changes - complete history) |
|
Keyword tags:
None
More Info: links to this page
|
There are no threads for this page.
Be the first to start a new thread.
