CSC 386 – Computer Security Scott Heggen. Agenda Security Management.
-
Upload
winifred-byrd -
Category
Documents
-
view
214 -
download
0
Transcript of CSC 386 – Computer Security Scott Heggen. Agenda Security Management.
CSC 386 – Computer Security
Scott Heggen
Agenda
• Security Management
Security Management
• What goes in a security policy?
• Examples: http://www.sans.org/security-resources/policies
Security Management• Scenario 1:
– Company XYZ is a new company devoted to developing a social networking platform
– The company will house their own servers which will provide its users with content
– The company will have an in-house IT team to manage their networks, but connect their servers to the Internet through the local ISP
– There will be three main teams working in the company: Administrators (CEOs, HR, Financial, etc.), Developers (software engineers, electrical engineers, graphic designers, etc.), and IT (network engineers, network operations experts, customer service)
– They expect their software to serve at least one million users in the next five years
Measuring Security
• Once a policy is in place, how do you know if it’s working?
• How do you quantify “secure”?
Security Management
• Scenario 2:– You are a contractor for the U.S. government who
develops missile control modules– You have regular communications with 3 other
government contractor companies regarding the integration of your modules with their parts of the system
Risk and Threat Analysis
Risk and Threat Analysis
• Identify the assets valuable to your company• Identify the threats that exist to each asset• Determine the impact a threat can potentially
have on an asset• Monitor your assets for vulnerabilities• Prepare for attacks
Risk and Threat Analysis
Risk and Threat Analysis
Risk and Threat Analysis
Risk = Assets x Threats x Vulnerabilities
Trivial – Important - Critical
Very unlikely - Likely
Fix when convenient – Fix now!
Risk Analysis
• Scenario 1 revisited:– Company XYZ is a new company devoted to developing a social
networking platform– The company will house their own servers which will provide its users
with content use cloud-based servers to host content– The company will have an in-house IT team to manage their networks,
but connect their servers to the Internet through the local ISP– There will be three main teams working in the company:
Administrators (CEOs, HR, Financial, etc.), Developers (software engineers, electrical engineers, graphic designers, etc.), and IT (network engineers, network operations experts, customer service)
– They expect their software to serve at least one million users in the next five years
Risk Mitigation
• Now have a prioritized list of risks/threats• Can develop countermeasures to mitigate
those risks
• Remember, this is an on-going process; IT is constantly changing!
Next Class
• Due:– Have a good weekend
• Agenda:– Foundations of Computer Security (Chapter 3 of
your text)