Data classification

The reason to classify data is to organize it according to its sensitivity to loss or disclosure, indicating the level of confidentiality, integrity and availability required.

Data classification helps ensure that the data is protected in the most cost-effective manner.

The classification is different in every company, but in general there are two man groups:

Private Business

Normally the availability is the main thing, if the service is down, or if data becomes lost, implies a monetary loss and image loss.

Government and military

In Government and military, the confidentiality is the main thing, integrity is the second and availability (normally) is the less important. Because there are secrets to keep, and the money don't come from the data or a service.


The information can be:

Public

Disclosure is not welcome, but it would not impact on the company.
->Business

Proprietary

If disclosed could reduce competitive edge.
(technical specifications of a product)
->Business

Confidential

Disclosure seriously affect a company.
(trade secrets, code)
->Business & Military

Sensitive

Special precaution in the integrity.
->Business

Secret

If disclosed could cause serious damage or national security.
(military plans)
->Military

Top secret

If disclosed, it could cause grave damage to a national security
(spy satellite)
->Military

Sensitive but unclassified (SBU)

Minor secret.
(medical data)
->Government

Unclassified

Data not sensible or classified.
->Military


The sensitivity level:
1. Top secret
2. Secret
3. Confidential
4. SBU
5. Unclasified

Data Classification Procedures

1. Identify custodian responsible for maintaining data and its security level
2. Criteria how is classified
3. The owner set the classification
4. Security controls required
5. Document exceptions
6. Methods to transfer the custody to a different data owner
7. Procedures to declassifying the data
8. Security awareness program

Responsibilities

Senior management, and other levels of management, understand the vision of the company, the business goals and objectives.
The next layer is functional management, who understand their departments and how security affects their department.
The next layers are operational management managers and staff, understand the techniques and procedures.

The data owner is a member of senior management, he is responsible for negligent acts and decide the classification.

The data custodian maintain and protect the data, for ex. system administrator.

The data user, who routinely uses the data.

The chief information officer (CIO) should work with senior to define procedures.

Business managers determine the level of protection needed, and are involved in the selection of safeguards.

Auditor examines the practices.

Security professional, is responsible for security and carry out the senior manager's directives.

DoD Data Classification

- Top Secret
- Secret
- Confidential
- Unclassified

Data classification is done in mandatory access controls.

Policies, Procedures, Standards, Baselines and Guidelines

The senior manager has to protect the computers and information the most cost-effective manner possible by a Risk Management.
He defines the scope of security, what is expected from employees and the consequences of noncompliance will be.
A security program includes: Policies, Procedures, Standards, Baselines and Guidelines

The Policies are the strategy and procedures, standards, baselines and guidelines the tactics. Procedures are the lowest level in the policy chain

Security Policy

The policy provides the fundation, procedures, standards, baselines and guidelines are the security framework.

There are thre categories or types of policies:

Regulatory

Ensures that organization is following the standards by a specific industry or law.

Advisory

Strongly suggest certain types of behaviors and activities.

Informative

Inform about some topics, is not enforceable policy but is to teach people.


The security policies are:

Organizational Security Policy

- How security progam will be set up.
- program's goals
- assigns responsibilities
- strategic and tactical value of security
- how enforcement should be carried.

Organizational security policy provides scope an direction for all future security activities within the organization and define the amount of risk the senior management is willing to accept.

Issue-specific policies

This policies are more detailed, because policies provide direction and structure for the staff.

For example: email security policy

System-specific policy

System policies includes: Computers, Networks, Application and Data.

- approved software list.
- how to configure firewalls.
- how databases have to be protected.
and o on.

More granularity is needed in this kind of policies.

Standards

Mandatory rules.
Standards and baselines achieve consistency in security implementation.

Baselines

Provide the minimum security level necessary throughout the organization,
for ex: At all workstations of the company, at least C2 level is required.

Guidelines

Recommended actions and operations to the staff and users when a specific standard doesn't apply.
Guidelines are flexible.

Procedures

Tasks detailed step by step to achieve certain goal.
Procedures spell out how the policy, standards, and guidelines will actually be implemented.

Risk Management

There are 3 steps in risk management:

1. Asset identification and Value Assignment
2. Quantitative/Qualitative Risk Analysis and assessment
3. Countermeasure and implementation

Asset identification and Value Assignment

Delphy technique consists in make a group, and anonimously, everybody put a value for some risks

Quantitative Risk Analysis

AV asset value
EF exposure factor
SLE single loss expectanci
ARO anualized rate of occurrence
ALE anualized loss expectancy
residual risk -> risk reduced by safeguards (risk never is reduced to 0)
total risk -> we have total risk if don't implement the safeguards.

AV * EF = SLE

SLE * ARO = ALE

Coefficients are in range 0-1 with 2 decimals.

Qualitative Risk Analysis

Some levels may be defined, like: dangerous, very dangerous, not dangerous.

Handling Risks

There are 4 options for each risk:

transfer the risk (ex. insurance)
reduce the risk (ex. countermeasures)
rejecting the risk (ex. ignore the risk)
accept the risk (ex. cost of countermeasures outweights the potential loss value AV)

Countermeasure costs:
Product cost
Design/planning cost
Implementation cost
Environment modifications
Compatibility with other countermeasures
Maintenance requirements
Testing requirements
Repair, replace, or update costs
Operating and support costs
Effects on productivity

Cryptograpy

Caesar Cipher is a substitution algorithm
Asymetric key are easy to distribute, this is a big advantage versus symetric ones.


online ppt

DES - Digital Encryption System

IMB developed DES on 1972, but never was approved by national security, but is a standard for unclassified government data.

Is a symetric private key algorithm that does 16 rounds of transpositions and substitutions.
blocksize 64bits, plain cyphertext.
keysize 56bit - 8bit of parity

Exists HW implementations of DES.

Double DES: key 112bits
Triple DES: very secure, encrypt first key, decrypt second key, encrypt first key.

El Gamal: Extends Diffie-Helman, enabling the encryption and the digital key management.

The only cipher system said to be unbreakable by brute force is one-time pad.

Electronic Code Book (ECB) is a cryptographic tool vulnerable to frequency analysis.
According to Bruce Schneier and Niels Ferguson, the best mode to select for a product would be CTR (counter) but failure to randomize the nonce, and preventing nonce reuse will decrease the security of CTR mode.

The running key cipher is based on modular arithmetic.

Cryptosystem attacks can be: timing, chosen plaintext an differential. But not Rubber hose which is used to attack the user and not the system.

Polyalphabetic ciphers are used for mitigating frequency analysis attack.

Change Control Management

Change control manager ensures that changes are authorized, documented, correct but NOT effective.

Code escrow

Source source code escrow protects against vendor bankruptcy.

X.509 certificate syntax

The current version of X.509 is 3, this are the fields:


1. version
2. serial number
3. signature algorithm ID
4. issuer name
5. validity period
6. subject (user) name
7. subject public key information
8. issuer unique identifier (version 2 and 3 only)
9. subject unique identifier (version 2 and 3 only)
10. extensions (version 3 only)
11. signature on the above fields

CISSP Exam can ask you about valid/invalid fields.

X.509 is supported by PEM, PKCS, S-HTTP, SSL, and other protocols

More info:
http://www.x5.net/faqs/crypto/q165.html