The Security Wheel
The implementation of a security policy typically involves four steps:
Step 1 Develop the security policy.
Step 2 Implement the security products called for by the security policy.
Step 3 Inspect the policy periodically.
Step 4 Handle incidents as they occur.
This process does not provide for the continual adaptation of the security policy to changes in the network environment. The Security Wheel concept treats network security as a continuous process that is built around the corporate security policy. This process is divided into four stages:
1. Securing the network.
2. Monitoring the network.
3. Testing the security of the network.
4. Improving the security of the network.
During the first phase of the Security Wheel, security solutions are implemented. This process involves deploying firewalls, VPN devices, intrusion detection systems (IDSs), and authentication systems and patching any systems that require a patch. These systems are deployed to stop or prevent unauthorized access or activities.
The second phase in the Security Wheel involves monitoring the network to detect violations of the security policy. Monitoring includes system auditing and real-time intrusion detection. This step is designed to validate the security implementation that is conducted in the first stage.
The testing phase of the Security Wheel involves validating the effectiveness of the security policy implementation. Validation is done through system auditing and vulnerability scanning.
In the fourth phase of the Security Wheel, the information gathered during the monitoring and testing phases is used to improve the security implementation of the network. At this phase, adjustments can be made to the security policy as vulnerabilities (both new and old) and risks are identified.
The fourth phase feeds back into the first and the process begins anew. Figure 5-1 illustrates the Security Wheel concept.
Figure 5-1 The Security Wheel
Corporate Security
Policy Implementation
Monitor and Respond
Test Manage
and Improve
Foundation Summary 81
Foundation Summary
The “Foundation Summary” section of each chapter lists the most important facts from the chapter.
Although this section does not list every fact from the chapter that will be on your CSI exam, a well-prepared CSI candidate should at a minimum know all the details in each “Foundation Summary”
section before taking the exam.
There are two primary reasons for the increasing threat to networks:
■ The ubiquity of the Internet
■ The pervasiveness of easy-to-use operating systems and development environments A security policy defines the framework that is used to protect the assets that are connected to a network. The main goal of a security policy is to ensure that system users, staff, and managers are informed of their responsibilities for protecting corporate technology and information assets.
The two general types of network security policies are
■ Permissive policies
■ Restrictive policies
To be effective, a security policy must
■ Be enforceable and apply to everyone
■ Be capable of being implemented through system administration procedures and through the publication of acceptable-use guidelines or other appropriate methods
■ Clearly define the areas of responsibility and the roles of users, administrators, and management The key trade-offs to consider when establishing the security goals of a security policy include the following:
■ The risks of offering some services versus the overall level of security provided
■ The ease of use of the network versus the desired security level
■ The cost of implementing the desired security versus the potential cost of losing confidential information, privacy, or service
The two basic elements that are determined during a security risk assessment are the following:
■ Which assets need to be protected. The basic aim for each asset is to ensure the CIA of the asset.
■ What the threats are to those assets.
Threats can be further defined through three elements:
■ The consequences of the threat if nothing is done
■ How often the threat may occur
■ The measure of the likelihood that the threat will occur
Risk assessment is a method that enables an organization to quantify the level of risk that is inherent in a system. The first step in risk assessment is to identify assets such as hardware, software, and intellectual property. The second step is to identify the threats to the assets. These threats include unauthorized access to resources and information, unintentional or unauthorized disclosure of information, and DoS.
A successful security policy can be subdivided into smaller policies, each covering a specific topic related to the overall security of the network. Some of these “subpolicies” include the following:
■ Acceptable-use policy
■ Authentication policy
■ Accountability policy
■ Access policy
■ Privacy policy
■ Violations-reporting policy
In the Security Wheel concept, network security is treated as a continuous process that is built around the corporate security policy. This process is divided into four phases:
1. Securing the network.
2. Monitoring the network.
3. Testing the security of the network.
4. Improving the security of the network.
References 83
Q&A
As mentioned in the introduction, “All About the Cisco Certified Security Professional Certification,”
you have two choices for review questions. The questions that follow next give you a bigger challenge than the exam itself by using an open-ended question format. By reviewing now with this more difficult question format, you can better exercise your memory and prove your conceptual and factual knowledge of this chapter. Appendix A provides the answers to these questions so that you can verify the topic areas in which you are proficient and those topic areas for which you need to study further.
For more practice with exam-like question formats, including questions using a router simulator and multiple choice questions, use the exam engine on the CD-ROM.
1. What are the three elements of a good security policy?
2. What are some of the more common threats described in RFC 2196?
3. What are the key trade-offs that define the corporate security goals?
4. Within the field of network security, what does CIA stand for?
5. What are some of the physical assets of a network?
6. What is a privacy policy?
7. What is an acceptable-use policy?
8. Describe the four phases of the security wheel.
References
Fraser, B. “Site Security Handbook – RFC 2196.” http://www.ietf.org/rfc/rfc2196.txt;
September 1997.
Malik, S. Network Security Principles and Practices. Indianapolis, Indiana: Cisco Press; 2003.
Pfleeger, C. Security in Computing, 2d ed. Englewood Cliffs, New Jersey: Prentice Hall; 1996.
The SANS Institute. “The SANS Security Policy Project.” http://www.sans.org/resources/
policies; 2002.