Chapter 8 Controls for information Security
Trust Services Framework
• Security
o Access to the system and data is controlled and restricted to legitimate users.
• Confidentiality
o Sensitive organizational data is protected
• Privacy
o Personal information about trading partners, investors, investors, and employees are
protected
• Processing integrity
o Data are processed accurately, completely, in a timely manner, and only with proper
authorization
• Availability
o System and information are available
Relationships Among the Five Trust Services Principles for Systems Reliability
information security is the foundation of systems reliability and is necessary for achieving each
of other four principles.
Security Life Cycle
Security is a management issue, not just a technology issue
Security Approaches
• Defense-in-depth
o Employing multiple layers of controls (preventive and detective) to avoid a single
point of failure
o The concept of defense-in-depth is based on the idea that, given enough time and
resources, any single control, no matter how sophisticated, can be overcome—
therefore, the use of redundant, overlapping controls maximizes security.
• Time-based model, security is effective if:
o P > D + C where
▪ P is time it takes an attacker to break through preventive controls
▪ D is time it takes to detect an attack is in progress
▪ C is time it takes to respond to the attack and take corrective action
time-based model of security – Implementing a combination of preventive, detective and
corrective controls that protect information assets long enough to enable an organization to
recognize that an attack is occurring and take steps to thwart it before any information is
lost or compromised.
– The time-based model of security, while theoretically valid, is difficult to apply.
Understanding Targeted Attacks
1. Conduct reconnaissance
2. Attempt social engineering
social engineering – Using deception to obtain unauthorized access to information
resources.
3. Scan and map the target.
4. Research.
5. Execute the attack.
6. Cover tracks.
How to mitigate risk of attack
• Preventive controls （下面详细介绍）
preventive controls – Controls that deter problems before they arise.
o People
o Process
o IT solutions
o Physical security
o Change controls and change management
• Detective controls
detective controls – Controls designed to discover control problems that were not
prevented.
– Detective controls actually monitor preventive controls.
o Log analysis
– The process of examining logs to identify evidence of possible attacks.
o Intrusion detection systems
– A system that creates logs of all network traffic that was permitted to pass the
firewall and then analyzes those logs for signs of attempted or successful intrusions.
o Penetration testing
– An authorized attempt to break into the organization’s information system.
o Continuous monitoring
o Vulnerability scan
– A detective control that identifies weaknesses in devices or software
• Corrective
corrective controls – Controls that identify and correct problems as well as correct and
recover from the resulting errors.
o Computer Incident Response Team (CIRT)
– A team that is responsible for dealing with major security incidents.
o Chief Information Security Officer (CISO)
o Patch management
• The process of regularly applying patches and updates to software.
• Patch management involves replacing flawed code that represents a vulnerability
with corrected code, called a patch.
exploit – A program designed to take advantage of a known vulnerability.
patch – Code released by software developers that fixes a particular vulnerability.
Preventive: People
• Culture of security
o Tone set at the top with management
• Training
o Follow safe computing practices
▪ Never open unsolicited e-mail attachments
▪ Use only approved software
▪ Do not share passwords
▪ Physically protect laptops/cellphones
o Protect against social engineering
Preventive: Process
• Authentication – verifies the person
1. Something person knows (passwords or personal identification numbers (PINs))
2. Something person has (smart cards or ID badges)
3. Some biometric (fingerprints or typing patterns) and characteristic
biometric identifier – A physical or behavioral characteristic that is used as an
authentication credential.
4. Combination of all three
authentication – Verifying the identity of the person or device attempting to access the
system.
multifactor authentication – The use of two or more types of authentication credentials in
conjunction to achieve a greater level of security. (例子： a PIN and an ATM card – The
PIN is something a person knows, the ATM card is something the person has.)
multimodal authentication – The use of multiple authentication credentials of the same
type to achieve a greater level of security. (例子：voice recognition and a fingerprint
reader)
• Authorization – determines what a person can access
authorization – The process of restricting access of authenticated users to specific portions
of the system and limiting what actions they are permitted to perform.
access control matrix – A table used to implement authorization controls
when an employee attempts to access a particular information systems resource, the
