The SECURE ONLINE BUSINESS handbook ppt

Miles Templeman, Director General, Institute of Directors Part 1: Information at risk 1.1 The information security management system 3 Alan Calder, IT Governance Ltd 1.2 The business ca

ឣ I

the

SECURE ONLINE

e-commerce, IT functionality & business continuity

consultant editor: jonathan reuvid

This book has been endorsed by the Institute of Directors.

The endorsement is given to selected Kogan Page books which the IoD recognizes as being of specific interest to its members and providing them with up-to-date, informative and practical resources for creating business success Kogan Page books endorsed by the IoD represent the most authoritative guidance available on a wide range of subjects including management, finance, marketing, training and HR.

The views expressed in this book are those of the authors and are not necessarily the same as those of the Institute

of Directors.

Publisher’s note

Every possible effort has been made to ensure that the information contained in this book is accurate at the time of going to press, and the publishers and authors cannot accept responsibility for any errors or omissions, however caused No responsibility for loss or damage occasioned to any person acting, or refraining from action, as a result

of the material in this publication can be accepted by the editor, the publisher or any of the authors.

First published in Great Britain and the United States in 2003 by Kogan Page Limited

Second edition 2004

Third edition 2005

Apart from any fair dealing for the purposes of research or private study, or criticism or review, as permitted under the Copyright, Designs and Patents Act 1988, this publication may only be reproduced, stored or transmitted, in any form or by any means, with the prior permission in writing of the publishers, or in the case of reprographic reproduction in accordance with the terms and licences issued by the CLA Enquiries concerning reproduction outside these terms should be sent to the publishers at the undermentioned addresses:

120 Pentonville Road 22883 Quicksilver Drive

British Library Cataloguing-in-Publication Data

A CIP record for this book is available from the British Library.

Library of Congress Cataloging-in-Publication Data

Reuvid, Jonathan.

The secure online business handbook : e-commerce, IT functionality and business

continuity / Jonathan Reuvid.

p cm.

ISBN 0-7494-4425-8

1 Computer security–Handbooks, manuals, etc 2 Business–Data

processing–Handbooks, manuals, etc I Title.

QA76 9.A25S3755 2005

005.8–dc22

2005011399

Typeset by Saxon Graphics Ltd, Derby

Printed and bound in Great Britain by Cambridge University Press

This page intentionally left blank

III ឣ

This page intentionally left blank

Miles Templeman, Director General, Institute of Directors

Part 1: Information at risk

1.1 The information security management system 3

Alan Calder, IT Governance Ltd

1.2 The business case for IT security 8

Andrew Steggles, EMEA Nokia Enterprise Solutions

1.3 Recent attack trends 12

The Fraud Advisory Panel’s Cybercrime Working Group

1.4 The fine art of elephant husbandry – a practical guide to patch management 18

Chris Knowles, Computacenter

1.5 Gone phishing 23

Frank Coggrave, Websense

1.6 The marketing dimension 26

Michael Harrison, Harrison Smith Associates

Part 2: Points of exposure

2.1 Web security 33

Suheil Shahryar, VeriSign UK

2.2 Broadband 48

Paul Collins, NTL Business

2.3 Don’t indulge in unprotected wireless 54

Ian Kilpatrick, Wick Hill Group

2.4 No phishing: protecting employees from e-mail fraud 57

Ed Rowley, CipherTrust Europe Ltd

This page intentionally left blank

CONTENTS VII ឣ

2.7 Protecting online privacy 71

Alexander Brown, Simmons & Simmons

2.8 Online payments: key areas of exposure 78

Tony Parnell, WorldPay Ltd

2.9 The spy that came in from the cold 82

Frank Coggrave, Websense

Part 3: Software protection

3.1 Firewalls 87

Mark Rogers, More Solutions

Mark Rogers, More Solutions

3.3 Authentication and encryption 95

Randle Cowcher, TrustAssured

3.4 Digital signatures 100

Johan Sys, GlobalSign

3.5 Biometrics 105

Clive Reedman and Bill Perry, Emerging Technology Services

3.6 From ‘Made in Hollywood’ to ‘Appearing in your local car boot sale’ –

piracy and the business of digital entertainment 110

Simon Mehlman, Macrovision

3.7 Keeping on the right side of the law 118

Frank Coggrave, Websense

Part 4: Operational management

4.1 Flow clearing: financial supply chain management 123

Dr Markus Braun, Wire Card

4.2 Developing a culture of security in the workplace 127

Peter Brudenall, Simmons & Simmons

4.3 Security as standard 133

British Standards Institution

4.4 Converged security – why manage three when one will do? 137

Mark Bouldin, Telindus

4.5 Countering cybercrime: risk management 142

The Fraud Advisory Panel’s Cybercrime Working Group

4.6 Countering cybercrime 152

Peter Brudenall, Simmons & Simmons

4.7 Centralized security management 157

Zuhamy Colton, Indicii Salus

4.8 Electronic contracting 163

Peter Brudenall, Simmons & Simmons

4.9 Information security training 169

Alan Calder, IT Governance Ltd

4.10 Outsourced solutions 173

Martin Saunders, Easynet

4.11 Securing the mobile workforce 178

Andy Baines, Fujitsu Services

Part 5: Contingency planning

5.1 Business continuity and crisis management 185

Dr David Smith

5.2 Dealing with the risks of peer-to-peer 196

Frank Coggrave, Websense

5.3 Data recovery 199

Adrian Palmer, Ontrack Data Recovery

5.4 Crisis or disaster management 204

Simon Langdon, Insight Consulting, part of Siemens Communications

5.5 Forensics 210

Robert Brown, DataSec

5.6 Forensic investigation 214

Clifford May, Integralis Ltd

IX ឣ

This page intentionally left blank

This page intentionally left blank

For many organizations their dependence on information systems, both within the companyand networked up and down their supply chain, is now business critical Any sustained loss

of availability of these systems would threaten the very existence of the business

Security is a holistic issue Vulnerabilities in physical, personnel and electronicsecurity all need to be addressed with equal commitment Too many businesses still focus

on physical security without sustaining even basic precautions in personnel and electronicsecurity For example, a recent survey of IoD members highlighted that only 90 per cent ofrespondents with broadband access to the internet used firewalls to protect their systemsand information Similarly only 75 per cent kept those firewalls up to date

Simple, well designed security precautions need not place onerous burdens on the staff

or operation of a business – indeed, if they do they will tend to prove useless because theywill be circumvented and disregarded Winning the hearts and minds of employees at alllevels is an essential first step, complementing the technology solutions that are deployed.This book outlines the basic steps that all businesses, of whatever size, should betaking, both to protect the operation of their information systems and to ensure that theyremain compliant with their increasing legal responsibilities

When we go home from an office or factory at night we would not dream of leaving thedoors and windows open and the safe unlocked Yet all too often, in terms of online security,organizations are doing exactly that This book should leave no business in any doubt aboutthe need for action on this key business issue of our times – and gives clear, practical advice

on the steps they need to implement

Miles Templeman Director General Institute of Directors

XI ឣ

This page intentionally left blank

This page intentionally left blank

XIII ឣ

Contributors’ notes

Andy Baines is a Principal Consultant in the Information Security Practice of Fujitsu

Services specializing in the development of security strategies and architectures He is aregular consultant to government departments and corporate customers

Mark Bouldin has over 15 years’ experience in the IT and electronics fields, much of

which was gained at Thorn Security where he worked across a range of CCTV, intruder,access control and fire system products Mark currently works at Telindus where he isresponsible for networked digital surveillance solutions

Dr Markus Braun brings extensive knowledge of information technology, financial risk

management and payment solutions to his position as Chief Executive Officer, since hejoined Wire Card in 2001 Born in Vienna in 1969, he studied commercial information tech-nologies at the Technical University of Vienna and holds a degree in social and economysciences Prior to 2001, Dr Braun practised in IT research at the University of Vienna, asSenior Consultant at Contrast Management Consulting, Vienna and IT Manager foreStrategy at KPMG Munich

British Standards Institution is a group of complementary businesses, all working to the

same vision of support for business improvement and trade worldwide BSI believes in theuniversal adoption of best management practices, reduction of risk throughout the tradingprocess and the harmonization and acceptance of standards by consent as a means ofachieving economic prosperity

Alexander Brown is a Senior Associate at Simmons & Simmons.

Robert Brown is Technical Director and Forensic Analyst at DataSec.

Peter Brudenall is Technology and Outsourcing Partner at Simmons & Simmons The Business Continuity Institute (BCI) promotes the highest standards of professional

competence and commercial ethics in the provision, maintenance and services for businesscontinuity management (BCM) It provides an internationally recognized certification

This page intentionally left blank

XV ឣ

scheme for BCM managers and practitioners There are now over 1,850 members of theInstitute working in over 45 countries across the world.

Alan Calder is founder and Chief Executive of IT Governance Ltd He has 25 years of

general manager, director and chief executive experience in medium and large tions He led one of the first organizations to achieve BS7799, is a member of the DNVcertification committee and was involved in developing the BCS ISEB certificate forsecurity professionals He writes, lectures and consults on information security He is co-

organiza-author of IT Governance: a Manager’s Guide to Information Security and

BS7799/ISO17799 (published by Kogan Page)

CipherTrust Europe Ltd is a leading provider of internet intrusion prevention and

network security solutions for companies and their employees

Frank Coggrave is UK Regional Director of Websense.

Paul Collins is Head of Customer Marketing at NTL Business.

Zuhamy Colton is a former Marketing Manager at Indicii Salus.

Computacenter is Europe’s leading independent provider of IT infrastructure services To

help its customers maximize the value of IT to their businesses, Computacenter offersservices at every stage of infrastructure investment Corporate and government clients areserved by a network of branch offices across the UK, Germany, France, Austria, Belgiumand Luxembourg and, through its international partners, at locations throughout the world

Randle Cowcher is Senior Business Development Manager at RBS TrustAssured,

respon-sible for the assessment and implementation of leading-edge enterprise security solutions

Peter Crowcombe is a Practice Leader at NetScreen Technologies, specializing in the

analysis of network vulnerabilities and their protection

DataSec are one of the UK’s leading providers of computer forensic services and as such

are registered with the Law Society as expert witnesses The DataSec range of servicesincludes awareness training for IT and HR managers and consultancy services for organiza-tions considering setting up an incident response team or who already have one in place.DataSec also provides independent investigations and analysis for internal incidents,criminal cases and civil litigation and expert witness testimony

Easynet is a leading pan-European business broadband provider and business ISP with

operations in eight European countries Established in 1994, Easynet owns and operatesone of Europe’s most advanced internet network and data centre infrastructures In the UK,Easynet has a national broadband spanning 4,450 km Easynet’s unrivalled product port-folio includes a full suite of scalable broadband access and hosting solutions In addition,Easynet offers a range of bespoke solutions, created exclusively for the education market,delivering internet access in a safe, appropriate and controlled environment All services arecomplemented by quality non-stop technical support

XVII ឣ

This page intentionally left blank

EMEA Nokia Enterprise Solutions focuses on mobile business devices and providing IP

network perimeter security (firewalls and VPN), secure content management (anti-virusscanning and SPAM filtering), and mobile connectivity (remote access VPN and content)solutions designed to help companies to mobilize their workforces and increase produc-tivity while ensuring the security and reliability of their networks

Emerging Technology Services is an independent technology agnostics company Major

recent initiatives include technical lead for the UK Passport Services ePassport Project, UKHome Office Biometric Pilot and many smaller but equally important projects

The Fraud Advisory Panel is a registered charity comprising volunteers drawn from the

public and private sector The Panel’s role is to raise awareness of the immense social andeconomic damage that is caused by fraud and develop effective remedies Members of theFraud Advisory Panel include representatives from the law and accountancy professions,industry associations, financial institutions, government agencies, law enforcement, regu-latory authorities and academia

Fujitsu Services is one of the leading IT services companies in Europe Information

security is one of the areas in which Fujitsu specializes with a full range of consultancyservices and solutions, both stand-alone and managed Typical consultancy services coveraccreditation, architecture, policy development and reviews whilst the Fujitsu service groupfocuses on firewalls, anti-virus and intrusion detection services

GlobalSign is Europe’s leading certificate service provider offering digital certificates and

co-sourced PKI solutions GlobalSign’s digital certificates allow individuals and businesses

to secure e-mail communication, to conduct fully authenticated and confidential onlinebusiness and to set up trusted software distribution GlobalSign certificates are globallyaccepted and are not limited by any application, geographic area or business sector.GlobalSign is one of the few certification authorities in the world that has attained theWebTrust accreditation level

Michael Harrison is Chairman of Harrison Smith Associates Ltd and Chairman, UK, of

the Protecting Critical Information Infrastructures Initiative

Indicii Salus is a London-based security services specialist offering a comprehensive suite

of secure services and solutions based on Xenophon, a unique server-centric securitysolution Xenophon solutions vary from the protection of e-mail to securing a variety ofweb content; its services are delivered via a single user identity, across a wide range ofaccess devices, independent of location

Insight Consulting currently employs over 50 consultants/trainers, and is one of the UK’s

largest specialist teams in information and communications security, risk management andbusiness continuity management In addition to direct support to clients, Insight providesboth public and tailored training courses in risk analysis, business continuity managementand crisis management

XIX ឣ

This page intentionally left blank

Integralis Ltd the corporate solutions division of Articon-Integralis, provides information

security solutions to all industry sectors throughout the world, allowing organizations togrow and achieve their business goals securely These solutions combine services andsystem integration, the deployment of ‘best-of-breed’ security products and managedsecurity services, and employ some of the leading technologists and most skilled engineers

in the industry Integralis is recognized as a leading and trusted provider of InformationSecurity Solutions in the European IT and e-commerce security market

IT Governance Ltd is a niche consultancy business, specializing in IT governance and

information security The different needs of small, medium and large businesses are metwith a range of services that all reflect the company’s commitment to practical, cost-effective, long term solutions The company can deploy vendor-neutral expertise in subjectssuch as compliance (Data Protection, Privacy, Sarbanes-Oxley, Turnbull, etc), standards(BS7799/ISO17799, TickIT, etc), technology (eg anti-malware, defence-in-depth), policy(processes and procedures) and training

Ian Kilpatrick is chairman of Wick Hill Group plc, specialists in secure infrastructure

solutions for e-business Ian has been involved with the group for over 28 years and is themoving force behind its dynamic growth He writes, consults and lectures on informationsecurity Wick Hill is an international organization supplying most of the Times Top 1000companies through a network of accredited resellers

Chris Knowles is Practice Leader, Security, at Computacenter.

Simon Langdon is a recognized authority on crisis management and is a Principal

Consultant at Insight Consulting, part of Siemens Communications – a division of Siemensplc, where he heads up the crisis management service line Simon has been an operationalcrisis manager and has responded to acts of terrorism, chemical fires and train crashes Hehas experience of crisis management in many business sectors including finance, retail,pharmaceutical, aviation, rail, oil and gas, and the media and has worked internationally inEurope and the Middle East Simon chairs the International Disaster and EmergencyResponse group (IDER)

Macrovision UK develops and markets content and software value management solutions

for the video, music and software industries Macrovision’s technologies are embedded inover 9.3 billion DVD, VHS and CD units representing over $130 billion of protected enter-tainment content In the software market Macrovision licenses software developers theFLEXnet™ universal licensing platform and the InstallShield® suite of software instal-lation, repackaging and update solutions, which are deployed on more than 500 milliondesktops worldwide Over 50,000 software publishers and hundreds of Fortune 1000companies use Macrovision’s technologies to maximize the value of their software.Macrovision’s headquarters are in Santa Clara, California and it has offices worldwide.More information about Macrovision can be found at www.macrovision.com

Clifford May has been a Principal Consultant with Integralis since 2001 He is the primary

consultant for information security, including policy development, risk analysis, security

XXI ឣ

This page intentionally left blank

audit, and BS7799 development, and heads the company computer forensic serviceproviding confidential investigation services, incident management and forensic training

Simon Mehlman is the European Marketing Director of Macrovision, the US-based

content protection company He has worked at Macrovision for the last four years and isresponsible for their European strategic and tactical marketing, media communications andevents management Simon has worked in IT marketing management for over 15 years fortechnology-based and publicly listed companies

More Solutions is a company dedicated to designing and deploying software solutions for

industries that use the internet as a communications medium With many applicationsinvolving stand-alone, unattended equipment installed miles from the nearest ITdepartment, security and reliability are essential aspects of their business

NetScreen Technologies Inc is a leading developer of network security and access

solu-tions for enterprises and carriers worldwide NetScreen’s solusolu-tions offer customersmultiple layers of network and application-level protection in purpose-built appliances andsystems that optimize performance and reduce total operating costs NetScreen’s global HQ

is located at Sunnyvale, USA

NTL Business is a leading provider of communications solutions to businesses and public

sector organizations throughout the UK It is the business arm of NTL Incorporated, theUK’s largest cable company and number one broadband internet provider

Ontrack Data Recovery is a wholly-owned subsidiary of Kroll Inc and is a leading

provider of data recovery and electronic evidence services IT enables customers to protect,manage and recover their valuable data Using its hundreds of proprietary tools and tech-niques, Ontrack Data Recovery is able to recover lost or corrupted data from all operatingsystems and types of storage devices through its do-it-yourself remote and in-lab capabil-ities Ontrack’s award-winning utility software tools help prevent critical data loss throughproblem-solving and file-management utilities

Adrian Palmer is a Principal Consultant at Ontrack Data Recovery

Tony Parnell is SME Marketing Director of WorldPay Ltd.

Bill Perry has been involved in biometrics for over 20 years and has fulfilled numerous

roles in the industry ranging from developer, systems integrator, R&D for a major tional bank, end-user and most recently independent consultant He now heads upEmerging Technology Services Ltd

interna-Clive Reedman has been involved in biometrics for over 22 years, as a Fingerprint Expert

with the Metropolitan Police, a project member of the UK’s National AutomatedFingerprint System and as Head of Biometric Capabilities with the Police InformationTechnology Organization He is now a consultant with Emerging Technology Services Ltdand continues to work exclusively in the identification area, including the management of

XXIII ឣ

This page intentionally left blank

the UK Passport Services Facial Recognition Project He has chaired the InternationalAssociation for Biometrics for over two years.

Mark Rogers is a senior developer at More Solutions Ltd.

Ed Rowley is Senior Technical Consultant at CipherTrust Europe Ltd.

Martin Saunders is Head of Products at Easynet

Suheil Shahryar has over 26 years’ experience in IT applications, strategy and security

management He has worked for numerous FTSE100 clients across the world in financial,legal, oil and technology sectors He is the Director of Global Security Consulting forVeriSign in the UK

Simmons & Simmons was ranked joint second in the United Kingdom for outsourcing in a

recent survey of in-house lawyers by The Lawyer magazine In 2002, Global Counsel 3000

ranked Simmons & Simmons in the top 10 worldwide for performance in all major practiceareas, based on the views of in-house counsel at over 5,000 companies across 74 jurisdic-tions In 2003 the firm won a prestigious Queen’s Award for Enterprise in the InternationalTrade category, the only law firm to do so

Dr David Smith is the former Editor of the BCI Good Practice Guidelines

Andrew Steggles is a Marketing Director at EMEA Nokia Enterprise Solutions.

Johan Sys is General Manager of GlobalSign.

Telindus deliver customized voice, video and data networked ICT solutions across the UK,

Europe and Asia Pacific They provide independent consultancy, integration andmanagement services enabling customers to concentrate on their core business Telindus’score technologies focus on productivity and networked digital surveillance

TrustAssured provides the services that enable companies to conduct business cost

effec-tively and securely over the internet With TrustAssured clients can take confidence in theknowledge that a major global bank is providing a service that enables e-commerce tooperate within a secure and trusted environment The key to this is the provision of uniquedigital identity credentials; these eliminate the fear of dealing with unknown counterpartiesover the web

VeriSign UK operates intelligent infrastructure services that enable people and businesses

to find, connect, secure and transact across today’s complex, global networks Every day,Verisign enables over 14 billion internet interactions, 3 billion telephony interactions and

$100 million of e-commerce It also provides services that help over 3,000 enterprises and400,000 websites to operate securely, reliably and efficiently

Websense is the world’s leading provider of employee internet management (EIM)

solu-tions Websense Enterprise software enables organizations to manage how their employees

XXV ឣ

This page intentionally left blank

use their computing resources, including internet access, desktop applications and networkbandwidth Implemented by more than 19,400 organizations worldwide and preferred bythe FTSE100 and Fortune 500 companies, Websense Enterprise delivers a comprehensivesoftware solution that analyses, manages and reports on employee internet access, networksecurity and desktop application usage Websense also helps organizations mitigate theproblems caused by new emerging internet threats, such as spyware, malicious mobile codeand peer-to-peer file sharing.

Wick Hill Group plc, established in 1976, specializes in secure infrastructure solutions.

The company’s portfolio covers security, performance, access, services and management.Wick Hill sources and delivers best-of-breed secure solutions, through its accreditedpartner network, for companies from SME to Times 100, backed up by customer support,implementation, training and technical services

Wire Card AG is not only aiming at internationally oriented companies with its modular

finance platform, Corporate Clearing Center, but also those of a small- or medium-sizedstructure Wire Card offers payment management, worldwide payment solutions, alter-native payment products such as CLICK2PAY, process optimization, financial managementand risk management The platform is based on Java and supports XML as an openstandard It also supports all major application services (Bea or IBM)

WorldPay Ltd is the UK’s largest payment services provider (PSP) and is part of the Royal

Bank of Scotland Group It provides payment services for thousands of clients across theworld, ranging from sole traders to multinational corporations

XXVII ឣ

This page intentionally left blank

This page intentionally left blank

This page intentionally left blank

XXIX ឣ

This page intentionally left blank

Information at risk

1 ឣ

This page intentionally left blank

The information security management

system

Alan Calder, IT Governance Ltd

Information security is now too important to be left to the IT department This is becauseinformation security is now a business-level issue:

ឣ Information is the lifeblood of any business today Anything that is of value inside theorganization will be of value to someone outside it The board is responsible forensuring that critical information, and the technology that houses and processes it, aresecure

ឣ Legislation and regulation is a governance issue In the UK, the Turnbull Report clearlyidentifies the need for boards to control risk to information and information systems.Data protection, privacy, computer misuse and other regulations – different in differentjurisdictions – are a boardroom issue Banks and financial sector organizations aresubject to the requirements of the Bank of International Settlements (BIS) and the Basle

2 framework, which includes information and IT risk

ឣ As the intellectual capital value of ‘information economy’ organizations increases, theircommercial viability and profitability – as well as their share value – increasinglydepend on the security, confidentiality and integrity of their information and infor-mation assets

1.1

3 ឣ

ឣ The scale of, and speed of change in, the ‘information economy’ is every day creatingnew, global threats and vulnerabilities for all networked organizations.

Threats and consequences

The one area in which businesses of all sizes today enjoy a level playing field is in

infor-mation security: all businesses are subject to world-class threats, all of them are potentially

betrayed by world-class software vulnerabilities and all of them are subject to an ingly complex set of (sometimes contradictory) computer- and privacy-related regulationaround the world

increas-While most organizations believe that their information systems are secure, the brutalreality is that they are not Individual hardware-, software- and vendor-driven solutions arenot information security systems Not only is it extremely dangerous for an organization tooperate in today’s world without a systematic, strategic approach to information security,such organizations have become threats to their more responsible brethren

The extent and value of electronic data are continuing to grow exponentially Theexposure of businesses and individuals to its misappropriation (particularly in electronicformat) or destruction is growing equally quickly The growth in computer- and infor-mation-related compliance and regulatory requirements reflects the threats associated withdigital data Directors have clear compliance responsibilities that cannot be met by saying,

‘The Head of IT was supposed to have dealt with that’ or, ‘I’m not really interested incomputer security.’

Ultimately, consumer confidence in dealing across the web depends on how securepeople believe their personal data to be Data security, for this reason, matters to anybusiness with any form of web strategy (and any business without a web strategy is unlikely

to be around in the long term), from simple business to consumer (b2c) or business tobusiness (b2b) propositions through Enterprise Resource Planning (ERP) systems to theuse of extranets and e-mail It matters, too, to any organization that depends on computersfor its day-to-day existence (to produce accounts, for instance) or that may be subject (asare all organizations) to the provisions of the Data Protection Act Even the Freedom ofInformation Act, which ostensibly applies only to public sector organizations, raises confi-dentiality issues for any business that contracts with the public sector

Newspapers and business magazines are full of stories about hackers, viruses andonline fraud These are just the public tip of the data insecurity iceberg Little tends to beheard about businesses that suffer profit fluctuations through computer failure, or busi-nesses that fail to survive a major interruption to their data and operating systems Even less

is heard about organizations whose core operations are compromised by the theft or loss ofkey business data; usually they just disappear quietly

Information security management today

In the vast majority of organizations, information security management is inadequate,unsystematic or, in practical terms, simply non-existent

Small- and medium-sized businesses tend to allocate inadequate resources (manpower,management time and hard cash) to deal with the real issues, while tackling individualthreats and concerns in a haphazard way Investing in isolated solutions to individual

THE INFORMATION SECURITY MANAGEMENT SYSTEM 5 ឣ

concerns leaves so many holes that it’s only slightly more useful than not bothering in thefirst place

Larger organizations tend to operate their security functions in vertically segregatedsilos with little or no coordination This structural weakness means that most organizationshave significant vulnerabilities that can be exploited deliberately or which simply openthem up to disaster For instance, while the corporate lawyers will tackle all the legal issues(non-disclosure agreements, patents, contracts, etc) they will have little involvement withthe data security issues faced on the organizational perimeter

On the organizational perimeter, those dealing with physical security concentratealmost exclusively on physical assets, such as gates and doors, security guards and burglaralarms They have little appreciation of, or impact upon, the ‘cyber’ perimeter

The IT managers, responsible for the cyber perimeter, may be good at ensuring thateveryone has a password, and that there is internet connectivity, that the organization is able

to respond to virus threats, and that key partners, customers and suppliers are able to dealelectronically with the organization, but almost universally they lack the training, expe-rience or exposure to adequately address the strategic threat to the information assets of theorganization as a whole

There are even organizations where the IT managers set and implement security policy

on the basis of their own risk assessment, past experiences and interests, with little regardfor real needs or strategic objectives What else could they do? They are not equipped todeal with the strategic, business issues Of course, users within the business recognize that

these sorts of rule interfere with doing business, so the rules tend to be ignored – leaving the

board with a false sense of assurance about the level of protection they enjoy

The board

Information security is a complex issue It deals with the confidentiality, integrity and ability of valuable data, sitting within business critical systems, and subject to world-classthreats One has to think in terms of the whole enterprise, the entire organization, whichincludes all the possible combinations of physical and cyber assets, all the possible combi-nations of intranets, extranets and Internets, and which might include an extended network

avail-of business partners, vendors, customers and others One has to look at the distribution andsupply channels One has to look at the information needs of the business, and the tech-nology required to support those needs

It’s about the business model It’s about the strategic risks facing the business And thatmeans it’s the board’s responsibility Yes, the board probably will need outside help toaddress the issues and, no, the board doesn’t have to become expert in the technologicalminutiae of how information security is managed But the board does have to face up to itsinformation security responsibility

The board’s responsibility

There are seven areas on which the board needs to focus:

1 The information security policy – which sets out the overall policy for securing theavailability, confidentiality and integrity of the company’s information and whichreflects senior management’s commitment to it

2 Allocation of resources and responsibilities – ensuring that adequately qualified viduals have the resources and clear objectives which, together, will enable the securitypolicy to be implemented This includes making decisions about the extent to whichexternal expertise is required.

indi-3 Risk assessment – identifying the strategic risks, and risk categories, that are likely toaffect the business, and ensuring that, for each of the information assets (hardware,software, data, etc) there is a detailed risk assessment

4 Risk treatment plan – setting the criteria by which risks are to be treated (accept, reject,transfer, or accept but control) and, for those risks that are to be controlled, setting thecriteria and standards that are to guide selection and implementation of the controls.These should, in simple terms, ensure that one doesn’t spend more on controlling therisk than its likely impact

5 Project initiation, monitoring and oversight – ensuring that the development and mentation of an appropriate information security management system proceeds in linewith a clearly thought-through, pragmatic plan

imple-6 Approval, prior to implementation, of proposed controls, irrespective of whether theyare technological or procedural

7 Ongoing, systematic monitoring of the performance of the information securitymanagement system, ensuring that it remains up-to-date, effective and meets the policyobjectives laid down for it

Information security management system

An information security management system (ISMS) is the practical outcome of the type ofapproach recommended above An ISMS is, at heart, a) a set of controls that reduces thoserisks the organization has decided to accept but control to a level consistent with its controlstandard; and b) the framework within which those controls are operated

‘Controls’ are a blend of technological, procedural and behavioural components which,between them, achieve the control objective

For instance, your desktop user systems are threatened by a malicious mix of viruses,worms, Trojans, scumware and spam, whose outcome is to compromise the availability,integrity and confidentiality of the data on the desktop The attack vectors are: e-mail, websurfing and Instant Messaging The controls would include:

ឣ technological – anti-virus and anti-spyware software, anti-spam filters, firewalls andautomatic updating;

ឣ procedural – configuration of the software and firewall, updating procedures, incidentmanagement procedures and acceptable use policies;

ឣ behavioural – user awareness of and training in dealing with these threats and methods

of response, including recognizing when scumware is attempting to download on to aPC

This three-way blend is typical of all effective controls; implementation of two only leaves

a significant exposure that can undo everything that has been put in place The false sense ofsecurity that most organizations derive from only having effected a partial solution can beparticularly destructive

Best practice

In this fast-changing and complex world, it is difficult for any one individual to identify allthe threats that exist and the full range of possible, workable controls that might bedeployed to counter them There is no need to Global best practice in information securityhas been harnessed and expressed in two documents that are fast becoming the cornerstone

of organizational information security: BS 7799 and ISO 17799

BS 7799:2005 is a sector-neutral specification for an ISMS and it contains, in Annex A,

a comprehensive list of controls It is a business-oriented and risk-assessment drivenstandard that, whether or not an organization seeks external certification, is external proof

of the quality of the organization’s information security systems

BS 7799 is supported by, and makes extensive reference to, the international code ofpractice, ISO 17799:2005 Whereas BS 7799 specifies what is required for an ISMS, ISO

17799 sets out, in substantial detail, what best practice considerations might be for each ofthe recommended controls These two standards, available from the British Standards

Institution, can be combined with a detailed, practical handbook (such as IT Governance: A

Manager’s Guide to Information Security and BS 7799/ISO 17799, Calder and Watkins,

Kogan Page, 2005) and a range of commercially available tools (policy generator, riskassessment tool, etc) to ensure that best practice is being systematically deployed inside thebusiness

Conclusion

The board is responsible and accountable for managing information security in thebusiness A strategic, systematic and thorough approach, translated into an informationsecurity management system, is essential With nothing less than the future of the wiredeconomy at risk, every management team has its part to play ISO 17799 describes bestpractice and an ISMS certified to BS 7799 is public proof that the board has been proactive

in identifying and meeting its business and regulatory obligations to secure the availability,confidentiality and integrity of the data on which its business depends

THE INFORMATION SECURITY MANAGEMENT SYSTEM 7 ឣ

The business case for IT

security

Andrew Steggles, EMEA Nokia Enterprise Solutions

For many years security was synonymous with having a solid firewall in place Protecting theperimeter and thereby keeping the bad guys out was the main goal of network architects.However, recent surveys suggest that more than 70 per cent of all security breaches result fromwithin the firewall, that is, from the people you trust – your employees, partners or consultants.New viruses continue to employ blend threat techniques, exploiting multiple weak-nesses and attacking through multiple methods (for example, e-mail, file transfers and webbrowsers) forcing organizations to purchase additional layers of anti-virus and contentsecurity products to deploy across the enterprise Instant messaging has entered thecorporate world and has brought with it another layer of security concerns Instantmessaging applications can provide attack points for hackers seeking to gain entry intocorporate systems by presenting tunnels through firewalls

Hacking toolkits and manuals can be found all over the internet Today, it is possible for

a 10-year-old to break into a multinational bank and steal or alter the most sensitive kinds ofinformation: balance statements, credit card information, access rights and so on

Understanding threats

When organizations first begin to assess network security, the tendency is to focus almostexclusively on external-facing assets to defend against unauthorized attacks However, toestablish an effective security policy, organizations must examine both external facing,publicly accessible resources, and internal facing, private networks Recent findings by the

1.2

FBI and the Computer Security Institute indicate that internal attacks account for themajority of security breaches that organizations experience This finding suggests thatinternal network security needs to be a higher priority for security and network adminis-trators Internal core network security is a requirement for all networks.

The threats to the security infrastructure of any network include packet sniffing, DNSspoofing (or domain name server spoofing: this is where a machine assumes the identity

of a company’s or service provider’s web address to an IP address look-up server), IP(internet provider) address spoofing (where an unscrupulous person forges the address ofthe sending device to make it appear as if it has come from a different machine) and theproliferation of fake routing information Spoofing occurs when an attacker sends networkpackets that falsely appear to be from a trusted host on the network In general terms, thesethreats can be categorized as interception and impersonation

Interception

The first type of attack involves interception of communication between two systems, such as

a client and a server In this scenario, an attacker exists somewhere on the network betweencommunicating entities The attacker observes the information passed between the client andserver The attacker might intercept and keep the information (reconnaissance), or might alterthe information and send it on to the intended recipient (man-in-the-middle attack)

A man-in-the-middle, or bucket brigade, attack is one in which the attacker interceptsmessages in an exchange and then retransmits them, substituting his or her own data for therequested one, such that the two original parties still appear to be communicating with eachother directly The attacker uses a program that, to the client appears to be the server, and tothe server appears to be the client The attack may be used simply to gain access to themessages, or enable the attacker to modify the messages before retransmitting them

Impersonation

The second type of attack is impersonation of a particular host, either a client or a server.Using this strategy, an attacker pretends to be the intended recipient of a message If thestrategy works, the client remains unaware of the deception and continues to communicatewith the impostor as if its traffic had successfully reached the destination

Anticipating threats

Both of these attack techniques allow network information to be intercepted, potentially forhostile reasons The results can be disastrous, whether that goal is achieved by listening for allpackets (through a packet sniffer) on a network or by utilizing a compromised name server toredirect a certain network required to a maliciously duplicated, or compromised, host.Over the last few years, falls in hardware prices have made it attractive and convenientfor corporations and home users to go wireless, in particular using the 802.11 standard But

in the rush towards liberation from the tethers of computer cable, individuals andcompanies are opening the doors to a whole new type of computer intrusion Withoutspecial software or hardware other than ordinary consumer wireless cards, hackers havefound a new pastime: cruising around metropolitan areas with their laptops listening for thebeacons of wireless networks and then accessing unprotected WLANs War driving _ THE BUSINESS CASE FORIT SECURITY 9 ឣ