ISA contained research papers submitted by researchers from all over the world. In order to guarantee high-quality proceedings, we put extensive effort into reviewing the papers. All submissions were peer reviewed by at least three Program Committee members as well as external reviewers. As the quality of the submissions was quite high, it was extremely difficult to select the papers for oral presentation and publication in the proceedings of the conference.
Written by two INFOSEC experts, this book provides a systematic and practical approach for establishing, managing and operating a comprehensive Information Assurance program.
It is designed to provide ISSO managers, security managers, and INFOSEC professionals with an understanding of the essential issues required to develop and apply a targeted information security posture to both public and private corporations and government run agencies.
There is a growing concern among all corporations and within the security industry to come up with new approaches to measure an organization's information security risks and posture. The authors lay out a detailed strategy for defining information security, establishing IA goals, providing training for security awareness, and conducting airtight incident response to system compromise.
Such topics as defense in depth, configuration management, IA legal issues, and the importance of establishing an IT baseline are covered in-depth from an organizational and managerial decision-making perspective. Experience-based theory provided in a logical and comprehensive manner. Management focused coverage includes establishing an IT security posture, implementing organizational awareness and training, and understanding the dynamics of new technologies.
Numerous real-world examples provide a baseline for assessment and comparison. Presents an Cyber-Assurance approach to the Internet of Things IoT This book discusses the cyber-assurance needs of the IoT environment, highlighting key information assurance IA IoT issues and identifying the associated security implications. Through contributions from cyber-assurance, IA, information security and IoT industry practitioners and experts, the text covers fundamental and advanced concepts necessary to grasp current IA issues, challenges, and solutions for the IoT.
The future trends in IoT infrastructures, architectures and applications are also examined. Other topics discussed include the IA protection of IoT systems and information being stored, processed or transmitted from unauthorized access or modification of machinemachine M2M devices, radio-frequency identification RFID networks, wireless sensor networks, smart grids, and supervisory control and data acquisition SCADA systems.
Discusses current research and emerging trends in IA theory, applications, architecture and information security in the IoT based on theoretical aspects and studies of practical applications Aids readers in understanding how to design and build cyber-assurance into the IoT Exposes engineers and designers to new strategies and emerging standards, and promotes active development of cyber-assurance Covers challenging issues as well as potential solutions, encouraging discussion and debate amongst those in the field Cyber-Assurance for the Internet of Things is written for researchers and professionals working in the field of wireless technologies, information security architecture, and security system design.
This book will also serve as a reference for professors and students involved in IA and IoT networking. Tyson T. With most services and products now being offered through digital communications, new challenges have emerged for information security specialists. A Multidisciplinary Introduction to Information Security presents a range of topics on the security, privacy, and safety of information and communication technology. It brings together methods in pure mathematics, computer and telecommunication sciences, and social sciences.
It explains the mathematical reasoning behind public key cryptography and the properties of a cryptographic hash function before presenting the principles and examples of quantum cryptography.
The text also describes the use of cryptographic primitives in the communication process, explains how a public key infrastructure can mitigate the problem of crypto-key distribution, and discusses the security problems of wireless network access. US: Tel 1. Today the vast majority of the world's information resides in, is derived from, and is exchanged among multiple automated systems. Critical decisions are made, and critical action is taken based on information from these systems.
Therefore, the information must be accurate, correct, and timely, and be manipulated, stored, retrieved, and exchanged s. As technological and legal changes have hollowed out the protections that reporters and news organizations have depended upon for decades, information security concerns facing journalists as they report, produce, and disseminate the news have only intensified.
From source prosecutions to physical attacks and online harassment, the last two decades have seen a dramatic increase in the risks faced by journalists at all levels even as the media industry confronts drastic cutbacks in budgets and staff.
As a result, few professional or aspiring journalists have a comprehensive understanding of what is required to keep their sources, stories, colleagues, and reputations safe. This book is an essential guide to protecting news writers, sources, and organizations in the digital era. Susan E. McGregor provides a systematic understanding of the key technical, legal, and conceptual issues that anyone teaching, studying, or practicing journalism should know.
Bringing together expert insights from both leading academics and security professionals who work at and with news organizations from BuzzFeed to the Associated Press, she lays out key principles and approaches for building information security into journalistic practice.
McGregor draws on firsthand experience as a Wall Street Journal staffer, followed by a decade of researching, testing, and developing information security tools and practices. Filled with practical but evergreen advice that can enhance the security and efficacy of everything from daily beat reporting to long-term investigative projects, Information Security Essentials is a vital tool for journalists at all levels. Your expert guide to information security As businesses and consumers become more dependent on complexmultinational information systems, the need to understand anddevise sound information security systems has never been greater.
This title takes a practical approach to information security byfocusing on real-world examples. While not sidestepping the theory,the emphasis is on developing the skills and knowledge thatsecurity and information technology students and professionals needto face their challenges. A solutions manual and a set of classroom-testedPowerPoint r slides will assist instructors in their coursedevelopment.
Students and professors in information technology,computer science, and engineering, and professionals working in thefield will find this reference most useful to solve theirinformation security issues. An Instructor's Manual presenting detailed solutions to all theproblems in the book is available from the Wiley editorialdepartment.
Engineering Information Security covers all aspects of information security using a systematic engineering approach and focuses on the viewpoint of how to control access to information. Includes a discussion about protecting storage of private keys, SCADA, Cloud, Sensor, and Ad Hoc networks Covers internal operations security processes of monitors, review exceptions, and plan remediation Over 15 new sections Instructor resources such as lecture slides, assignments, quizzes, and a set of questions organized as a final exam If you are an instructor and adopted this book for your course, please email [email protected] to get access to the additional instructor materials for this book.
High-level overview of the information security field. Covers key concepts like confidentiality, integrity, and availability, then dives into practical applications of these ideas in the areas of operational, physical, network, application, and operating system security. In this high-level survey of the information security field, best-selling author Jason Andress covers the basics of a wide variety of topics, from authentication and authorization to maintaining confidentiality and performing penetration testing.
Using real-world security breaches as examples, Foundations of Information Security explores common applications of these concepts, such as operations security, network design, hardening and patching operating systems, securing mobile devices, as well as tools for assessing the security of hosts and applications.
Skip to content. Security Templates Security templates are files that contain a set of security configurations. Using templates is an easy way to standardize security across a platform or domain. Templates can be applied to Windows computers either by being imported into a GPO or by being directly applied to the local computer policy. Templates cannot be applied to a system or group of systems using the Security Templates MMC, which only allows administrators to create, view, and edit security templates.
When configuring system services with security templates, you must configure the Access Control List ACL for each service. Now we have to save our changes to the template. Click Properties and then click on the Group Policy Tab. Now right click on the Security Settings container and click Import Policy. Gartner has been criticized for this, because IIS is so widely implemented and because IIS can, in fact, be rather secure—if the administrator is vigilant and well informed.
Microsoft has provided truckloads of whitepapers, checklists, and tools for securing IIS. However, the key is to begin with Windows Server, because the underlying operating system must be hardened in conjunction with the specific requirements of the service in this case IIS.
Ensure that only the minimum essential privileges are granted, especially in the case of IIS systems accessible from the Internet. Additionally, consider applying the Hisecweb. When executed, IISlockd. It starts by checking to see if IIS in installed on the system and whether or not the Lockdown Wizard has been previously run.
Then it presents the following series of dialog boxes to help you set up the appropriate configuration for your environment. Select the Internet service s. Disable Script maps. Disable weak default features. Install URLScan. Apply the configuration. For a public Web server, you will likely enable the default anonymous user authentication method. This means that every time someone on the Internet connects to the service, they are authenticating anonymously with IIS but are actually using a built-in Windows user account.
Unlike a public Web server, an administrator can require tighter authentication and access controls for an internal Intranet server, where he or she knows who should have access to the service.
In this case, only source addresses from the RFC private address space Although this contributes to the defense in depth goal, it might be done more effectively by a host-based firewall. In the case of the later, it can be configured to authenticate user digital certificates, thereby increasing the reliability of the authentication considerably. We still find it to be the best free Windows personal firewall out there—mainly because of the granularity it provides regarding rules and features like syslog capability, hashing of registered applications, and its intuitive interface.
You have the ability to customize this rule by service ports and IP addresses. In this example we are allowing TCP traffic destined for our Web server port 80 application from any Internet host. You can then create new rules that specifically deny this bad traffic to gain access to your public Web server.
The built-in convenience of being able to have TPF send all of its logs to a centralized syslog server is a very nice feature, and highly recommended from a security standpoint. A port scanner for example, nmap14 can only provide information about what ports are open and listening. Port scanners cannot even reliably determine what service is running on a particular port. For example, a Web server can be configured to run on port 22 which is normally reserved for SSH.
A port scanner will only report that port 22 was found to be open, leading the casual scanner to believe that the SSH service is available on the target system. Vulnerability scanners like Nessus,15 on the other hand, take information provided from a port scan and perform various checks to determine what service is running. Therefore, using our previous example, a vulnerability scanner can tell you not only that a Web server is running on port 22 but it will also reveal that the server is Apache 1.
This information will be invaluable in hardening your host system. Nessus Architecture Nessus is actually comprised of two major components; a server nessusd which is responsible for performing the scan, and a client nessus that can parameterize scans and view reports.
All client sessions are authenticated using an SSL-like method. Once the scan has finished, results will also be viewed through the client interface. Installing and Running Nessus Nessus installation is an extremely simple process. With the release of Nessus 2. To install Nessus: 1. Download nessus-installer.
Figure 4: Adding a User in Nessus 1. Enter a user name. This will tell Nessus to use a password as opposed to a certificate. Enter a password. Leave the rules section blank. Update the Nessus plug-ins to get the latest vulnerability tests. Enter the information that it asks for.
This certificate will be presented to all Nessus clients that connect to this server. Press enter to accept the certificate. Before starting a scan, all users must log into the Nessus client. Configure the following scan parameters: Plug-ins From this tab, users can select which vulnerability tests will be run on the target host.
Since we will be scanning a Linux machine as our target, we should disable all Plugins that are not Linux specific. Prefs Allows you to supply extra information to some of the security checks.
Also, you can configure NIDS evasion techniques. Scan Options Provides the ability to change certain scan options. You can choose the port scanner to use, how many hosts should be scanned simultaneously and the number of plug-ins to run at the same time.
Target Selection Specifies the host to be scanned. You can enter a new host, a new network, or you can restore a previously saved session. User Allows the user to enter rules that further restrict the scanning ability.
For example, if you are scanning a network and there are a small number of hosts you would prefer to ignore, you can enter those hosts in this tab as opposed to dissecting the network into blocks that exclude those hosts.
KB Using the knowledge base allows for users to perform differential scans. Using the KB tab allows the user to test only unseen hosts increases speed , or to only report when the security posture of a machine has changed from a previous scan. Click on Start the Scan to begin. Review the results of the scan. One of the most common tasks a system administrator performs is to remove components that correspond to unnecessary operating system features and applications.
Many of these features are installed by default and will never be noticed until a security vulnerability is discovered. By removing these extraneous features immediately, we can reduce our future exposure to security risks. In this example, we will be introducing two of the most powerful features of the RPM system; namely uninstalling packages and querying the rpm database.
By default, Red Hat Linux 8. We have two options at this point. One option would be to ignore this dependency using the --nodeps switch. However, that is probably not a good idea because the dependent package cannot be trusted to function properly. Our other option is to remove the dependent package. Fortunately, in this case, we were going to remove it anyway.
Even though Microsoft dominates the news concerning patches and security holes, Linux is not without its deficiencies in certain areas. Up2date will contact the Red Hat Network and retrieve the latest updates for your operating system. Figure 9: Linux Taskbar with up2date Notification When you first boot into Linux after a fresh install, the task bar at the bottom of the screen will resemble the one shown in Figure 9 above.
The interesting part of the taskbar is the small red circle with the white exclamation point. This icon indicates that your system may need to download critical updates. Double click the up2date notification icon.
You will be presented with a dialog box similar to that in Figure A fresh Linux install can require a great many updates as many as , whereas current systems will only need the latest patches. This can be very helpful in a number of situations.
For example, if you have customized the configuration of certain packages as in a production environment then you would want to test all changes before updating any package. You will be presented with the Red Hat Update Agent.
The channels screen presents the Red Hat channels available to your system. Choose your favorite channel and proceed. The one package that typically appears in this screen is the kernel package. If you wish to update the kernel, then it is recommended that you perform an update for that specific purpose after the other packages are updated.
Proceed to the next screen. On the available packages screen, choose the packages that you want installed, and proceed. What you might not realize is that, like Windows, many of these services are unnecessary and can be safely stopped or removed. How do you find out what is running and how do you stop a service? Linux makes this whole process very straightforward. Run Levels First, before we can disable a service, we need a little background on run levels.
Run levels represent all of the modes in which a Linux system can boot. The first item of note is that the init. Run level 0 corresponds to rc0. These rc[]. The contents of the rc5. In this example, S10network will start before S56inetd network services.
Now that we know how the system starts its services, we can check to see which ones are running by using the chkconfig command. Now, since this machine is not a mail server, there is no reason for us to be running sendmail. First you must terminate the currently running service, and then you must prevent it from starting in the future.
Stop the service. Prevent the service from starting in the future. Remove the service. Alter the run level properties of the service. Instead of removing the service entirely, you can simply turn off the service in specific run levels. In particular, the scripts can disable unnecessary services, secure default configurations, configure logging, and set up a firewall based upon specific system needs.
How Bastille-Linux Works Bastille-Linux works by systematically working through a comprehensive list of potential security vulnerabilities. At each step, Bastille asks the user to customize the security settings for a particular facet of the operating system.
It will also disable the use of the notoriously vulnerable r-tools rlogin, rsh, etc. Typically, malicious attackers will upload source code to a victim machine after gaining illicit access.
Disallowing access to a compiler can delay or possibly stop further damage from occurring. Console access which typically includes special system-level access rights can be restricted to certain users. Configuring PAM also allows you to set limits on the number of processes users can own.
Limiting processes is useful because it will prevent a single user from executing a denial of service attack by forking enough processes to starve legitimate programs. Daemons disables system daemons which are often unneeded given the configuration of the system and the information provided to Bastille thus far. This setting is only available if the firewall is configured as well.
Depending on the configuration of the host system, several other categories may also appear. Once all of the questions have been answered, Bastille performs a validity check on your answers and then customizes its scripts to apply the changes it can do automatically. This list includes reboots as changes may require. Running Bastille-Linux Bastille-Linux supports two methods of configuration: interactive and non-interactive.
First time users must use interactive mode to create a configuration profile. It is for this reason that we suggest use of this mode. Bastille itself can be run with the simple steps shown below: 1. Consult the Bastille-Linux Web site18 to download and install the appropriate modules.
Answer the questions Bastille poses. Save your configuration file. Apply the changes. One such capability that has been available since the 2. At its core, the IPtables system behaves as a stateful packet filter. For more on stateful packet filtering, see section 2. Based on the specific role of the system e. Figure 16 represents the portion of the IPtables packet filter that is relevant for host based firewalls.
In keeping with best practices, we will have our firewall set up to deny all traffic not explicitly allowed, and so the default policy for our chains will be DROP. As you might have noticed, we will not make use of the FORWARD chain because our machine is a workstation and will not be performing routing tasks.
These two chains will allow us to explicitly define what traffic is allowed into and out of a particular system. On the opening Webmin screen, select the Networking icon at the top of the screen, and then click on the Linux Firewall icon. You should be presented with a screen that looks much like the one shown in Figure At this point, we have no rules configured for any of the chains. Initially our host machine generates the nmap run shown in Figure Here, we will allow the packet if it is destined for This task is accomplished by intermittently querying each user-configured service and reporting the results back to a central correlation engine.
Once the low-level setup has been accomplished, system and network status can be viewed through the use of a Web interface hosted on the Nagios machine itself see Figure However, one of its many features is the capability to do remote service availability monitoring. PureSecure is quite easy to configure for initial monitoring of networked services, with all configuration done from within its clean GUI.
In order to actually perform the checks for services, hosts, etc. Also, an organization running a proprietary network service or protocol can develop its own plug- in and incorporate that into the Nagios system. Thus, there is no need to completely overhaul a Nagios installation when a new type of service or host is incorporated into the network. Review Questions 1. Name and describe 3 host system hardening concepts. How can Group Policy help secure a Windows domain?
What directory should be inspected to see which services are loaded on a Red Hat Linux system? What practice should be followed when administering rules on a host-based firewall? Name and describe three host system hardening concepts. In computer literature, the popular press, and vendor marketing materials, the term is used in many ways. Some people use it to identify a specific hardware component or software package, while others consider the entire collection of systems and software deployed as a control mechanism between two networks to be parts of a firewall.
A firewall is a combination of hardware and software used to implement a security policy governing the network traffic between two or more networks, some of which may be under your administrative control e.
A network firewall commonly serves as a primary line of defense against external threats to your organization's computer systems, networks, and critical information. These systems can be appliances, built specifically for filtering the network traffic that passes through it.
They can be routers configured to accept certain types of packets and to discard others. They can be software components designed to control access to a specific host. They can be a combination of any of the examples or any other type of system which controls access and filters unwanted network traffic.
These devices are built to implement security policy by specifically allowing or denying traffic between the networks they separate. They are designed to let in good packets and keep out bad packets. Firewalls are very good at what they do, which is to make filtering decisions based on their rules. Since these systems are designed to protect networks but are only able to make decisions based on the intelligence provided to them, the effectiveness of the firewall and the overall security of the network depend on the administration of the firewall itself, and on making, testing, and revising the rulesets the firewall uses.
These more intelligent filters may use a variety of filtering rules across a number of criteria. They may also use connection state stateful packet filters , packet payload application layer filters , or other heuristic information as the filtering criteria. When it comes to packet filtering, if you can imagine it, you can likely do it! Implementing packet filters, access control rules, and access control devices will allow administrators to gain control over their network, their systems, and their services.
These tools will take many forms. Some of the technologies focus on the network layer, managing and controlling access at a choke-point on the network. Some of the technologies manage and control access on a specific host. Despite these differences, keep in mind that all the tactics, techniques, technologies, and procedures discussed in this module share that same goal: restricting the bad traffic while allowing good traffic to pass.
The perimeter can be defined as what separates the external network usually the Internet from the internal network or what separates internal sub-networks with differing access requirements.
Ultimately, a firewall implements policy that specifies how network traffic is allowed to move between two or more networks. A firewall intercepts and controls traffic between networks with differing levels of trust—different security domains. A firewall is an excellent place to focus security decisions and to enforce a network security policy.
As a result, it serves as a logical point for monitoring for policy compliance, examining network traffic flow and performance, detecting signs of suspicious or unexpected behavior, capturing detailed log information for later analysis, and implementing alerts for high-priority action. It does so by blocking or denying both incoming and outgoing traffic that is not permitted by policy.
Firewall rules and configuration need to be reviewed on a regular basis as attack patterns change frequently and new vulnerabilities are discovered almost daily. The table is used to monitor the state or context of a communication session by attempting to match up outgoing and incoming packets.
The information retained in the table usually includes the source and destination addresses and source and destination ports. Stateful packet filtering does not simply rely on flag settings. If all this data is correct, the stateful packet filter allows the packet to pass. Additionally, if no reply is received for a period of time anywhere from one minute to one hour, depending on the configuration , the firewall assumes that the remote server is no longer responding and again deletes the connection table entry.
This keeps the table current, but can be an issue under certain circumstances. This larger, more complex enterprise calls for connectivity to vastly more individuals and networks than was required just a few years ago.
The need to allow external connections into the enterprise creates some potentially compromising positions for the IT administrator. How can appropriate access be granted while limiting inappropriate access? How can specific systems and services be made available but be closely controlled and managed? How can malicious and sometimes non-malicious traffic be kept away from sensitive systems? Now more than ever, the answer lies in the development and deployment of packet filtering and network access controls.
Many organizations have implemented hierarchical networks, allowing varied access to the systems in the enterprise based on where the user and system reside in the hierarchy. This requires very tight access controls. If public services are available through this Internet connection, it is very common for the organization to set up a demilitarized zone, or DMZ, to manage access to the service network where the publicly available services reside and to control access to the protected network where the users and the remainder of the enterprise reside.
The DMZ firewall will have three network interfaces, and will apply separate rules on all three interfaces depending on the source, destination, and type of packet it receives. They often do so based on characteristics of the packet itself.
There are a variety of choices, depending on our operating systems and our desired outcome of the implementation. Table 1 shows the tables included in the IPTables firewall, as well as their associated chains and functions.
Creating and administering user chains is a very effective way to manage very large rule sets on a firewall, as only packets which meet certain requirements will be passed on to these user defined chains.
IPTables is made up of a series of tables containing chains, which in turn contain rules which specify targets. A target is what happens to a packet when a rule is met dropped, accepted, logged, sent to another chain, etc. We want to create a rule which will allow Webmin access from one specific host to our firewall.
This host, Webmin operates on TCP port Therefore, we want to go to our Webmin client and create the rules which will allow only this host to connect on TCP port see Figure The second rule will allow packets with a source TCP port of back to This will cause any packet which does not meet our ruleset to be dropped.
The result of attempting to ping the Webmin firewall host ping A DMZ is your front line when protecting valuables from direct exposure to an untrusted environment. Even if you have hardened your operating system and have a firewall, there is still the possibility that the software on those systems might contain a bug that an attacker could exploit.
New bugs are found all the time in software. When you consider all the IIS bugs, sendmail bugs, and DoS attacks, you realize that it may only be a matter of time until your initial perimeter is violated.
Then the attacker has access to whatever vital information you have on those systems, such as your protected files and databases. A DMZ hides your important information an extra step away from an attacker.
Determine what services will be in the DMZ. Will the DMZ contain Web servers? Mail servers? At this point, it is important to consider whether the services will be offered on standard service ports or on non-standard ports. Who needs access to these services? Will all of the services be publicly available?
Will they be available only to a select set of users from the Internet? Will they be available only from the internal corporate network? How will the DMZ and protected network be protected? What technologies will be deployed to segregate the DMZ from the Internet?
What technologies will be deployed to protect the internal network? Create rulesets for the packet filter s. Once the administrator knows what services will be offered from the DMZ to the Internet and the internal network, it is time to build the ruleset s for the firewall s.
As such, organizations need to stay abreast of the latest protective measures and services to prevent cyber attacks. The Handbook of Research on Information Security and Assurance includes 47 chapters offering comprehensive definitions and explanations on topics such as firewalls, information warfare, encryption standards, and social and ethical concerns in enterprise security. Edited by over 90 scholars in information science, this reference provides tools to combat the growing risk associated with technology.
The coverage of this handbook of research on information assurance and security provides a reference resource for both information science and technology researchers and also decision makers in obtaining a greater understanding of the concepts, issues, problems, trends, challenges and opportunities related to this field of study.
Each article includes full references, making this a good source of research topics as well as a handbook.
0コメント