Front cover - IBM Redbooks

48 Lotus Security Handbook
The same thing goes for security. What made distributed denial-of-service
attacks effective at first was that people trying to combat them knew about the
vulnerabilities in TCP/IP that could be used to mount a denial-of-service attack
(such as SYN Floods), but they didn’t know that, through the power of distributed
computing, machines connected to the Internet could be infected with a special
kind of software that caused them to act as zombies and mount a coordinated
denial-of-service attack which is several orders of magnitude worse than a simple
denial-of-service attack. Worse, these people didn’t even known that they didn’t
know this, so they could not plan for it as part of the security policy and the
resulting security architecture.
Because attackers will always find new ways of attacking, there will always be
some residual risk. Ideally, a proper security methodology will help us do a
thorough security review and implement an appropriate security infrastructure.
Before we go into this, we first complete our review of the basic steps of IT
security (more complex models and methods will follow).
Looking back at Figure 2-1, mitigating risks involves a set of specific steps.
1. Analyze the major risks for the organization you are trying to secure so that
you can define procedures that will help prevent these risks from happening.
2. Define a security policy to deal with assets for which it is not possible to
prevent malicious actions without putting one or more protective measures in
place.
3. In situations where protective measures are overcome, have in place an
emergency response plan (generally called an Incident Handling procedure)
that tells you what to do in those cases.
4. Finally, because all those problems are not solved just by defining a security
policy, but only by investing money for certain activities and countermeasures,
it is the final call of senior management as to what residual risk can be
accepted. Insurance carriers can provide coverage for these residual risks.
The rate at which risk can be reduced by defining and applying a security policy
varies on a case-by-case basis; our figure is for illustration purposes only.
2.1.3 The human element
To complete our review of the basics, let’s consider the most common cause of
security problems: people.
People, and not necessarily the technology in place, are the cause of security
problems in the long run. Generally, security is compromised when employees
make mistakes or perform activities that lay outside of their realm of permissions.