National Institute of Standards and Technology Technology Administration U.S.

Department of Commerce

Generally Accepted Principles and Practices for Securing Information Technology Systems

Marianne Swanson Barbara Guttman

September 1996

Principles and Practices for Securing IT Systems

Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.1 Principles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.3 Relationship of Principles and Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 1.4 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 1.5 Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.6 Structure of this Document . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1.7 Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 2. Generally Accepted System Security Principles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 2.1 Computer Security Supports the Mission of the Organization . . . . . . . . . . . . . . . . . 5 2.2 Computer Security is an Integral Element of Sound Management . . . . . . . . . . . . . . 6 2.3 Computer Security Should Be Cost-Effective . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 2.4 Systems Owners Have Security Responsibilities Outside Their Own Organizations .............................................................7 2.5 Computer Security Responsibilities and Accountability Should Be Made Explicit . 8 2.6 Computer Security Requires a Comprehensive and Integrated Approach . . . . . . . . 9 2.7 Computer Security Should Be Periodically Reassessed . . . . . . . . . . . . . . . . . . . . . . 9 2.8 Computer Security is Constrained by Societal Factors . . . . . . . . . . . . . . . . . . . . . 10 3. Common IT Security Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1 Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.1 Program Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.2 Issue-Specific Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.3 System-Specific Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.4 All Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Program Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.1 Central Security Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.2 System-Level Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3 Risk Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.1 Risk Assessment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.2 Risk Mitigation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.3 Uncertainty Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 Life Cycle Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4.1 Security Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4.2 Initiation Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4.3 Development/Acquisition Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4.4 Implementation Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . iii 11 13 13 14 14 15 16 16 17 19 19 20 21 22 22 22 22 23

Principles and Practices for Securing IT Systems

3.4.5 Operation/Maintenance Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4.6 Disposal Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5 Personnel/User Issues . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5.1 Staffing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5.2 User Administration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6 Preparing for Contingencies and Disasters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6.1 Business Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6.2 Identify Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6.3 Develop Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6.4 Develop Strategies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.6.5 Test and Revise Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.7 Computer Security Incident Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.7.1 Uses of a Capability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.7.2 Characteristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.8 Awareness and Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.9 Security Considerations in Computer Support and Operations . . . . . . . . . . . . . . . 3.10 Physical and Environmental Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.11 Identification and Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.11.1 Identification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.11.2 Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.11.3 Passwords . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.11.4 Advanced Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.12 Logical Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.12.1 Access Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.12.2 Access Control Mechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.13 Audit Trails . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.13.1 Contents of Audit Trail Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.13.2 Audit Trail Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.13.3 Audit Trail Reviews . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.13.4 Keystroke Monitoring . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.14 Cryptography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4. References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

24 26 27 27 28 31 31 31 32 32 33 34 34 34 37 39 41 43 43 44 45 45 46 46 47 50 50 51 51 52 54 56

iv

The intrinsic expectations are described in this document as generally accepted system security principles. certain intrinsic expectations must be met whether the system is small or large or owned by a government agency or by a private corporation. 1. a common understanding of what is needed and expected in securing information technology (IT) resources is required. internal auditors. The practices guide organizations on the types of controls. accountability. objectives and procedures that comprise an effective IT security program.2 Practices The next level in the foundation is the common IT security practices that are in general use today. Principles are expressed at a high level. and integration. cost effectiveness. e. practices or policies. 1. The principles are to be used when developing computer security programs and policy and when creating new systems. Introduction As more organizations share information electronically. The principles address computer security from a very high-level viewpoint.Principles and Practices for Securing IT Systems 1. encompassing broad areas. This document provides the practices in a checklist format to assist organizations in reviewing their current policies and procedures against the common practices presented here. and security practioners can use the guideline to gain an understanding of the basic security requirements most IT systems should contain.. The document gives a foundation that organizations can reference when conducting multi-organizational business as well as internal business. The foundation begins with generally accepted system security principles and continues with common practices that are used in securing IT systems. The practices provide a common ground for determining the security of an organization and build confidence when conducting multi-organizational business. system developers.g. users. This document provides a baseline that organizations can use to establish and review their IT security programs.1 Principles Many approaches and methods can be used to secure IT systems. Management. Organizations should use the practices as a starting point in order to develop additional practices based on their 1 . The practices show what should be done to enhance or measure an existing computer security program or to aid in the development of a new program. however.

Their recommendation called for the development of a comprehensive set of generally accepted system security principles (GSSP) which would clearly articulate essential security features. The important point is that the principles provide the foundation for a sound computer security program. particularly front-line systems for delivering services electronically to citizens. Work began on implementing the Computers At Risk recommendation in 1992 2 . and design of government information and data systems. practices are derived from one or more principles.3 Relationship of Principles and Practices This document describes eight principles and fourteen practices. in other cases practices are constrained by principles. 1. standards. so will the practices. protection. They are not intended to be definitive.4 Background The National Performance Review (NPR) recommended as part of the National Information Infrastructure (NII) that the National Institute of Standards and Technology (NIST) develop generally accepted system security principles and practices for the federal government. The need for rules. These security principles and practices are to be applied in the use. However.Principles and Practices for Securing IT Systems own organizational and system requirements. While a mapping could be made to the specific relationships between the principles and the practices. the Risk Management Practice is directly derived from the Cost-Effectiveness Principle. For example. Each of the principles applies to each of the practices. it is probably not useful. In some cases. the Comprehensive and Reassessment Principles place constraints on the Risk Management Practice. An Introduction to Computer Security: The NIST Handbook. assurances. The common practices should be augmented with additional practices based on each organization’s unique needs. The nature of the relationship between the principles and the practices varies. and practices. 1. conventions and procedures that define accepted security practices was outlined in the 1991 National Research Council document Computers At Risk. as technology changes. The practices described in this publication come from NIST Special Publication 800-12.

users and computer security officers. availability. and telecommunications).6 Structure of this Document This document is organized as follows: Chapter 2 presents the principles. software. Chapter 3 contains the common IT security practices. The principles are intended as a guide when creating program policy or reviewing existing policy. Chapter 4 provides references used in the development of this document. 1.7 Terminology This document uses the terms information technology security and computer security interchangeably. The chapter covering principles is to be used by all levels of management and by those individuals responsible for computer security at the system level and organization level. This document draws upon their on going efforts. The concepts presented are generic and can be applied to organizations in private and public sectors. 1. 3 . information data. firmware. managers. The common practices are intended as a reference document and an auditing tool. The terms refer to the entire spectrum of information technology including application and support systems. and confidentiality of information system resources (including hardware.Principles and Practices for Securing IT Systems by several national and international organizations with an interest in computer security. Computer security is the protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity. 1.5 Audience This document has two distinct uses. The goal of this document is to provide a common baseline of requirements that can be used within and outside organizations by internal auditors.

Reassessment . They are based on the premise that (most) everyone applies these when developing or maintaining a system and they have become generally accepted. Ethics .Security levels. providers. NIST developed principles which applies to federal systems.Principles and Practices for Securing IT Systems 2..Public and private parties.The Information systems and the security of information systems should be provided and used in such a manner that the rights and legitimate interest of others are respected. The OECD Guidelines were developed in 1992 by a group of international experts to provide a foundation from which governments and the private sector. An Introduction to Computer Security: The NIST Handbook. consistent with maintaining security. NIST drew upon the OECD Guidelines.. probability and extent of potential harm.. Integration . to gain appropriate knowledge of and be informed about the existence and general extent of measures. practices and procedures for the security of information systems should take account of and address all relevant considerations and viewpoints. Awareness . should act in a timely coordinated manner to prevent and to respond to breaches of security of information systems. The OECD Guidelines are the current international guidelines which have been endorsed by the United States. as information systems and the requirements for their security vary over time. Timeliness . Democracy .. The principles added by NIST are in keeping OECD's Guidelines for the Security of Information Systems : Accountability . acting singly and in concert. Figure 1.should be explicit. at both national and international levels. measures.that which is most commonly being used at the present time to secure IT resources.. A brief description of the nine OECD principles is provided in Figure 1. could construct a framework for securing IT systems. The eight principles originally appeared as the "Elements of Computer Security" in the NIST Special Publication 80012.for the security of information systems. The principles that this document offers are not new to the security profession. practices and procedures for the security of information systems should be coordinated and integrated with each other and other measures. users and other parties should readily be able.Owners. 1 4 . the principles are generally accepted -..Measures..The responsibilities and accountability of owners. Multidisciplinary .The security of information systems should be compatible with the legitimate use and flow of data and information in a democratic society. combined some principles. costs.Measures. added material. Most of the rewriting and combining was done to provide clarity.. OECD Guidelines..The security of information systems should be reassessed periodically.. Generally Accepted System Security Principles As the name implies. Using the spirit of the Guidelines.1 In developing this set of principles. Proportionality . providers and users of information systems and other parties. practices and procedures of the organization so as to create a coherent system of security. This document uses the Organization for Economic Co-operation and Development's (OECD) Guidelines for the Security of Information Systems as the base for the principles. practices and procedures should be appropriate and proportionate to the value of and degree of reliance on the information systems and to the severity. and rewrote others.

well-chosen security rules and procedures do not exist for their own sake -. Security. Through the selection and application of appropriate safeguards.Principles and Practices for Securing IT Systems with the OECD principles but not directly stated. is a means to an end and not an end in itself. Security. managers need to understand both their organizational mission and how each information system supports that mission. employees. Unfortunately. After a system's role has been defined. 2. bothersome rules and procedures on users. security is usually secondary to the agency's providing services to citizens. Government would benefit from its own set of principles. the security requirements implicit in that role can be defined. then. practices. In a public-sector agency. such as information. and software. For example. in a privatesector business. or policies. Security can then be explicitly stated in terms of the organization's mission. They are not designed to produce specific answers. Security. having good security is usually secondary to the need to make a profit. legal position. ought to increase the firm's ability to make a profit. therefore. hardware.they are put in place to protect important assets and support the overall organizational mission. 5 . These principles are intended to guide agency personnel when creating new systems. a determination was made that the U. NIST added the principle that Computer Security Support the Mission of the Organization.S. and other tangible and intangible assets. then. With much consideration.1 Computer Security Supports the Mission of the Organization The purpose of computer security is to protect an organization's valuable resources. NIST thoroughly reviewed what is currently being accomplished in the IT Security principles area. Each principle is expressed as a one-line section heading and explained in the paragraphs that immediately follow. ought to help improve the service provided to the citizen. Prior to developing these principles. To act on this. reputation. and systems. managers. security is sometimes viewed as thwarting the mission of the organization by imposing poorly selected. The eight principles contained in this document provide an anchor on which the Federal community should base their IT security programs. security helps the organization's mission by protecting its physical and financial resources. On the contrary. For example. pragmatically and reasonably. The principles should be applied as a whole.

However. including security considerations in the management of information and computers does not completely eliminate the possibility that these assets will be harmed. For example. good security on the buyer's system also benefits the seller. Security should be appropriate and proportionate to the value of and degree of reliance on the IT systems and to the severity. (The reverse is also true. probability. and extent of potential harm. This requires that management (1) know what general level or type of security is employed on the external system(s) or (2) seek assurance that the external system provides adequate security for their organization's needs. However. depending upon the particular IT system. Ultimately. Requirements for security vary.) 2. In an interorganizational system. the management of information and computers may transcend organizational boundaries. Protecting them can be as important as protecting other organizational resources. physical assets. or employees. taking into account the cost of security controls. When an organization's information and IT systems are linked with external systems. for electronic commerce to be successful. As with other resources. the buyer's system is less likely to be used for fraud or to be unavailable or otherwise negatively affect the seller. 2. organization managers have to decide what level of risk they are willing to accept. management's responsibilities extend beyond the organization.Principles and Practices for Securing IT Systems The roles and functions of a system may not be restricted to a single organization.2 Computer Security is an Integral Element of Sound Management Information and IT systems are often critical assets that support the mission of an organization. each organization benefits from securing the system. such as money. 6 .3 Computer Security Should Be Cost-Effective The costs and benefits of security should be carefully examined in both monetary and nonmonetary terms to ensure that the cost of controls does not exceed expected benefits. each participant requires security controls to protect their resources.

may significantly reduce the loss. Elimination of these kinds of threats can reduce unfavorable publicity as well as increase morale and productivity. employee morale. than simply tolerating the problem. 7 . installing. This does not imply that all systems must meet any minimum level of security. such as an improved access control system. and administering security measures. All of these have to be considered in addition to the basic cost of the control itself. In many cases. Additionally. its owners have a responsibility to share appropriate knowledge about the existence and general extent of security measures so that other users can be confident that the system is adequately secure.Principles and Practices for Securing IT Systems In general. an organization can reduce the frequency and severity of computer security-related losses. security is a smart business practice.4 Systems Owners Have Security Responsibilities Outside Their Own Organizations If a system has external users. directly or indirectly. For example. 2. Security benefits do have both direct and indirect costs. Direct costs include purchasing. By investing in security measures. but does imply that system owners should inform their clients or users about the nature of the security. for example. or retraining requirements. in the costs of administering an access control package). Solutions to security problems should not be chosen if they cost more. Security measures. Moreover. an organization may estimate that it is experiencing significant losses per year in inventory through fraudulent manipulation of its IT system. security measures can sometimes affect system performance. in monetary or non monetary terms. a sound security program can thwart hackers and reduce the frequency of viruses. these additional costs may well exceed the initial cost of the control (as is often seen. such as access control software or firesuppression systems.

the computer security program may be large or small. 1992. Organization for Economic Co-operation and Development. taking such action should not jeopardize the security of systems. programmers. This element does not specify that individual accountability must be provided for on all systems. responsibility is a broader term.5 Computer Security Responsibilities and Accountability Should Be Made Explicit The responsibility and accountability3 of owners. and network managers). For example. 5 This principle implicitly states that people and other entities (such as corporations or governments) have responsibility and accountability related to IT systems which may be shared. maintenance providers. Guidelines for the Security of Information Systems.Principles and Practices for Securing IT Systems In addition to sharing information about security. many information dissemination systems do not require user identification or use other technical means of user identification and. However. an anonymous user on a system is responsible for behaving according to accepted norms but cannot be held accountable if a compromise occurs since the action cannot be traced to an individual. therefore. defining obligations and expected behavior. managers charged with security of information systems. 4 3 2 8 . operations managers. The difference between responsibility and accountability is not always clear.5 The assignment of responsibilities may be internal to an organization or may extend across organizational boundaries. organization managers "should act in a timely. information system managers (software managers. coordinated manner to prevent and to respond to breaches of security" to help prevent damage to others. The term accountability generally refers to the ability to hold people responsible for their actions. people could be responsible for their actions but not held accountable. Paris. The term other parties may include but is not limited to: executive management. The term implies a proactive stance on the part of the responsible party and a causal relationship between the responsible party and a given outcome. Depending on the size of the organization. For example. cannot hold users accountable. In general. software development managers. 2.2 However. Therefore. even small organizations can prepare a document that states organization policy and makes explicit computer security responsibilities. providers. and users of IT systems and other parties4 concerned with the security of IT systems should be explicit. even a collateral duty of another management official. and internal and external information system auditors.

security controls often depend upon the proper functioning of other controls. legal issues. Managers should recognize how computer security relates to other areas of systems and organizational management. In reality. without proper training on how and when to use a virus-detection package. On the other hand. a change in the value or use of information. If appropriately chosen. This comprehensive approach extends throughout the entire information life cycle. or the emergence of a new threat.7 Computer Security Should Be Periodically Reassessed Computers and the environments in which they operate are dynamic. they can actually undermine one another. For example. and technical controls can work together synergistically. data and information in the systems. System technology and users. quality assurance. The effectiveness of security controls also depends on such factors as system management. managerial. Computer security needs to work with traditional security disciplines including physical and personnel security. Many types of changes affect system security: technological developments (whether adopted by the system owner or available for use by others). the user may mistakenly believe that if their system has been checked once. the user may apply the package incorrectly and. and security requirements are ever-changing. In addition. Many other important interdependencies exist that are often unique to the organization or system environment. As a result. operational. security is never perfect when a system is implemented. without a firm understanding of the interdependencies of security controls. and internal and management controls. connection to external networks.6 Computer Security Requires a Comprehensive and Integrated Approach Providing effective computer security requires a comprehensive approach that considers a variety of areas both within and outside of the computer security field. To work effectively. therefore. Changes in the 9 . System users and operators discover new ways to intentionally or unintentionally bypass or subvert security.Principles and Practices for Securing IT Systems 2. that it will always be virus-free and may inadvertently spread a virus. ineffectively. risks associated with the system. these interdependencies are usually more complicated and difficult to ascertain. Many such interdependencies exist. 2.

(In some cases. This may involve balancing the security needs of information owners and users with societal goals. The relationship between security and societal norms is not necessarily antagonistic. Strict adherence to procedures is rare and procedures become outdated over time. rules and expectations change with regard to the appropriate use of security controls. However. security is implemented on an IT system by identifying users and tracking their actions. such as social issues. it is not the only one.) Although privacy is an extremely important societal issue.Principles and Practices for Securing IT Systems system or the environment can create new vulnerabilities. privacy may be mandated by law. For example. Commonly. However. expectations of privacy vary and can be violated by some security measures. The flow of information. Security can enhance the access and flow of data and information by providing more accurate and reliable information and greater availability of systems. 2. Security measures should be selected and implemented with a recognition of the rights and legitimate interests of others. especially between a government and its citizens. 10 . some authentication measures may be considered invasive in some environments and cultures. is another situation where security may need to be modified to support a societal goal.8 Computer Security is Constrained by Societal Factors The ability of security to support the mission of an organization may be limited by various factors. Security can also increase the privacy afforded to an individual or help achieve other goals set by society. security and workplace privacy can conflict. In addition. These issues make it necessary to reassess periodically the security of IT systems. These changes may either increase or decrease security.

In the audit trail section. The NIST Handbook contains over 200 pages of assistance in securing computer-based resources. The controls are then divided into subsections with practices listed below.Principles and Practices for Securing IT Systems 3. agencies should consider them as the minimum set. 11 . It was much more difficult to design a checklist of practices for types of technical controls. cost considerations. an agency is developing a contingency plan. the reader will find more of a laundry list of what should be considered. Whether the section is a technical control or an operational or management control." Several documents should be referenced for further information. it was easy to provide a checklist of what should be considered when. nor are they relevant to every situation. such as audit trails. however. The NIST Handbook will easily map to this chapter since the chapters are placed in the same order as the subsections. In most cases. Each chapter of the NIST Handbook was carefully reviewed to determine which sections denoted a practice and which parts were explanation. each section is formatted as a practice. in the way the practices are presented. This chapter should be augmented with additional practices based on each agencies' unique requirements. These practices are the ones currently employed in an effective computer security program. An Introduction to Computer Security: The NIST Handbook. It provides a broad overview of computer security and is an excellent primer for anyone interested in computer security. for example. detail. This section provides the "what" should be done. The practices serve as a companion to the NIST Special Publication. They do not take into account environmental or technological constraints. Each section begins with a brief explanation of the control and a synopsis of the practice. not the "why" or the "how. Common IT Security Practices The goal of this chapter is to assist the time-constrained security manager in reviewing their current policies and procedures against the common practices presented here. The NIST Handbook should be used to obtain additional detail on any of the practices listed. or example. the practice is followed with a brief explanation or example. The key points of each chapter along with a short explanation were placed into a practice format. Each practice appears with a small box placed to the left of it. The list is not exhaustive. and interrelationships of security controls. Some disparity exists. The NIST Handbook provides the "why to" and served as the template for deriving the practices. In some sections. The document explains important concepts. 800-12.

A Code of Practice for Information Security Management.nist. contact BSI Standards at the following: BSI Standards 389 Cheswick High Road London W4 4AL United Kingdom 44-181-996-9000 12 . For ordering information. The Code of Practice for Information Security Management is written in a similar style and offers short concise practices in IT security. Copyright was not obtainable. This document and the NIST Handbook are available electronically as follows: Anonymous ftp: csrc. NIST considered obtaining a copyright release for an excellent practices document that originated in the United Kingdom. The document is the British Standard 7799. It is highly recommended that this document be obtained as an excellent source for additional information.gov (129.Principles and Practices for Securing IT Systems The handbook also provides many references for further study.nist.6. however. the document was referenced while preparing this chapter.54.gov/nistpubs/800-12 Dial-up with modem: 301-948-5717 In the early development of this chapter.11) in the directory nistpubs/800-12 URL: http://csrc.

the computer security program covers. Address Compliance Issues.including facilities. procedures. For instance. and personnel -.1. or plans. data corruption. hardware.Principles and Practices for Securing IT Systems 3.) 3. and recovery might be specifically stressed. Assign Responsibilities. The term policy is also used to refer to the specific security rules for particular systems. data loss. Responsibilities should be assigned to the computer security organization for direct program implementation and other responsibilities should be assigned to related offices (such as the Information Resources Management organization). Organizations should have the following three different types of policy: Program. such as the specific managerial decisions setting an organization's e-mail privacy policy or fax security policy. (Some organizations may refer to these types with other names such as directives. in an organization responsible for maintaining large missioncritical databases. This may include defining the goals of the program. and software. IssueSpecific.1 Policy The term computer security policy has more than one meaning. Set Organizational Strategic Directions. and assign responsibilities. Program policy typically addresses two compliance issues: 1) meeting the requirements to establish a program and the responsibilities 13 . Additionally. policy may refer to entirely different matters. establish its goals. Program policy should be clear as to which resources -. and System Specific. reduction in errors. Policy is senior management's directives to create a computer security program. information.1 Program Policy An organization's program policy should: Create and Define a Computer Security Program.

Principles and Practices for Securing IT Systems

assigned therein to various organizational components, and 2) the use of specified penalties and disciplinary actions. 3.1.2 Issue-Specific Policy An organization's issue-specific policies should: Address Specific Areas. Topics of current relevance and concern to the organization should be addressed. Management may find it appropriate, for example, to issue a policy on how the organization will approach e-mail privacy or Internet connectivity. Be Updated Frequently. More frequent modification is required as changes in technology and related factors take place. If a policy was issued, for example, on the appropriate use of a cutting-edge technology (whose security vulnerabilities are still largely unknown) within the organization, it could require updating. Contain an Issue Statement. The organization's position statement, applicability, roles and responsibilities, compliance, and point of contact should be clear. 3.1.3 System-Specific Policy An organization's system-specific policies should: Focus on Decisions. The decisions taken by management to protect a particular system, such as defining the extent to which individuals will be held accountable for their actions on the system, should be explicitly stated. Be Made by Management Official. The decisions management makes should be based on a technical analysis. Vary From System to System. Variances will occur because each system needs defined security objectives based on the system's operational requirements, environment, and the

14

Principles and Practices for Securing IT Systems

manager's acceptance of risk. In addition, policies will vary based on differing needs for detail. Be Expressed as Rules. Who (by job category, organization placement, or name) can do what (e.g., modify, delete) to which specific classes and records of data, and under what conditions. 3.1.4 All Policies All three types of policy should be: Supplemented. Because policy may be written at a broad level, organizations also develop standards, guidelines, and procedures that offer users, managers, and others a clearer approach to implementing policy and meeting organizational goals. Standards, guidelines, and procedures may be disseminated throughout an organization via handbooks, regulations, or manuals. Visible. Visibility aids implementation of policy by helping to ensure policy is fully communicated throughout the organization. Supported by Management. Without management support, the policy will become an empty token of management's "commitment" to security. Consistent. Other directives, laws, organizational culture, guidelines, procedures, and organizational mission should be considered.

15

Principles and Practices for Securing IT Systems

3.2 Program Management
Managing computer security at multiple levels brings many benefits. Each level contributes to the overall computer security program with different types of expertise, authority, and resources. In general, executive managers (such as those at the headquarters level) better understand the organization as a whole and have more authority. On the other hand, front-line managers (at the computer facility and applications levels) are more familiar with the specific requirements, both technical and procedural, and problems of the systems and the users. The levels of computer security program management should be complementary; each can help the other be more effective. Many organizations have at least two levels of computer security management; the central level and the system level. 3.2.1 Central Security Program A central security program should provide distinct types of benefits: increased efficiency and economy of security throughout the organization and the ability to provide centralized enforcement and oversight. It should have the following: Stable Program Management Function. The program management function should be stable and recognized within the organization as a focal point for computer security. However complex or simple the program management function is, it requires a stable base, including resources, to perform its activities. Existence of Policy. A program should be based on organizational policy and should create policy, standards, and procedures, as appropriate to address the computer security needs of the organization. Published Mission and Functions Statement. The statement should clearly establish the function of the computer security program and define responsibilities for the computer security program and other related programs and entities. It is often a part of organizational policy.

16

Compliance Program. for example. as well as organization-specific requirements. a major application. or a group of similar systems (either technologically or functionally). such as safety. as appropriate. Intraorganizational Liaison. An effective program should have established relationships with these groups in order to integrate computer security into the organization's management. the computing resources within an operational element. System-level computer security programs may address. to external groups. Liaison with External Groups. Computer security often overlaps with other offices. The system policy should document the system security rules for operating or developing the system. It should also provide information. A program should explore and develop long-term strategies to incorporate computer security into the next generation of information technology. Life Cycle Management. reliability and quality assurance. They should have the following: System-Specific Security Policy. An established program should be knowledgeable of and take advantage of external sources of information. system-level computer security programs ensure appropriate and cost-effective security for each system. or the Office of the Inspector General.2.Principles and Practices for Securing IT Systems Long-Term Computer Security Strategies. Systems should be managed to ensure appropriate and costeffective security. This specifically includes ensuring that security is authorized by 17 . A central computer security program needs to address compliance with national policies and requirements. internal control. physical security. such as defining authorized and unauthorized modifications. 3.2 System-Level Program While the central program addresses the entire spectrum of computer security for an organization.

4). if a computer security program lacks appropriate independence. However. and its operating environment. and have few resources. its technology. Appropriate Integration with System Operations. The people who run the system security program should understand the system. it may have minimal authority. 18 . receive little management attention. Effective security management needs to be integrated into the management of the system. its mission.Principles and Practices for Securing IT Systems appropriate management and that changes to the system are made with attention to security (also see Section 3.

The consequence assessment estimates the degree of harm or loss that could occur. taking steps to reduce risk to an acceptable level and maintaining that level of risk. The value of an asset consists of its intrinsic value and the near-term impacts and long-term consequences of its compromise. These include the information. is comprised of three basic activities: Determine the Assessment's Scope and Methodology. This examination normally includes gathering data about the threatened area and synthesizing and analyzing the information to make it useful. The many different components of risk should be examined. 19 . Risk management consists of two primary and one underlying activity. The first step in assessing risk is to identify the system under consideration. Typical threats are errors. hardware.1 Risk Assessment Risk assessment.3 Risk Management Risk is the possibility of something adverse happening. Risk management is the process of assessing risk. . and physical assets (such as the computer facility). software. fires.Principles and Practices for Securing IT Systems 3. Risk management requires the analysis of risk. Collecting and Analyzing Data. disgruntled employees. and the analytical method including its level of detail and formality.Threat Identification.3. . 3. A threat is an entity or event with the potential to harm the system. personnel. and. water damage. fraud. the process of analyzing and interpreting risk. risk assessment and risk mitigation are the primary activities and uncertainty analysis is the underlying one.Consequence Assessment.Asset Valuation. consideration of alternatives. the part of the system that will be analyzed. implementation of what management determines to be the best course of action. An organization should consider the following when assessing risks. The types of areas are: . finally. relative to potential benefits.

they need not be performed in that sequence. legislation. . and strengths of threats as well as the effectiveness of safeguards (or presence of vulnerabilities). the following factors should be considered: . Although there is flexibility in how risk assessment is conducted. A vulnerability is a condition or weakness in (or absence of) security procedures. the process of risk mitigation has greater flexibility than the sequence of events conducted in a risk assessment. however.Vulnerability Analysis. The risk assessment is used to support two related functions: the acceptance of risk and the selection of cost-effective controls.Safeguard Analysis. The identification of appropriate controls is a primary function of computer security risk management. and viruses.3.organizational policy. Interpreting Risk Assessment Results. Threats should be identified and analyzed to determine the likelihood of their occurrence and their potential to harm assets. A likelihood assessment considers the presence. or other controls that could be exploited by a threat. technical controls. and regulation. The following activities are discussed in a specific sequence.Principles and Practices for Securing IT Systems hackers. 20 . 3.2 Risk Mitigation Risk mitigation involves the selection and implementation of security controls to reduce risk to a level acceptable to management.Likelihood Assessment. Safeguard analysis should include an examination of the effectiveness of the existing security measures. physical controls. Likelihood is an estimation of the frequency or chance of a threat happening. Select Safeguards. tenacity. In selecting appropriate controls. The risk assessment must produce a meaningful output that reflects what is truly important to the organization. . .

incomplete data. accuracy. and completeness requirements.system performance requirements. or consequences.the life cycle costs of security measures.) Implementing Controls and Monitoring Effectiveness. often called accreditation.technical requirements.cultural constraints. Management needs to decide if the operation of the IT system is acceptable.3. and (2) a lack of sufficient information to determine the exact value of the elements of the risk model. The acceptance of risk is closely linked with the authorization to use a IT system. To continue to be effective. and quality requirements. reliability.3 Uncertainty Analysis Risk management must often rely on speculation. best guesses. An uncertainty analysis should be performed and documented so that the risk management results can be used knowledgeably. . and . This requires a periodic assessment and improvement of safeguards and reanalysis of risks. Accept Residual Risk. The safeguards selected need to be effectively implemented.safety. (Accreditation is the acceptance of risk by management resulting in a formal approval for the system to become operational or remain so. . . given the kind and severity of remaining risks. .timeliness. 3. risk management needs to be an ongoing process. 21 . There are two primary sources of uncertainty in the risk management process: (1) a lack of confidence or precision in the risk management model or methodology. and many unproven assumptions. such as threat frequency. safeguard effectiveness.Principles and Practices for Securing IT Systems .

or operational practices (e. assurances.4 Life Cycle Planning Security. 3. is best managed if planned for throughout the IT system life cycle. This phase often consists of other defined cycles. These requirements can be expressed as technical features (e. implementation. assurances (e.1 Security Plan Organizations should ensure that security activities are accomplished during each of the phases. 3. such as the system development cycle or the acquisition cycle. purchased. 3. Incorporate Security Requirements Into Specifications. A sensitivity assessment looks at the sensitivity of the information to be processed and the system itself. Determining security features.2 Initiation Phase During the initiation phase. background checks for system developers). developed.4.g. access controls). programmed.. There are many models for the IT system life cycle but most contain five basic phases: initiation. the need for a system is expressed and the purpose of the system is documented. During the first part of the development/ acquisition phase.. like other aspects of an IT system. Prepare a Security Plan. and operational practices can yield significant security information 22 . and disposal..4. security requirements should be developed at the same time system planners define the requirements of the system. the system is designed.g. The following steps should be considered during this phase: Determine Security Requirements.4. A security plan should be used to ensure that security is considered during all phases of the IT system life cycle.3 Development/Acquisition Phase During this phase. awareness and training). operation.Principles and Practices for Securing IT Systems 3. or otherwise constructed.g. development/acquisition. Conduct a Sensitivity Assessment.

procedures. While obvious. In this case. and malicious insiders.4. Many systems use a combination of development and acquisition. poorly functioning development tools. 3. This information needs to be validated. Security Testing. the system is tested and installed or fielded. responding to changes. If the system is being acquired off the shelf. and contingency planning are 23 . a system often comes with security features disabled. security activities may include developing the system's security features. personnel. These need to be enabled and configured. and preparing documentation. System security testing includes both the testing of the particular parts of the system that have been developed or acquired and the testing of the entire system. operational practices need to be developed.4 Implementation Phase During implementation. incorrect code. awareness and training. and organized into the detailed security protection requirements and specifications used by systems designers or purchasers. the use of commercial or in-house services (such as networking services). physical facilities. and evaluation of proposed systems. monitoring the development process itself for security problems. When acquired. updated. The following items should be considered during this phase: Install/Turn-On Controls. Threats or vulnerabilities that may arise during the development phase include Trojan horses.Principles and Practices for Securing IT Systems and often voluminous requirements. security activities include both sets. In addition to obtaining the system. If the system is being built. security activities may include monitoring to ensure security is a part of market surveys. this activity is often overlooked. and monitoring threats. manipulation of code. Security management. These refer to human activities that take place around the system such as contingency planning. Obtain the System and Related Security Activities. contract solicitation documents.

operational. Audits and Monitoring. holding training classes. These terms are used loosely within the computer security community and often overlap. It is usually supported by a review of the system. including its management. and technical controls. 3. In general. the system performs its work. Operational assurance examines whether a system is operated according to its current security requirements. and updating security software are some examples.4. To maintain operational assurance. A system audit is a one-time or periodic event to evaluate security. 24 . organizations use two basic methods: system audits and monitoring. managing cryptographic keys. Accreditation. the more it falls into the category of monitoring. System security accreditation is the formal authorization by the accrediting (management) official for system operation and an explicit acceptance of risk. The system is almost always being continuously modified by the addition of hardware and software and by numerous other events. keeping up with user administration and access privileges.Principles and Practices for Securing IT Systems examples of areas that affect the security of the entire system. Monitoring refers to an ongoing activity that examines either the system or the users. Operation of a system involves many security activities discussed in this publication. Figure 2 describes the various forms of auditing and monitoring.5 Operation/Maintenance Phase During this phase. but may have been specified outside of the development or acquisition cycle. This includes both the actions of people who operate or use the system and the functioning of technical controls. Performing backups. Operational Assurance. The following high-level items should be considered during this phase: Security Operations and Administration. the more "real-time" an activity is.

Penetration testing can use many methods to attempt a system break-in. The auditor will often analyze both computer and noncomputer-based controls. Some methods are deemed more socially acceptable and some are illegal. lack of integrity of the system software. Periodically. It is wise to check with agency legal council. < < < Figure 2. In addition to monitoring the system. such as improper access controls or access control configurations. < < < Monitoring Types. A periodic review of system-generated logs can detect security problems. procedural. and (2) passive tests. Penetration Testing. In addition to using active automated tools as described above. or other aspects of security. Several types of automated tools monitor a system for security problems. it is useful to formally reexamine the security of a system from a wider perspective. managerial. There are many types and methods of monitoring a system or user. configuration management provides assurance that the system in operation is the correct version (configuration) of the system and that any changes to be made are reviewed for security implications. penetration testing can be done "manually. lax procedures or a lack of internal controls on applications are common vulnerabilities that penetration testing can target. Security Checklists. There are two types of automated tools: (1) active tools. Automated Tools. including attempts to exceed access authority or gain system access during unusual hours. integrity verification programs. Both types can provide excellent information about technical. checksumming. < Automated Tools. which find vulnerabilities by trying to exploit them. The analysis. or not using all relevant software updates and patches. which include national or organizational security policies and practices (often referred to as baselines). which only examine the system and infer the existence of problems from the state of the system. should address such questions as: Is the security still sufficient? Are major changes needed? The reaccreditation should address high-level security and management concerns as well as the implementation of the security. Checklists can be developed. intrusion detectors. Periodic Reaccreditation. 25 . password crackers. Automated tools can be used to help find a variety of vulnerabilities. and system performance monitoring. Some examples are virus scanners. The essential difference between a self-audit and an independent audit is objectivity. Configuration Management/Managing Change. Audits can be self-administered or independent (either internal or external). Audit and Monitoring Techniques." For many systems. Internal Controls Audit. An auditor can review controls in place and determine whether they are effective. Penetration testing is a very powerful technique. which leads to reaccreditation. weak passwords. From a security point of view. it is useful to monitor external sources for information. < < Review of System Logs.Principles and Practices for Securing IT Systems Audit and Monitoring Techniques Audit Types. it should preferably be conducted with the knowledge and consent of system management. Trade Literature/Publications/Electronic News.

and software.6 Disposal Phase The disposal phase of the IT system life cycle involves the disposition of information. It is important to consider legal requirements for records retention when disposing of IT systems. The removal of information from a storage medium (such as a hard disk or tape) is called sanitization. For federal systems. hardware. A distinction can be made between clearing information (rendering it unrecoverable by keyboard attack) and purging (rendering information unrecoverable against laboratory attack). The following items should be considered during this phase: Information. system management officials should consult with their agency office responsible for retaining and archiving federal records. Media Sanitization. consider the method for retrieving the information in the future. discarded. and destruction. degaussing (for magnetic media only). archived. 26 . There are three general methods of purging media: overwriting. When archiving information. Information may be moved to another system. Different kinds of sanitization provide different levels of protection. Measures may also have to be taken for the future use of data that has been encrypted. such as taking appropriate steps to ensure the secure long-term storage of cryptographic keys. the technology used to create the records may not be readily available in the future. or destroyed.4.Principles and Practices for Securing IT Systems 3. While electronic information is generally easier to retrieve and store.

for example.5. no single individual should normally be given authority to issue checks. There are two general security rules to apply when granting access: separation of duties and least privilege. Data entry clerks. Rather. The responsible manager should determine the position sensitivity. 3. A broad range of security issues relate to how these individuals interact with computers and the access and authorities they need to do their job. the responsible supervisor should determine the type of computer access needed for the position. Separation of duties refers to dividing roles and responsibilities so that a single individual cannot subvert a critical process. Early in the process of defining a position. No IT system can be secured without properly addressing these security issues.5 Personnel/User Issues Many important issues in computer security involve users.1 Staffing An organization's staffing process should generally involve at least the following four steps which apply equally to general users as well as to application managers. Least privilege refers to the security objective of granting users only those accesses they need to perform their official duties. so that appropriate costeffective screening can be completed. designers. and managers. based on the duties and access levels.Principles and Practices for Securing IT Systems 3. security issues should be identified and addressed. Determining Position Sensitivity. system management personnel. may not have any need to run analysis reports of their database. one person initiates a request for a payment and another authorizes that same payment. 27 . and security personnel: Position Definition. For example. implementors. Once a position has been broadly defined. in financial systems.

rather than relying on screening to reduce the risk to the organization. (2) tracking users and their respective access authorizations. Detecting Unauthorized/Illegal Activities.2 User Administration Organizations should ensure effective administration of users' computer access to maintain system security. These reviews can be conducted on at least two levels: (1) on an application-by-application basis. conformity with the concept of least privilege. Mechanisms besides auditing and analysis of audit trails should be used to detect unauthorized and illegal acts. Audit and Management Reviews. The following should be considered: User Account Management. and closing user accounts. it is more effective to use separation of duties and least privilege to limit the sensitivity of the position. establishing. In general. whether management authorizations are up-to-date. or (2) on a system wide basis. Employees should be trained in the computer security responsibilities and duties associated with their jobs. 3. or periodic rescreening of personnel are methods that can be used. Organizations should have a process for (1) requesting. issuing. including user account management.5. Background screening helps determine whether a particular individual is suitable for a given position. whether all accounts are still active. and (3) managing these functions. auditing and the timely modification or removal of access. 28 . and so forth. which could expose a scam that required an employee’s presence. Rotating employees in sensitive positions. It is necessary to periodically review user account management on a system. Employee Training and Awareness.Principles and Practices for Securing IT Systems Screening. whether required training has been completed. Reviews should examine the levels of access each individual has.

system access should be removed at the same time (or just before) the employees are notified of their dismissal. In both the manual and the electronic worlds. and how are they backed up. the availability of cryptographic keys to management personnel must be ensured. Friendly terminations should be accomplished by implementing a standard set of procedures for outgoing or transferring employees. this may involve documenting procedures or filing schemes. computer accounts. When an employee notifies an organization of a resignation and it can be reasonably expected that it is on unfriendly terms. Employees should be instructed whether or not to "clean up" their PC before leaving. Unfriendly Termination. This normally includes: removal of access privileges. return of property. authentication tokens. organizations should do the following: System access should be terminated as quickly as possible when an employee is leaving a position under less than friendly terms. such as how documents are stored on the hard disk. the control of keys. If cryptography is used to protect data. If employees are to be fired. the briefing on the continuing responsibilities for confidentiality and privacy.Principles and Practices for Securing IT Systems Friendly Termination. system access should be immediately terminated. Given the potential for adverse consequences. 29 . and continued availability of data.

- In some cases. 30 . This may be particularly true for employees capable of changing programs or modifying the system or applications. physical removal from the offices may be necessary.Principles and Practices for Securing IT Systems - During the "notice of termination" period. it may be necessary to assign the individual to a restricted area and function.

If appropriate priorities have been set (and approved by senior management). This broad perspective on contingency planning is based on the distribution of computer support throughout an organization.1 Business Plan An organization should identify mission.6. 31 . Identify Functions and Priorities. The business plan should identify functions and set priorities for them. 3. The identification of resources should cross managers' areas of responsibility. Overlap of Areas. certain functions will not be performed. Organizations should practice contingency planning because it makes good business sense.6. Contingency planning should address all the resources needed to perform a function. it could mean the difference in the organization's ability to survive a disaster. Analyze Resources Needed.Principles and Practices for Securing IT Systems 3. Contingency planning addresses how to keep an organization's critical functions operating in the event of disruptions. both large and small. The analysis of needed resources should be conducted by those who understand how the function is performed and the interdependencies among various resources. The identification of critical functions is often called a business plan. This allows an organization to assign priorities to resources since not all elements are crucial to the critical functions.or business-critical functions.2 Identify Resources An organization should identify the resources that support critical functions. The following six steps describe the basic functions an organization should employ when developing contingency plans. In the event of a disaster.6 Preparing for Contingencies and Disasters Contingency planning directly supports an organization's goal of continued operations. 3.

as well as research. imagination and creativity. contingencies. but less obvious.g. Scenarios should include small and large contingencies. The development of scenarios should help an organization develop a plan to address the wide range of things that can go wrong. mainframes.4 Develop Strategies The selection of a contingency planning strategy should be based on practical considerations. and the effect on the mission or business of the continued unavailability of the resource. Although it is impossible to think of all the things that can go wrong. 3.g.. legal documents) Time Frame Needed. telecommunications. The following items should be considered: Identify Possible Scenarios.3 Develop Scenarios An organization should anticipate potential contingencies or disasters. can point to other possible.6. The following is a list of resources used by most organizations: People Processing Capability (e. an organization should identify a likely range of problems.6.g. personal computers) Computer-Based Services (e. an organization should identify the time frames in which each resource is used (e. Risk assessment can be used to help estimate the cost of options 32 . documentation. including feasibility and cost. In addition.. While some general classes of contingency scenarios are obvious. Address Each Resource. 3.. blank forms. is the resource needed constantly or only at the end of the month?).Principles and Practices for Securing IT Systems Common Resources Used. The contingency scenarios should address each of the resources listed above. world wide web) Data and Applications Physical Infrastructure Documents and Papers (e.g..

Plan the steps that are taken to continue support for critical functions. the longer the organization will have to operate in the recovery mode. The longer it takes to resume normal operations. Resumption. A contingency plan should be tested periodically because there will undoubtedly be flaws in the plan and its implementation. considering the likelihood of losing electrical power for various lengths of time? Whether the strategy is on-site or off-site. Document the initial actions taken to protect lives and limit damage. Emergency Response.5 Test and Revise Plan An organization should test and revise the contingency plan. document the procedures. The following items should be considered: Keep Current. a contingency planning strategy normally consists of three parts: emergency response. recovery. For example. Determine what is required in order to return to normal operations. Once the contingency planning strategies have been selected.6. and train employees. Recovery. Responsibility for keeping the contingency plan current should be specifically assigned. Implementation. is it more expensive to purchase and maintain a generator or to move processing to an alternate site. and resumption. Many of these tasks are ongoing. Implement the contingency plan. The extent and frequency of testing will vary between organizations and among systems. 33 . 3. The relationship between recovery and resumption is important. it is necessary to make appropriate preparations. Test. Update the plan since it will become outdated as time passes and as the resources used to support critical functions change.Principles and Practices for Securing IT Systems to decide on an optimal strategy.

either an insider or an outsider. An incident handling capability may be viewed as a component of contingency planning. Prevent Future Damage. The constituency may be external as well as internal. Containing the incident should include an assessment of whether the incident is part of a targeted attack on the organization or an isolated incident. or a system intruder. Incident handling can be considered that portion of contingency planning that responds to malicious technical threats. Incidents can be studied internally to gain a better understanding of the organization's threats and vulnerabilities. Contain and Repair Damage From Incidents. An incident handling capability should assist an organization in preventing (or at least minimizing) damage from future incidents. because it provides the ability to react quickly and efficiently to disruptions in normal processing.2 Characteristics An incident handling capability should have the following characteristics: Understanding of the Constituency It Will Serve. 3.1 Uses of a Capability An organization should address computer security incidents by developing an incident handling capability. depending on the technology and its connectivity. malicious software can significantly harm an organization's computing. 3. The definition of a computer security incident is somewhat flexible and may vary by organization and computing environment. The incident handling capability should be used to: Provide Ability to Respond Quickly and Effectively. other malicious code.7.7 Computer Security Incident Handling A computer security incident can result from a computer virus.Principles and Practices for Securing IT Systems 3. When left unchecked. An incident that affects an organization may also affect its trading 34 .7.

Expertise in the Requisite Technologies. Intruder activity. therefore.g. Technical capabilities (e. straightforward fashion without the fear of attribution. Centralized Communications.. Through training and awareness programs. users can become knowledgeable about the existence of the capability and how to recognize and report incidents. who range from system administrators to unskilled users to management to lawenforcement officials. technical. can often affect many systems located at many 35 .. or clients. ready to be used as necessary. help protect the community as a whole. if users are linked together via a network.Principles and Practices for Securing IT Systems partners. For example. Successful incident handling requires that users be able to report incidents to the incident handling team in a convenient. In addition. legal. Ability to Communicate Effectively. public affairs. Users trust in the value of the service will build with reliable performance. This includes communicating with different types of users. A centralized communications point is very useful for accessing or distributing information relevant to the incident handling effort.g. contractors. Users need to know about. Other groups assist in incident handling (as needed). Links to Other Groups. Educated Constituency. and trust the incident handling capability or it will not be used. accept. the incident handling capability can then use the network to send out timely announcements and other information. An incident handling capability should provide a way for users to report incidents. both external and internal with other supportive sources (e. The organization should have already made important contacts. trained personnel and virus identification software) should be prepositioned. managerial and state and local law enforcement) to aid in containment and recovery efforts. whether hackers or malicious code. The technical staff members who comprise the incident handling capability need specific knowledge. an organization's computer security incident handling capability may be able to help other organizations and.

handling the incidents can be logistically complex and can require information from outside the organization. 36 . thereby containing and minimizing damage. such contacts can be preestablished and the speed of response improved.Principles and Practices for Securing IT Systems different network sites. By planning ahead.

Not everyone needs the same degree or type of computer security information to do their jobs. and techniques. principles. implementation. a computer security awareness and training program should encompass the following seven steps: Identify Program Scope. It is important that trainers have sufficient knowledge of computer security issues. Administer the Program. Goals. and periodic evaluation. and Objectives. a large organizationwide program needs to be supplemented by more system-specific programs. topics.8 Awareness and Training An effective computer security awareness and training program requires proper planning. Several important considerations for administering the program include visibility. selection of appropriate training methods. and omits irrelevant information will have the best results. Consider using motivational techniques to show management and employees how their participation in a computer security and awareness program will benefit the organization. In general. Identify Target Audiences. Identify Training Staff. Motivate Management and Employees. The scope of the program should provide training to all types of people who interact with IT systems. 37 . it is important to gain the support of management and employees. A computer security awareness and training program that distinguishes between groups of people. and presentation techniques. To successfully implement an awareness and training program. materials. Since users need training which relates directly to their use of particular systems.Principles and Practices for Securing IT Systems 3. presents only the information needed by the particular audience. maintenance. It is also vital that they know how to communicate information and ideas effectively.

A training program that meets an organization's needs today may become ineffective when the organization starts to use a new application or changes its environment. and general attitudes toward computer security. Evaluate the Program. Efforts should be made to keep abreast of changes in computer technology and security requirements. An evaluation should attempt to ascertain how much information is retained. such as by connecting to the Internet. to what extent computer security procedures are being followed.Principles and Practices for Securing IT Systems Maintain the Program. 38 .

g. Computer security system literature includes many examples of how organizations undermined their often expensive security measures because of poor documentation. an organization may audit systems for illegal copies of copyrighted software. a significant weakness. In general. Software Support. Controls should be placed on system software commensurate with the risk.. Failure to consider security as part of the support and operations of IT systems is. for many organizations. or other shoddy practices. 39 . Support staff need to be able to identify security problems. The following practices are what an organization's support and operation should include: User Support. or software that may subvert or bypass security controls. The controls should include: policies for loading and executing new software on a system. license management. This involves the protection of software and backup copies and can be done with a combination of logical and physical access controls. use of powerful system utilities. System utilities can compromise the integrity of operating systems and logical access controls. system support and operations staff should provide assistance to users such as with a help desk. and inform appropriate individuals. unexpected software interactions.9 Security Considerations in Computer Support and Operations Computer support and operations refers to system administration and tasks external to the system that support its operation (e. no control of maintenance accounts.Principles and Practices for Securing IT Systems 3. maintaining documentation). Software should be properly licensed and organizations should take steps to ensure that no illegal software is being used. authorization of system changes. Executing new software can lead to viruses. For example. respond appropriately.

The extent of media control depends upon many factors. Program managers should be consulted to determine what backup schedule is appropriate. If a system has a maintenance account. and other media. Backup copies should be tested to ensure they are usable. Backups. the system should display a banner warning that use of the system is restricted to authorized people. then a security vulnerability is introduced. including the type of data. printouts. authentication of the maintenance provider should be made. it is critical to change factory-set passwords or otherwise disable the accounts until they are needed. If maintenance is to be performed remotely. The goal is to know how changes will affect system security. Backups should be stored securely. All aspects of computer support and operations should be documented to ensure continuity and consistency. the quantity of media. Frequency of backups will depend upon how often data changes and how important those changes are. Procedures should be developed to ensure that only authorized personnel perform maintenance. Media Controls. The security of a system also needs to be documented. including security plans. and the nature of the user environment. Documentation. Prior to user authentication. diskettes. Security documentation should be designed to fulfill the needs of the different types of people who use it. and security policies and procedures. Maintenance. Standardized Log-on Banner. Configuration management should ensure that changes to the system do not unintentionally or unknowingly diminish security. If someone who does not normally have access to the system performs maintenance. A variety of measures such as marking and logging. 40 . It is critical to back up software and data. should be used to provide physical and environmental protection and accountability for tapes.Principles and Practices for Securing IT Systems Configuration Management. contingency plans.

Fire Safety Factors. and theft. heating and air-conditioning systems. Physical access controls should address not only the area containing system hardware. it is important to evaluate the fire safety of buildings that house systems. Smoke. Failure of Supporting Utilities. and any other elements required for the system's operation. Physical access controls restrict the entry and exit of personnel (and often equipment and media) from an area. and high humidity from a localized fire can damage systems throughout an entire building. but also locations of wiring used to connect elements of the system. and the facilities used to support their operation. It is important to review the effectiveness of physical access controls in each area. such as an office building. both during normal business hours and at other times -.Principles and Practices for Securing IT Systems 3. loss of control over system integrity. physical damage. and other utilities will 41 . or room containing a local area network (LAN ) server. failures of electric power. it can help prevent interruptions in computer services. Building fires are a particularly important security threat because of the potential for complete destruction of both hardware and data. supporting services (such as electric power). the risk to human life. water. backup media. Consequently. unauthorized disclosure of information. Physical Access Controls. data center. Systems and the people who operate them need to have a reasonably well-controlled operating environment. suite. In doing so. the system resources themselves. and the pervasiveness of the damage. corrosive gases.particularly when an area may be unoccupied.10 Physical and Environmental Security Physical and environmental security controls are implemented to protect the facility housing system resources. Consequently. sewage. An organization's physical and environmental security program should address the following seven topics.

Encrypt data files on stored media. or a fire that weakens structural members. 42 . The analysis and management of risk usually has to be modified if a system is installed in a vehicle or is portable. when cost-effective. moving hardware. such as a laptop computer. Interception of Data. Plumbing Leaks.Principles and Practices for Securing IT Systems usually cause a service interruption and may damage hardware. as a precaution against disclosure of information if a laptop computer is lost or stolen. they can be seriously disruptive. as well as regional and local risks. The system in a vehicle will share the risks of the vehicle. function properly. Organizations should use: Secure storage of laptop computers when they are not in use. An organization should know the location of plumbing lines that might endanger system hardware and take steps to reduce risk (e.g.. Mobile and Portable Systems. and electromagnetic interception. and identifying shutoff valves) . Organizations should be aware that a building may be subjected to a load greater than it can support. there may be a significant risk if the data is intercepted. Depending on the type of data a system processes. Structural Collapse. including their many elements. While plumbing leaks do not occur every day. an explosion that displaces or cuts structural members. relocating plumbing lines. Most commonly this is a result of an earthquake. Organizations should be aware that there are three routes of data interception: direct observation. interception of data transmission. Organizations should ensure that these utilities. including accidents and theft. a snow load on the roof beyond design criteria.

6 Identification and Authentication is a technical measure that prevents unauthorized people (or unauthorized processes) from entering an IT system. which refers to the granting to users of only those accesses minimally required to perform their duties. 3 months) should be disabled. Access control usually requires that the system be able to identify and differentiate among users. The following should be considered when using user IDs: Unique Identification.Principles and Practices for Securing IT Systems 3. 6 Not all types of access control require identification and authentication. Correlate Actions to Users. For example. access control is often based on least privilege. An organization should require users to identify themselves uniquely before being allowed to perform any actions on the system unless user anonymity or other factors dictate otherwise. User IDs that are inactive on the system for a specific period of time (e. An organization should ensure that all user IDs belong to currently authorized users. (See audit trails below.1 Identification Identification is the means by which a user provides a claimed identity to the system.11. The most common form of identification is the user ID. 3. therefore. Identification data must be kept current by adding new users and deleting former users. The system should internally maintain the identity of all active users and be able to link actions to specific users. requires the system to identify users. Inactive User IDs.) Maintenance of User IDs.g. User accountability requires the linking of activities on an IT system to specific individuals and. 43 ..11 Identification and Authentication Identification and Authentication is a critical building block of computer security since it is the basis for most types of access control and for establishing user accountability.

handwriting dynamics. is transmitted to an IT system. 44 . This requires the user to authenticate themselves only once and then be able to access a wide variety of applications and data available on local and remote systems. There are three means of authenticating a user's identity which can be used alone or in combination: something the individual knows (a secret -.g. characteristics such as a voice pattern.2 Authentication Authentication is the means of establishing the validity of this claim. This helps to prevent guessing of authentication data. The following should be considered: Require Users to Authenticate. or a fingerprint). including system administrators. Many operating systems can be configured to lock a user ID after a set number of failed log-on attempts. Secure Transmission of Authentication Data.g. an ATM card or a smart card). It may be desirable for users to authenticate themselves with a single log-in. something the individual possesses (a token -. it can be electronically monitored. Authentication data should be protected with access controls and one-way encryption to prevent unauthorized individuals. Personal Identification Number (PIN).. An organization should require users to authenticate their claimed identities on IT systems.e. or cryptographic key)..e.g.Principles and Practices for Securing IT Systems 3. Organizations should limit the number of log-on attempts. the ciphertext becomes the password.. such as a password.e. This can happen on the network used to transmit the password or on the IT system itself. Simple encryption of a password that will be used again does not solve this problem because encrypting the same password will create the same ciphertext.11. Restrict Access to Authentication Data. An organization should protect authentication data transmitted over public or shared data networks. and something the individual is (a biometric -. Limit Log-on Attempts. a password. When authentication data. An organization should restrict access to authentication data. or hackers from obtaining the data.

Why it is Used. not being in an online dictionary. organizations should: Specify Required Attributes.Principles and Practices for Securing IT Systems Secure Authentication Data as it is Entered. Secure password attributes such as a minimum length of six.4 Advanced Authentication Advanced authentication.11. physical protection of tokens is also required. Change Frequently. Organizations should carefully administer authentication data and tokens including procedures to disable lost or stolen passwords or tokens and monitoring systems to look for stolen or shared accounts. not to divulge their passwords. users should be told why this type of authentication is being used. In the use of the authentication system including secrecy of PINs.3 Passwords If passwords are used for authentication. and being unrelated to the user ID should be specified and required. including suppressing the display of the password as it is entered and orienting keyboards away from view. Passwords should be changed periodically. Organizations should protect authentication data as it is entered into the IT system. If used. 45 . To help decrease possible user dissatisfaction. generally requires more administrative overhead than passwords. Train Users. and not to store passwords where others can find them. 3. Administer Data Properly. inclusion of special characters. Teach users not to use easy-to-guess passwords. or cryptographic keys.11. organizations should train users in the following: How to Use. 3. passwords. such as a challenge-response system.

Logical access controls can prescribe not only who or what (e. in the case of a process) is to have access to a specific system resource but also the type of access that is permitted. users can be restricted based upon network addresses (e. subsystem.g. Location. Logical access controls are the system-based means by which the ability is explicitly enabled or restricted in some way.12. but it can be a group identification or even anonymous.Principles and Practices for Securing IT Systems 3. Roles. organizations should base access control policy on the principle of least privilege. or group of systems.e. 46 . or view). The process of defining roles should be based on a thorough analysis of how an organization operates and should include input from a wide spectrum of users in an organization. users from sites within a given organization may be permitted greater access than those from outside). operational requirements.. 3.1 Access Criteria Organizations should control access to resources based on the following access criteria. the role) of the user who is seeking access. Organizations should implement logical access control based on policy made by a management official responsible for a particular system.. The identity is usually unique in order to support individual accountability.g.. and user-friendliness. In general. Similarly. use.12 Logical Access Control Access is the ability to do something with a computer resource (e. Access to particular system resources may be based upon physical or logical location. Access to information may also be controlled by the job assignment or function (i. application. which states that users should be granted access only to the resources they need to perform their official functions. The policy should balance the often-competing interests of security. change. as appropriate: Identity (user ID)..g.

include read. Another criteria can be used by organizations handling transactions. Time-of-day and day-of-week/month restrictions are another type of limitation on access. an ATM machine may restrict transfers of money between accounts to certain dollar limits or may limit maximum ATM withdrawals to $500 per day. Service Constraints. For example. When setting up access controls. Common access modes. External access controls are a means of controlling interactions between the system and outside people. or access modes. execute. Another type of service constraint is based upon application content or numerical thresholds. and delete. For example. write. Access would be denied for a sixth user.12. Other specialized access modes (more often found in applications) include create or search. these criteria can be used in conjunction with one another. which can be used in both operating or application systems. Organizations should consider the types of access. A service representative would be given read access to that account.g. in an account inquiry a caller would enter an account number and pin. access to a particular account could be granted only for the duration of a transaction. use of confidential personnel files may be allowed only during normal working hours..Principles and Practices for Securing IT Systems Time. 3. organizations should consider the following mechanisms: 47 . The concept of access modes is fundamental to access control. Of course. For example. systems. When completed. Access Modes. even if the user were otherwise authorized to use the application. For example. a particular software package may be licensed by the organization for only five users at a time. Transaction. Internal access controls are a logical means of separating what defined users (or user groups) can or cannot do with system resources. This means that users have no choice in the accounts to which they have access.2 Access Control Mechanisms An organization should consider both internal and external access control mechanisms. the access authorization is terminated. Service constraints refer to those restrictions that depend upon the parameters that may arise during use of the application or that are preestablished by the resource owner/manager. e. and services.

Principles and Practices for Securing IT Systems Access control lists (ACLs). Port Protection Devices. machines. Fitted to a communications port of a host computer. processes) who have been given permission to use a particular system resource and the types of access they have been permitted.g. Many network applications in use today use host-based authentication to determine whether access is allowed.. it is accompanied by the need for strong key management. Access to specific functions are restricted by never allowing users to request information. Encrypted information can only be decrypted. Host-based authentication grants access based upon the identity of the host originating the request. Secure gateways block or filter access between two networks. database views. While encryption can provide strong access control. instead of the identity of the user making the request. a port protection device (PPD) authorizes access to the port itself. especially if the masquerading host is physically located close to the host being impersonated. Three major types exist: menus. Secure gateways allow internal users to connect to external networks while protecting internal systems from compromise. ACLs are a register of users (including groups. e. more public network such as the Internet. Secure Gateways/Firewalls. by those possessing the appropriate cryptographic key. This includes implementing. testing. modifying. Under certain circumstances. Organizations should carefully administer access control. Host-Based Authentication. monitoring. and therefore read. it is fairly easy to masquerade as the legitimate host. 48 . an ATM. often between a private network and a larger. functions. and physically constrained user interface. Constrained User Interfaces. often based on a separate authentication (such as a dial-back modem) independent of the computer's own access control functions. or other resources for which they do not have access. and terminating user accesses on the system. Encryption.

which. Password-based access controls for PC applications are often easy to circumvent if the user has access to the operating system (and knowledge of what to do). 49 . if written down or poorly chosen. users may find it difficult to remember additional application passwords. Password-based access control is often inexpensive because it is already included in a large variety of applications.Principles and Practices for Securing IT Systems Organizations should avoid using passwords as a means of access control which can result in a proliferation of passwords that can reduce overall security. can lead to their compromise. However.

including individual accountability. audit trails can provide a means to help accomplish several security-related objectives. While users cannot be prevented from using resources to which they have legitimate access authorization. they can assist in intrusion detection. Defining the scope and contents of the audit trail should be done carefully to balance security needs with possible performance. Reconstruction of Events. an event record should specify: 50 . or other costs. when. Audit trails should be used for the following: Individual Accountability. If audit trails have been designed and implemented to record appropriate information. Intrusions can be detected in real time. In general. by examining audit records as they are created or after the fact. Intrusion Detection. In conjunction with appropriate tools and procedures.1 Contents of Audit Trail Records An audit trail should include sufficient information to establish what events occurred and who (or what) caused them.13 Audit Trails Audit trails maintain a record of system activity by system or application processes and by user activity. audit trail analysis can be used to examine their actions.Principles and Practices for Securing IT Systems 3.13. The audit trail supports accountability by providing a trace of user actions. An organization should use audit trails to support after-thefact investigations of how. Audit trails may also be used as online tools to help identify problems other than intrusions as they occur. by examining audit records in a batch process. Problem Identification. intrusion detection. and problem identification. reconstruction of events. privacy. and why normal operations ceased. 3. This is often referred to as real-time auditing or monitoring.

Organizations should strive for separation of duties between security personnel who administer the access control function and those who administer the audit trail. Reviewers should know what to look for to be effective in spotting unusual activity.and applicationspecific security-relevant events. 51 . The time and day the event occurred should be listed. Protect Confidentiality. 3. and organization. such as failed user authentication attempts. User ID Associated With the Event. for example.3 Audit Trail Reviews Audit trails should be reviewed periodically. The following should be considered when reviewing audit trails: Recognize Normal Activity. The type of event and its result. The confidentiality of audit trail information also needs to be protected if. The following precautions should be taken: Control Online Audit Logs. Separation of Duties. When the Event Occurred.13. changes to users' security information.2 Audit Trail Security Organizations should protect the audit trail from unauthorized access. it records personal information about users. They need to understand what normal activity looks like. Access to online audit logs should be strictly controlled. Program or Command Used to Initiate the Event.Principles and Practices for Securing IT Systems Type of Event.13. 3.

or some unexplained system or user problem. Audit trail review can be easier if the audit trail function can be queried by user ID.Principles and Practices for Securing IT Systems Contain a Search Capability. Follow-up Reviews. Application owners. Organizations should use the many types of tools that have been developed to help reduce the amount of information contained in audit records. The Department of Justice has advised that an ambiguity in U.g. The appropriate system-level or application-level administrator should review the audit trails following a known system or application software problem. or some other set of parameters to run reports of selected information. Keystroke monitoring is usually considered a special case of audit trails. attack signature.. daily). or near real-time fashion. If keystroke monitoring is used in audit trails. can be used in a real-time. organizations should: Have Written Policy. date and time. should be developed.S. 52 . 3. a known violation of existing requirements by a user. Automated Tools. and variance techniques. and computer security managers should determine how much review of audit trail records is necessary. Develop Review Guidelines.4 Keystroke Monitoring Keystroke monitoring is the process used to view or record both the keystrokes entered by a computer user and the computer's response during an interactive session. as well as to distill useful information from the raw data. audit trails are analyzed in a batch mode at regular intervals (e. based on the importance of identifying unauthorized activities. application name. A policy. such as those based on audit reduction. law makes it unclear whether keystroke monitoring is considered equivalent to an unauthorized telephone wiretap. Traditionally. terminal ID. Audit analysis tools. system administrators. data processing function managers. data owners.13. in concert with appropriate legal counsel.

53 .Principles and Practices for Securing IT Systems Notify Users. Inform users if keystroke monitoring may take place.

14 Cryptography Cryptography is a branch of mathematics based on the transformation of data. This module contains the cryptographic algorithm(s). firmware. Cryptography can be implemented in either hardware or software. The trade-offs among security. each standard should be carefully analyzed to determine if it is applicable to the organization and the desired application. Several important issues should be considered when designing. Select Design and Implementation Standards. cost. and archiving of cryptographic keys. Key management involves the procedures and protocols. modern cryptography can be used to provide many security services. It provides an important tool for protecting information and is used in many aspects of computer security. each has related costs and benefits. Their selection should be based on cost-effectiveness analysis. Managers and users of IT systems must select among various standards when deciding to use cryptography. and integrating cryptography in an IT system. implementing. Decide on Hardware vs. Cryptography is typically implemented in a module of software. and ease of implementation need to be studied by managers acquiring various security products. However. certain control parameters. and use of the cryptographic module. entry. Secure Cryptographic Modules.Principles and Practices for Securing IT Systems 3. 54 . simplicity. In addition. and temporary storage facilities for the key(s) being used by the algorithm(s). distribution. such as electronic signatures and ensuring that data has not been modified. and interoperability requirements. destruction. trends in the standard's acceptance. and secret keys and private keys need protection against unauthorized disclosure. This includes protecting the module against tampering. storage. hardware. both manual and automated. efficiency. use. used throughout the entire life cycle of the keys. Cryptography is traditionally associated only with keeping data secret. implementation. All keys need to be protected against modification. Software Implementations. Manage Keys. The proper functioning of cryptography requires the secure design. or some combination thereof. This includes the generation.

S. cryptography is a rapidly changing field. Questions concerning the export of a particular implementation should be addressed to appropriate legal counsel. 55 . since they consider multiple factors. In addition. Users must be aware that the U. The rules governing export can be quite complex. Government controls the export of cryptographic implementations.Principles and Practices for Securing IT Systems Comply with Export Rules. and rules may change from time to time.

1992 Privacy Working Group. Washington. Information Infrastructure Task Force. June 6.Principles and Practices for Securing IT Systems 4. National Academy Press. Information Policy Committee. An Introduction to Computer Security: The NIST Handbook. Paris. 1995. Privacy and the National Information Infrastructure: Principles for Providing and Using Personal Information. The Quest for Generally Accepted System Security Principles (GSSP). 1995 56 . National Institute of Standards and Technology. Minimum Security Requirements for MultiUser Operating Systems. Delran NJ. A Code of Practice for Information Security. National Research Council. British Standard 7799. 1991 Organization for Economic Co-operation and Development. Special Publication 800-12. References British Standards Institution. DC. NISTIR 5153. Computers at Risk: Safe Computing in the Information Age. October 1994 National Institute of Standards and Technology. 1995 Datapro. Guidelines for the Security of Information Systems. March 1993.

Principles and Practices for Securing IT Systems 57 .

Sign up to vote on this title
UsefulNot useful