Information and Security

VISA International Security Model VISA International promotes strong security measures andhas security guidelines Developed two important documents that improve andregulate information systems: “Security AssessmentProcess”; “Agreed Upon Procedures” Using the two documents, security team can develop soundstrategy the design of good security architecture Only down side to this approach is very specific focus onsystems that can or do integrate with VISA’s systemsBaselining and Best Business Practices Baselining and best practices are solid methods forcollecting security practices, but provide less detail than acomplete methodology Possible to gain information by baselining and using bestpractices and thus work backwards to an effective design The Federal Agency Security Practices (FASP) site(fasp.nist.gov) designed to provide best practices for publicagencies and adapted easily to private institutionsHybrid Framework for a Blueprint of anInformation Security System Result of a detailed analysis of components of alldocuments, standards, and Web-based informationdescribed previously Offered here as a balanced introductory blueprint forlearning the blueprint development processFigure 5-15 – Spheres of SecurityHybrid Framework for a Blueprint of anInformation Security System (continued) NIST SP 800-26 Management controls cover security processes designed bythe strategic planners and performed by securityadministration Operational controls deal with operational functionality ofsecurity in organization Technical controls address tactical and technical issuesrelated to designing and implementing security inorganizationDesign of Security Architecture Defense in depth Implementation of security in layers Requires that organization establish sufficient securitycontrols and safeguards so that an intruder faces multiplelayers of controls Security perimeter Point at which an organization’s security protection ends andoutside world begins Does not apply to internal attacks from employee threats oron-site physical threatsKey Technology Components Firewall: device that selectively discriminates againstinformation flowing into or out of organization Demilitarized zone (DMZ): no-man’s land between insideand outside networks where some organizations placeWeb servers Intrusion Detection Systems (IDSs): in effort to detectunauthorized activity within inner network, or on individualmachines, organization may wish to implement an IDSFigure 5-18 – Key ComponentsSecurity Education, Training, and AwarenessProgram As soon as general security policy exist, policies toimplement security education, training and awareness(SETA) program should follow SETA is a control measure designed to reduce accidentalsecurity breaches Security education and training builds on the generalknowledge the employees must possess to do their jobs,familiarizing them with the way to do their jobs securely The SETA program consists of three elements: securityeducation; security training; and security awareness