Download Document

A 24x7x365
Secure Government
Internet Portal
by Gavin Longmuir
[email protected]
1
5 November 2001
What are the objectives of
Information Security



Availability
Confidentiality
Integrity
[email protected]
2
5 November 2001
A Secure AND Available
Portal?
A secure highly available Government
Internet portal needs to not only ensure
availably of the resources but to ensure
the integrity of the resources and prevent
opportunities for malicious misuse of the
resource.
[email protected]
3
5 November 2001
Guidelines that must be
followed


National Office for the Information
Economy (NOIE) – Online Security
Requirements for Commonwealth
Agencies
Commonwealth Privacy Act (Public
Sector) 1998
[email protected]
4
5 November 2001
Guidelines …

Protective Security Manual (PSM)



Part C: Information Security
Part E: Physical Security
Defence Signals Directorate (DSD)’s ACSI 33







HB
HB
HB
HB
HB
HB
HB
2: Evaluated Products
3: Risk Management
4: Security Management
8: Network Security
10: Web Security
13: Intrusion Detection and Audit Analysis
14: Physical Security
[email protected]
5
5 November 2001
Guidelines …


DSD’s Gateway Certification Guide
DSD/NOIE Commonwealth Agency Online
Security Checklist
[email protected]
6
5 November 2001
Industry guidelines

ISO 17799:2001 - Code of practice for
Information Security Management


Formally AS/NZS 4444.1 or BS 7799.1
AS/NZS 4360:1999 – Risk Management
[email protected]
7
5 November 2001
Building a Secure High
Availability Environment








Physical Security – Computer Rooms
Firewalls
Intrusion and Misuse Detection
Security Awareness and Training
Building It Secure – Evaluated Products
Availability
Denial of Service Attacks
Incident Handling
[email protected]
8
5 November 2001
Physical Security – Computer
Rooms





Standards developed by DSD and ASIO T4
Group
Access Control/All Physical access secured
(including ducts and wall/roof tiles)
Alarm Systems (Certification to be undertaken
by ASIO T4 Group)
Secure Containers/Racks
Extensive UPS Systems (including testing)
[email protected]
9
5 November 2001
Firewalls

Implemented as security enforcing points of the
network




Filtering device




Application
Filtering
Stateful Inspection
IP Header Restriction (eg. Source IP address)
Application Restriction (eg. Only FTP get/recv)
Content
To have verbose logging and reporting
apparatus
[email protected]
10
5 November 2001
Intrusion and Misuse
Detection

Intrusion Detection Systems (IDS)






Network (Promiscuous) Tap - NIDS
Host based with additional system activity as inputs – HIDS
Based on expert ‘pattern’ matching – not 100%
Placement is vital – event could occur in non-monitored
environment
Monitoring and correlation with other logs
(routers/firewalls) can give essential foresight
Logs provide legal forensic evidence for any possible
prosecution
[email protected]
11
5 November 2001
SSL and Intrusion Detection




Encryption protocols are blind spots for any
NIDS – they are tunnels
Use of HIDS could be used at the end points
Typical encryption technologies are SSL, IPSec,
and VPNs
Other protocols such as SNA may not be
understood by the IDS
[email protected]
12
5 November 2001
Vulnerability Monitoring



Vulnerability testing of the security
enforcing functions of the environment
must be done to ensure correct
configuration
Automatic scanning and manual invoking
after every major configuration change
Host based integrity checking is also to
be undertaken
[email protected]
13
5 November 2001
Security Awareness and
Training


Staff must understand their
responsibilities for security and why it is
enforced
Operations staff are to have a full
understanding of the security enforcing
functions of the environment along with
the functionality of the enforcing devices
[email protected]
14
5 November 2001
Building It Secure – Evaluated
Products





Building a secure environment requires the use of a
evaluated or trusted system
Evaluated systems have been evaluated against a number
of criteria to test the functionality of the system
Criteria describe strength of the security system, the
security features provided, confidence in systems design,
and confidence in system implementation
DSD’s Evaluated Product List (EPL)
The use of Evaluated Firewalls is mandated
[email protected]
15
5 November 2001
Avoiding Single Points of
Failure




Multiple geographic separate sites
Multiple broadband carriers
Traffic load-balancing or management tools
Clustering – horizontal (parallel) scaling




Increases availability
Increases bandwidth
Decreases integrity? – content replication
Failover/High-Availability of ALL networking
devices
[email protected]
16
5 November 2001
Calculating Availability




Replication of any component within the
environment increases availability
Most manufactures provide availability
information with devices such as mean time to
failure
Serial Availability – the product of component
reliability for all devices between two locations
in a network
Parallel Availability – the inverse of the product
of component unreliability for all mirrored
devices in a network
[email protected]
17
5 November 2001
Load-Balancing Firewalls


Firewall’s are traditionally seen as traffic bottlenecks
Newer Firewalls now come with load-balancing features




Software implementations pass state information between
‘nodes’ – but don’t scale
Hardware implementations pass state but not information
like CPU load or memory utilisation
Highly Protected information must be protected by
multiple serially implemented Firewalls (of different
manufacture)
Placement of smart load-balancing traffic management
devices ‘in-front’ of these serial-paired Firewalls
[email protected]
18
5 November 2001
Denial of Service Attacks




Use modern and patched networking devices





Data Flood Attacks
Infrastructure Attacks
Distributed Denial of Service Attacks
Logical access filtering
SYN flood throttling
Connection rate throttling
Data rate throttling
Still need multiple sites and defence in depth –
greatest defence is redundancy
[email protected]
19
5 November 2001
Incident Handling





Part of the Business Continuity Plan
Identification and Analysis of the event
Reporting Procedures and resultant actions
documented in detail
Confirmation of system(s) and data/information
integrity
Collection and integrity of audit logs and other
evidence used for forensics
[email protected]
20
5 November 2001
Ensuring Integrity of the
Resource


How to tell a Fake?
Quality Management
[email protected]
21
5 November 2001
How to tell a Fake?

An intruder (possibility only says) accesses
restricted components of the environment






Has the data/information been tampered with?
Has malicious code been placed?
Have to prove it – otherwise treat as it has
Malicious network traffic redirection
Digital signatures – verification of content
SSL certificates – verification of destination
[email protected]
22
5 November 2001
Quality Management

Mandated change control, peer review and
testing procedures


Information/data protection from newly
developed rogue application functionality


Including reassessment of threats and risk
Development and testing to occur in non-production
environment
Backups of non-replicated/non-redundant data
[email protected]
23
5 November 2001
Threat and Risk Assessment
DSD’s Risk Assessment Methodology
Based on AS/NZS 4360:1999
[email protected]
24
5 November 2001
Risk Assessment Methodology









Asset Identification
(Estimated) Threat to Asset
(Estimated) Threat Likelihood
(Estimated) Harm, if Realised
(Resultant) Risk Assessment
(Estimated) Required Risk
(Resultant) Counter-measure Priority Rating
Counter-measures (Policy, Procedures, Design)
Identification (and Acceptance) of Residual Risk
[email protected]
25
5 November 2001
Example TRA Entry


Asset – Loss or Corruption of
Government data/information Resources
and supporting systems
Threat to the Asset – Unavailable or
bogus service from IP service hijacking or
infiltration
[email protected]
26
5 November 2001
Example TRA …





Threat Likelihood – High
Harm, if Threat is Realised – Serious
Resultant Risk – Critical (4)
Required Risk – Nil (0)
Counter-measure Priority Rating - 4
[email protected]
27
5 November 2001
Example TRA …

Counter-measures





Deployment of NIDS and HIDS
Controlled and ‘hardened’ system OS
Ensure that security enforcing devices deny all this is not
specifically allowed
TCP/IP Ingress and Egress filtering
Residual Risk



New attack mechanism which is not picked up by IDS
In-band attack via permitted communication paths enforced
by Security enforcing mechanisms
Standard Operating Procedures are not followed – patches
not applied
[email protected]
28
5 November 2001
To recap

The shown outlined infrastructure is for
supporting Government customers for secure
and highly availably application hosting. Topics
covered included:





Portal Integrity
Portal Availability
Guidelines and Monitory requirements
Analysis of Threats and Risks
And proposed counter-measures
[email protected]
29
5 November 2001
Recommendation


A suitable architecture can be shaped that can
not only provide the capacity and scalability
required but also the security needed for
mission critical systems
Creation of a project team to finalise design,
select products and create/document
procedures is required as the next step in this
project
[email protected]
30
5 November 2001