SECURITY PLANNING

By DONALD JACKSON

CONTENTS CHAPTER SETTING THE STAGE FOR SUCCESSFUL SECURITY PLANNING NOT AN ABSOLUTE SCIENCE A WAY OF THINKING AVOIDING THE PITFALLS THE ULTRA-PLANNER THE NONPLANNER THE SHOCK-ADVISOR IDENTIFYING RISK PROFILING HACKERS THE ATTENTION SEEKER THE MALICIOUS THE CURIOUS THE THIEF THE UNINTENTIONAL HACKER NEGOTIATING WITH HACKERS SELLING SECURITY AUTHENTICATION, TOKENS, SMART CARDS, AND BIOMETRICS: AN OVERVIEW MAKING THE SECURITY SALE: AN EXAMPLE DOING THE MATH UNDERSTANDING IMPACT ANALYSIS PERFORMING SECURITY IMPACT ANALYSIS: AN EXAMPLE COUNTING THE COST OF SECURITY ESTABLISHING MAXIMUM IMPACT, COST, AND THE SECURITY BUDGET ESTIMATING THE VALUE OF SECURITY LAYING THE SECURITY FOUNDATION IMPROVING SECURITY AS PART OF THE BUSINESS PROCESS CONCLUSIONS CHAPTER A SECURITY PLAN THAT WORKS FORMING A SECURITY PLANNING TEAM AT THE FIRST MEETING ANATOMY OF AN EFFECTIVE SECURITY PLAN THE IMPORTANCE OF A SECURITY-CENTRIC BUSINESS MODEL INFORMATION INFRASTRUCTURE PEOPLE SECURITY LIFE CYCLE CHOOSING TECHNOLOGY HITTING THE ON SWITCH: IMPLEMENTATION KEEPING A LOOKOUT: OPERATIONS DEALING WITH THREATS, HACKS, AND MISTAKES: INCIDENT RESPONSE ACTIVITIES COORDINATING TEAM MEMBERS NOTIFYING AUTHORITIES FILING AN INCIDENT REPORT TESTING INCIDENT HANDLING CREATING ORDER FROM CHAOS: THE SECURITY STACK MAPPING THE TEMPLATE: THE KEYS TO THE KINGDOM PREPARING TO WORK WITH THE SECURITY ELEMENTS INTRODUCING THE SECURITY ELEMENTS THE CORE ELEMENTS THE FUNDAMENTALS THE WRAP-UP ELEMENTS USING THE SECURITY PLAN WORKSHEETS: THE FUNDAMENTALS FROM HERE TO SECURITY ORGANIZATION OF THE WORKSHEETS FILLING IN THE FUNDAMENTAL SECURITY ELEMENT WORKSHEETS AUTHORIZATION AND ACCESS CONTROL SUMMARY SECURITY STACK LIFE-CYCLE MANAGEMENT BUSINESS AUTHENTICATION ENCRYPTION INTEGRITY NONREPUDIATION PRIVACY USING THE SECURITY PLAN WORKSHEETS: THE REMAINING CORE AND WRAP-UP ELEMENTS ADDRESSING, PROTOCOL SPACE, ROUTING PLAN, FILTERING, AND DISABLEMENT CONFIGURATION MANAGEMENT CONTENT AND EXECUTABLE MANAGEMENT (CEM) DIRECTORY SERVICES LIFE CYCLE MANAGEMENT DIVERSITY, REDUNDANCY, AND ISOLATION (DRI) DRI: AN EXAMPLE INTRUSION DETECTION AND VULNERABILITY ANALYSIS (IDS/VA) SECURE SOFTWARE SECURE TIME SERVICES STAFF MANAGEMENT WRAP-UP SECURITY ELEMENT WORKSHEETS ADMINISTRATION AND MANAGEMENT INTEROPERABILITY AND STANDARDS LAWS AND REGULATIONS LOCKDOWN LOST OR STOLEN ITEMS MANAGED (OUTSOURCED) SECURITY PERFORMANCE PHYSICAL SECURITY PROCUREMENT SUPPORT INTERFACE TESTING, INTEGRATION, AND STAGING TRAINING RECOVERY STRATEGIC SECURITY PLANNING WITH PKI PKI PRIMER AUTHENTICATION AND NONREPUDIATION WITH DIGITAL SIGNATURES THE X 509 STANDARD AND CERTIFICATE AUTHORITIES MAKING A BUSINESS CASE FOR PKI CLASSIFYING PKI BENEFITS OF VIRTUAL PRIVATE NETWORKS PKI SERVICES PKI BUSINESS INTEGRATION COLLABORATION, WORKFLOW, AND BUSINESS PROCESSES INVENTORY AND SUPPLIER MANAGEMENT SOFTWARE DISTRIBUTION METHODS SINGLE, OR REDUCED, SIGN-ON FORMALIZATION OF POLICIES AND PRACTICES LEGISLATION PKI IN VERTICAL INDUSTRIES FINANCIAL SERVICES HEALTH CARE LEGAL RETAIL AND MANUFACTURING GOVERNMENT CHALLENGES OF PKI BUSINESS JUSTIFICATION SCALABILITY INTEROPERABILITY EMERGING STANDARDS COMPLEXITY MATURITY DISASTER PLANNING AND RECOVERY INTEGRATION POLICIES, PRACTICES, RELIANCE, RISK, LIABILITY, AND TRUST CASE STUDY: A REAL-WORLD BUSINESS-TO-BUSINESS PKI SUCCESS STORY BACKGROUND COMPONENTS OF THE SOLUTION ROLES AND RESPONSIBILITIES CHALLENGES AND LESSONS LEARNED EDUCATING USERS ON INTERNET AND DIGITAL CERTIFICATE TECHNOLOGIES DEFINING ROLES LINKING CORPORATE SECURITY WITH DOING BUSINESS SUCCESSFULLY DEVELOPING DIGITAL CERTIFICATE POLICIES AND PROCEDURES COORDINATING PRODUCT DEPENDENCIES OASIS TODAY AHEAD OF THE HACKER: BEST PRACTICES AND A VIEW OF THE FUTURE PRACTICE MAKES PERFECT—OR AT LEAST MORE SECURE INTO THE FUTURE: THE TOP 10 METHODS OF ATTACK IN CLOSING FOR FURTHER READING SECURITY ISN’T A PRODUCT, A FEATURE, OR ANYTHING THAT WE CAN SIMPLY ACQUIRE AND THEN IMPLEMENT, CONFIDENT THAT IT WILL WORK NOW AND FOREVER AFTER IT IS A HIGHLY COMPLEX, ORGANIC PROCESS, ONE WE MUST MANAGE HEURISTICALLY AND OPTIMIZE IN AN ONGOING PROCESS SECURITY IS ALSO A WAY OF THINKING; IT IS NEITHER AN ABSOLUTE SCIENCE NOR A PURELY TECHNICAL SUBJECT SECURITY PLANNING DEMANDS AN UNDER- STANDING OF THE PSYCHOLOGY OF THE HACKER, OF THE KEY VARIABLES INFLUENCING INFORMATION AND INFRASTRUCTURE VULNERABILITY, AND OF THE ORGANIZATION’S BUSI- NESS SECURITY ALSO REQUIRES A FRAMEWORK FOR WEIGHING THESE VARIABLES, FOR THE PURPOSE OF DRIVING SECURITY IMPLEMENTATION DECISIONS AND ASSOCIATED BUDGETS THIS CHAPTER SETS THE STAGE FOR A SECURITY PLANNING APPROACH THAT WORKS ALONG THE WAY, WE’LL IDENTIFY THE CHALLENGES, PROBLEMS, AND PITFALLS ASSOCIATED WITH LESS-THAN-OPTIMAL APPROACHES SO THAT WE KNOW HOW TO AVOID THEM WE WILL ADDRESS THE IMPORTANT TOPICS OF SECURITY RISK (IMPACT) ANALYSIS, TO GIVE OUR SECURITY PLAN FOCUS AND JUSTIFICATION TO THAT END, THE CHAPTER INTRODUCES A METHOD FOR GUIDING AND JUSTIFYING YOUR SECURITY BUDGET AND ADDRESSES THE IMPORTANT TOPIC OF SUCCESSFULLY “SELLING” SECURITY INSIDE YOUR ORGANIZATION THE CHAPTER CLOSES WITH A SUMMARY OF SECURITY BUSINESS PROCESS IMPROVEMENT ALL OF THE TOPICS INTRODUCED ARE THEN EXPANDED ON THROUGHOUT THE REMAINDER OF THE BOOK SETTING THE STAGE FOR SUCCESSFUL SECURITY PLANNING C HAPTE R