Domain Name System (DNS) – Application Layer Protocol

Introduction:

Domain Name System (DNS) – An Application Layer Protocol for Efficient Name Resolution

The Domain Name System (DNS) is an application-layer protocol that plays a crucial role in the functioning of the World Wide Web (WWW) and other internet services. It enables the translation of human-readable domain names, such as www.zymitry.com, into machine-readable IP addresses. In addition to the World Wide Web, DNS is essential for enabling services such as email, file transfers, and other internet applications. By using DNS, users can navigate the internet using alphanumeric names instead of relying on IP addresses. DNS is an integral part of the application layer protocols, defining how applications on different systems communicate with each other.

Domain Name System and Application Layer Protocols:

An application-layer protocol defines how applications on different systems communicate with each other. In the case of DNS, it specifies the types of messages exchanged, their syntax, the information conveyed, and the rules for sending and responding to these messages. DNS is critical for efficient name resolution and is essential for web browsing, email services, file transfers, and various other applications.

DNS Hierarchical Structure and Name Resolution:

The Domain Name System follows a hierarchical structure that starts with thirteen root servers distributed worldwide. These root servers maintain a database of Top Level Domain (TLD) servers, such as .com, .edu, .net, and .org. The TLD servers, in turn, store information about Authoritative DNS servers, which manage databases of actual host names and their corresponding IP addresses. This hierarchical structure enables efficient and accurate name resolution.

Domain Name System Resource Records (RR):

DNS uses resource records (RR) to store mappings between host names and IP addresses. Each record consists of four fields: Name, Value, Type, and Time To Live (TTL). The Name and Value fields vary based on the record type. For example, an “A” record directly translates a host name to an IP address. Other record types include Name Server (NS) records for resolving DNS server names, Mail Server (MX) records for mail server resolution, and Canonical Name (CNAME) records for mapping IP addresses to host alias names.

DNS Messaging and Protocols:

DNS messages are sent and received over User Datagram Protocol (UDP) port 53. UDP is a lightweight, connectionless protocol used for fast transmission of DNS messages. While UDP does not guarantee message delivery, it is widely used due to its efficiency. TCP port 53 can also be used if UDP is not available, especially in IPv6 environments.

DNS Caching:

DNS caching is a mechanism used to improve DNS lookup efficiency and reduce network traffic. When a DNS resolver receives a DNS response, it stores the mapping between a domain name and its corresponding IP address in its cache. Subsequent requests for the same domain name can be resolved from the cache, eliminating the need for repeated queries to authoritative DNS servers. Caching occurs at different levels, including local DNS resolvers, ISP DNS servers, and web browser caches, helping to speed up the overall DNS resolution process. For example, a local DNS resolver can store frequently accessed domain name-to-IP mappings in its cache, reducing the latency and network traffic associated with querying external DNS servers.

DNS Security:

DNS security is of utmost importance due to the risks associated with DNS spoofing and cache poisoning. DNS spoofing involves falsifying DNS data to redirect users to malicious websites, while cache poisoning involves injecting false information into DNS caches. These attacks can lead to DNS spoofing, where users are directed to deceptive or harmful destinations. To address these risks, DNSSEC (DNS Security Extensions) was introduced. DNSSEC uses digital signatures to verify the authenticity and integrity of DNS responses, providing an additional layer of security and ensuring that users are directed to legitimate and trusted resources.

DNS Load Balancing and Redundancy:

DNS can be used for load balancing by distributing traffic across multiple servers. This helps optimize performance, improve response times, and ensure high availability of services. Various strategies, such as round-robin DNS, geoDNS, and Anycast routing, can be employed to achieve load balancing. Round-robin DNS rotates the order of IP addresses in DNS responses, distributing the load evenly. GeoDNS considers the geographic location of clients and directs them to the nearest server, reducing latency. Anycast routing involves using the same IP address for multiple servers located in different geographic locations, improving scalability and ensuring efficient load distribution. Load balancing provides benefits such as improved scalability, fault tolerance, and optimized resource utilization.

DNS Privacy and Anonymity:

Emerging concerns regarding DNS privacy highlight the need to protect user data and prevent unauthorized access. DNS queries traditionally transmitted in clear text can be intercepted and monitored, compromising privacy. The motivation behind DNS privacy concerns includes protecting user browsing habits, preventing surveillance, and combating censorship. To address these concerns, DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) have been introduced. DoH encrypts DNS queries using the HTTPS protocol, while DoT uses the Transport Layer Security (TLS) protocol. Both mechanisms ensure that DNS queries remain confidential and protected from interception, enhancing privacy and anonymity for users.

Conclusion:

The Domain Name System (DNS) is a critical application-layer protocol that enables the translation of domain names to IP addresses, facilitating seamless internet navigation. Understanding DNS, its hierarchical structure, resource records, and messaging protocols is crucial for managing and optimizing network resources. Moreover, considering enhancements such as caching, security measures, load balancing, and privacy mechanisms further enhances the reliability, performance, and security of DNS in modern network environments.

References

G. Palmer Security Notes (2015-2023)

Gonyea, C. (2010, August 25). DNS: Why It’s Important and How It Works. Retrieved July 5, 2017, from http://dyn.com/blog/dns-why-its-important-how-it-works/.

Hogg, S. (2010, August 22). Allow Both TCP and UDP Port 53 to Your DNS Servers. Retrieved July 5, 2017, from http://www.networkworld.com/article/2231682/cisco-subnet/cisco-subnet-allow-both-tcp-and-udp-port-53-to-your-dns-servers.html.

Kurose, J. F., & Ross, K. W. (2017). Computer networking: a top-down approach (7th ed.). Hoboken, NJ: Pearson.

TechNet DNS. (n.d.). Network Ports Used by DNS. Retrieved July 5, 2017, from Domain Name System (DNS) – An Application Layer Protocol for Efficient Name Resolution. https://technet.microsoft.com/en-us/library/dd197515(v=ws.10).aspx.

Related Articles and Content

Exploring the Implications of Artificial Intelligence

Artificial Intelligence in Texas Higher Education: Ethical Considerations, Privacy, and Security

Understanding Business Continuity Planning

Fortinet: What Is DNS (Domain Name System)?

What is DNS? | How DNS works

Definition,  domain name system (DNS)

Amazon: What is DNS?

Application Layer Protocol

What is the DNS Layer and How Do I Secure It?

Javapoint: DNS

Note: This article has been revised and improved with the assistance of AI, incorporating ChatGTP suggestions and revisions to enhance clarity and coherence. The original research, decision-making, and final content selection were performed by a human author.

Disclaimer

Terms and Conditions of Use

The post Domain Name System (DNS) – Application Layer Protocol appeared first on .

IDS / IDPS Detection Methods: Anomaly, Signature, and Stateful Protocol Analysis

Updated June 19, 2023

Introduction:

References:

G. Palmer Security Notes (2017-2023)

Cepheli, O., Buyukcorak, S., & Kurt, G. K. (2016). Hybrid Intrusion Detection System for DDoS Attacks. International Conference on Intelligent Computing, Communication & Convergence (ICCC-2014). Retrieved from https://www.hindawi.com/journals/jece/2016/1075648/

Ja, J., & Muthukumar, B. (2015). Intrusion Detection System (IDS): Anomaly Detection using Outlier Detection Approach. International Conference on Intelligent Computing, Communication & Convergence (ICCC-2014). Retrieved June 16, 2023 from https://www.sciencedirect.com/science/article/pii/S1877050915007000

Weaver, R., Weaver, D., Farwood, D., & Weaver, R. (2012). Guide to Network Defense and Countermeasures (3rd ed.). Boston, MA: Course Technology, Cengage Learning.

IDPS_Info498. (n.d.). Stateful protocol analysis detection. Retrieved March 28, 2017, from https://sites.google.com/site/idpsinfo498/home/common-detection-methodologies/stateful-protocol.

Related Articles and Content

Exploring the Implications of Artificial Intelligence

Artificial Intelligence in Texas Higher Education: Ethical Considerations, Privacy, and Security

Understanding Business Continuity Planning

https://www.barracuda.com/support/glossary/intrusion-prevention-system

Intrusion Detection Systems

https://www.spiceworks.com/it-security/vulnerability-management/articles/what-is-idps/

Stay Secure Intrusion Detection

IDS / IDPS Detection Methods: Anomaly, Signature, and Stateful Protocol Analysis

Note: This article has been drafted and improved with the assistance of AI, incorporating ChatGTP suggestions and revisions to enhance clarity and coherence. The original research, decision-making, and final content selection were performed by a human author.

This article is for informational purposes only. Terms and conditions of use apply.

Disclaimer

Terms and Conditions of Use

The post IDS / IDPS Detection Methods: Anomaly, Signature, and Stateful Protocol Analysis appeared first on .

The Domain Name System (DNS) is a service used on both the Internet and private networks to translate Internet Protocol (IP) addresses to Fully Qualified Domain Names. Example, this service allows someone to type a FQDN like www.zymitry.com to reach the Zymitry web site instead of having to type in the domains IP address. Regarding security, Domain Name Service provides another method for administrators to control network traffic. Network devices and applications such as firewalls, proxy servers, and web browsers can be used to block unwanted communications based on DNS names. Domain Name Service can be exploited by attackers in several ways to include buffer overflow attacks and DNS cache poisoning.

The following is a list of common DNS threats. These threats are both technical, and non-technical in nature:

• Typosquatting: The practice of registering a domain name that is confusingly similar to an existing popular brand. Recent research has shown that typosquatting is becoming a profound risk to the confidentiality of corporate secrets and should be increasingly thought of as a security problem. Typosquatting is not only about attackers opportunistically registering confusingly similar domains in the hope of benefiting from misdirected Web traffic, it can also be used to steal information. To mitigate against this threat it is recommended for administrators to monitor newly registered domain names against other similar domain names. Information about new domain registrations is often freely available from registries, and there are many companies that offer dedicated digital brand management services.

• Distributed denial of service attacks (DDoS). DDoS is not considered a threat specific to DNS, however, DNS is particularly vulnerable to DDoS attacks because it represents a logical choke point on the network. Recommended DDoS mitigation measures are as follows:
  • Don’t count on a firewall to prevent or stop a DDoS attack. The first step is to recognize that your firewall is insufficient protection against the types of DDoS attacks that are increasingly common today. Firewalls should be considered only one component of a DDoS mitigation strategy.
  • Incorporate DDoS into the organizations Disaster Recovery Plan (DRP) and Business Continuity Plans (BCP). Measure the financial impact of being offline for a period of time.
  • Monitor networks and know how to identify DDoS attacks. Use firewall DDoS detection applications.
  • Know your customers and users, and lock out unexpected transactions.
  • If a DDoS attack occurs, look for fraud, data breaches or other criminal activity.
  • Employ consultants and security professionals that know how to identify and recover from DDoS attacks.

• DNS Amplification Attacks. DNS amplification is a tactic used in DDoS attacks that leverages DNS servers deployed in insecure “recursive” configurations. Recursion is a feature of DNS that allows for domain name resolution to be handed off to more robust name servers. Running a recursive DNS server that is open to the entire Internet is no longer considered acceptable security practice. Securing against this threat is usually achieved with a simple configuration change.

• Registrar Hijacking. Domain names are registered via a registrar company, and these represent single points of failure. If an attacker can compromise your account with your chosen registrar, they gain control over your domain name allowing them to point it to the servers of their choice. To mitigate against hijacking, choose a registrar that follows accepted security authentication or offers additional security precautions such as multi-factor authentication.

• Cache Poisoning. Vulnerabilities in the DNS protocol itself could allow an attacker to inject fraudulent addressing information into DNS caches. Users accessing the cache to visit the targeted site would find themselves instead at a server controlled by the attacker. An attacker can setup this counterfeit site to look like the original and use it to harvest information such as user names and passwords. Mitigation against DNS cache poisoning is often done using the DNSSEC protocol. Once DNSSEC adoption becomes universal, adding a DNSSEC digital signature to a domain name will mean that browsers and ISPs will be able to validate that DNS information they receive is authentic.

References

Mohan, R. (2011, October 05). Five DNS Threats You Should Protect Against. Retrieved May 16, 2018, from http://www.securityweek.com/five-dns-threats-you-should-protect-against.

Musthaler, L. (2013, January 10). Best practices to mitigate DDoS attacks. Retrieved May 16, 2018, from http://www.networkworld.com/article/2162683/infrastructure-management/best-practices-to-mitigate-ddos-attacks.html.

Weaver, R., Weaver, D., Farwood, D., & Weaver, R. (2012). Guide to Network Defense and Countermeasures (3rd ed.). Boston, MA: Course Technology, Cengage Learning.

Disclaimer

The post Domain Name System (DNS) Security Threats appeared first on .

SunSpot Credit Union

Computer Incident Response Team—Access & Authorization Policy

1.0       Policy Statement

This policy applies to SunSpot Credit Union employees, temporary workers, contractors, and consultants who use or access SunSpot Credit Union information systems and computers.

2.0       Purpose/Objectives

Definitions for this policy are as follows:

• SunSpot Credit Union: (SCU).
• Incident Response Team: (IRT). Personnel designated to respond to security incidents.
• Incident Response Policy: (IRP). Establishes Incident Response (IR) procedures for dealing with incidents related to technology and information risk.
• Graham-Leach-Bliley Act: (GLBA).
• Chief Information Office: (CIO).
• Information Security Officer: (ISO).

This document establishes IRT membership, roles, responsibilities, and authority. IRT members and their authority are as follows:

• Information Security Officer (ISO): IRT team leader with authority over all SCU information systems in the event of a security incident. The ISO has the authority to perform any legal action necessary to protect SCU resources and private information, and customer personal and financial information.
• Senior System Administrator: overall responsible for monitoring internal systems and configurations. Designated by the ISO authority to change configurations and take actions as required to protect SCU information resources and customer private and financial information in the event of a security incident. Has the authority to represent and communicate with law enforcement.
• Network Administrator. Works closely with the Senior Systems Administrator. Granted the authority to take networks and systems offline if required to protect SCU information systems, and customer private and financial information.
• Human Resources Director: Granted the authority manage staff regulation and law related matters that may result from a security incident.
• Public Relations Director: Granted the authority to communicate with news and other public entities, stockholders, and other non-legal entities as dictated by the ISO.
• Law Firm: The authority to conduct legal matters related to security incidents per direction of the ISO. Has the authority to represent and communicate with law enforcement.

3.0       Scope

This policy applies to all SCU security domain areas to include computers and devices, SCU system users, security detection systems, firewalls, remote access VPN software and hardware, and applications, that are controlled and operated by SCU staff or its designated IT Infrastructure Implementation Agents, contractors, and vendors, throughout at all branches of SCU, SCU Enterprise Cloud, Web, and Data Center providers, and other offsite facilities.

4.0       Standards

Require compliance with section 501(b) of the Gramm-Leach-Bliley Act (GLB Act).4 and section 216 of the Fair and Accurate Credit Transactions Act of 2003 (FACT Act).5 The Security Guidelines establish standards relating to administrative, technical, and physical safeguards to ensure the security, confidentiality, integrity and the proper disposal of customer information. Specific standards are as follows:

• Develop and maintain an effective information security program.
• Ensure the security of customer information at all times.
• Procedures for notifying customers of confirmed or suspected private information exposure.

5.0       Procedures

Responsible IRT members must consider GLBA standards when responding to incidents. The ISO is responsible for overseeing the development, implementation, and maintenance of this policy. The CIO is responsible for enforcing this policy. The SCU incident response model is as follows:

1. Incident detection. The Senior System Administrator and Network Administrator are responsible for monitoring Intrusion Detection and Prevention Systems (IDS/IDPS), system logs, and maintain communications with the help desk in order to detect possible security incidents. If a possible incident is detected, they will notify the ISO who will determine if the IRT needs to be activated.
2. The ISO will direct team members to implement additional control configurations to stop an attack, secure systems, and begin collecting evidence. Per SCU IRP, the ISO will issue evidence bags, make available electronic collection media, and chain of custody forms. All evidence will be collected and chain of custody maintained per the SCU IRP standards. The ISO and CSU law firm will monitor evidence collection procedures.
3. After evidence collection is complete or to a point where normal operations will not interfere with collection, the ISO will direct team member to recover systems per SCU IRP, Business Continuity Plans (BIA)’s, and other applicable SCU technical and administrative publications and policies.
4. Conduct analysis and debrief. At the ISO direction, the IRT will meet to discuss, evaluate, and make recommendations to prevent future incidents.
5. The ISO will be responsible for constructing and disseminating an incident report based on the IRT analysis of the incident. The report is to be used by HR, the Public Relations Director, and retained law firm for communicating details of the incident and make decisions on possible disciplinary or legal action.
6. Process improvement. Policy updates and additional training as required are to be implemented per the SCU IRP and training policy.

6.0       Guidelines

In the course of business it is inevitable that situations will arise that policy does not specifically address. Guidelines for these issues are as follows:

• Unforeseen security events or conflicts in procedures are to be referred to the ISO for guidance. In the event that the ISO is unavailable, the Senior System Administrator or CIO, dependent on the most senior present, will fulfill the ISO duties.

7.0       Policy Enforcement and Violations

Violations of this policy will be addressed in accordance relevant SCU information security and human resource policies. The appropriate level of disciplinary action will be determined on an individual case basis by the appropriate executive or designee, with sanctions up to or including termination depending upon the severity of the offense. The ISO is responsible for official interpretation of this policy. Questions regarding the application of this policy should be directed to the SCU Information Technology department.

Disclaimer

The post Security Policy Example – IRT Access & Authorization Policy appeared first on .

SunSpot Health Care Provider

Remote Access Policy for Remote Workers & Medical Clinics

1.0       Policy Statement

• It is SunSpot Health Care Provider (SHCP) policy to protect Information Resources based on risk against accidental or unauthorized disclosure, modification, or destruction, and assure the Confidentiality, Integrity, and Availability (CIA) of clinic and patient data.
• Apply appropriate physical and technical safeguards in a manner intended to reduce obstacles to conducting clinic business.
• Comply with applicable state and federal laws, and other clinic governing policies.

2.0       Purpose/Objectives

This Policy serves as the foundation for the security of remote access to clinic information system resources, and provides the Information Security Officer the authority to implement policies, standards, procedures, and guidelines, deemed necessary to protect clinic and patient data. Definitions found in this policy are as follows:

• Information Security Office: (ISO)
• Health Insurance Portability and Accountability Act: (HIPAA)
• Virtual Private Network: (VPN). A technology that allows the creation of a secure connection to a private network, or between private networks, over public networks such as the Internet.
• Secure Socket Layer: (SSL). A standard security technology for establishing an encrypted link between a web server and a browser.
• Electronic Private Health Information (ePHI).

3.0       Scope

This policy applies to all SHCP Local Area Network (LAN) to Wide-area Network (WAN) devices and security detection systems, firewalls, remote access VPN software and hardware, and remote access users, that are controlled and operated by SHCP staff or its designated IT Infrastructure Implementation Agents, contractors, and vendors, throughout at all branches of SHCP, SHCP Enterprise Cloud, Web, and Data Center providers, and other offsite facilities.

4.0       Standards

SHCP security policies are guided by HIPAA which defines data protection controls necessary to comply with the HIPAA standards. These standards are mandatory requirements, and establish an effective baseline of appropriate system, administrative, and physical controls. All policies must be designed to ensure that SHCP conforms to the following HIPAA standards:

• Two-factor authentication, example; unique user name and password
• Proper remote user access privilege approval system.
• Time-outs on inactive portals or VPN sessions.
• Restrictions on downloading of ePHI to remote host devices.
• ePHI in transit or at rest must be encrypted on host and server systems.
• Ensure remote access users are trained on policies and remote access use.
• All computers that use or store ePHI must use anti-malware software.
• Use Intrusion Detection/Intrusion Detection Prevention (IDS/IDPS).
• Conduct regular system scans and audits.

5.0       Procedures

Responsible administrators and managers must consider HIPAA standards when performing maintenance and configuration of information systems. They must implement processes and control procedures that meet HIPAA standards to include effective oversight of activities and transactions. The ISO will establish the requirement for a remote access policy and is responsible for the design, implementation, and management of the clinics security program.

• Authentication and granting remote access privileges. Individual department heads are responsible for requesting remote access privileges for their employees to include specifying the desired level of access. The department head will initiate a remote access request form that must be approved by the ISO, and then routed to the system administrator. The system administrator will create a unique account requiring a complex password for each remote user. Accounts created will be logged and tracked.
• The system administrator will be responsible for configuring a twenty (20) minute inactivity time-out on all VPN connections.
• Downloading ePHI on unprotected non-clinic devices is prohibited. The system administrator will configure mechanisms that will prevent remote hosts from downloading information.
• Users transmitting data outside of SHCP systems are required to encrypt the data using SSL certificates and digital signatures. All physical storage media must be encrypted using proven industry standard algorithms. The ISO is responsible for approving all SSL certificates. The system administrator is responsible for the creation, configuration, and tracking of SSL certificates.
• The ISO is responsible for overseeing and monitoring security and remote access user training. Department heads are responsible for ensuring employee compliance.
• The system administrator will install, update, and monitor anti-malware software on all SHCP computers and servers. The ISO will regularly audit patch and update policy compliance, and review scan logs monthly.
• The system administrator will review IDS/IDPS scan logs daily. The ISO will audit system logs monthly.

6.0       Guidelines

In the course of business it is inevitable that situations will arise that policy does not specifically address. Guidelines for these issues are as follows:

• Unforeseen security events or conflicts in procedures are to be referred to the ISO for guidance. In the event that the ISO is unavailable, the system administrator fulfills ISO duties.

7.0       Policy Enforcement and Violations

Violations of this policy will be addressed in accordance relevant SHCP information security and human resource policies. The appropriate level of disciplinary action will be determined on an individual case basis by the appropriate executive or designee, with sanctions up to or including termination depending upon the severity of the offense. The ISO is responsible for official interpretation of this policy. Questions regarding the application of this policy should be directed to the SHCP Information Technology department.

Disclaimer

The post Security Policy Example – Remote Access appeared first on .

The SANS Reading Room article; Security Policy for the use of handheld devices in corporate environments, provides a security policy template for Governing the use of hand-held devices in a corporate environment. Standard template elements are as follows:

• Introduction
• Purpose
• Scope of application and obligation
• Roles and Responsibilities
• Target Readership
• How to use the policy template
• Definitions
• References

The actual security policy contains the following elements:

• General policy requirements which discuss a wide range of elements to include roles and responsibilities of users, inventory of mobile devices, authorized and forbidden services, and user awareness training.
• Physical security. This policy includes, physical security as it relates to theft or loss of a mobile device, device safety, password requirements, ownership, remote blocking and wiping, availability and business continuity, and camera use.
• Operating System (OS) security. Items covered include firmware and OS update and patching, hardening, signed and unsigned application use, firewalls and anti-virus, and defining a security model for the device itself.
• Personal Area Network (PAN) security. Items covered here include, the use of Bluetooth, PINS and pairing, Bluetooth device security, file transfer over PAN, audits, and unauthorized use.
• Data security. A few items covered here include, information classification, restrictions, data security as it relates handling information, and encryption.
• Corporate network access security. Some items listed are. Access control to the network, remote access to corporate resources, internal access to resources, and wireless support.
• Over-the-air provisioning security. This policy covers device management, provision security, and communications security
• Internet security. Includes acceptable use, general email security, and attachment restrictions,
• Forbidden services
• Unauthorized actions

Overall, the template generally falls in line with other commonly used policy frameworks. It covers all the general elements with the exception of legal or industry general requirements.

References

Guerin, N., & Wanner, R. (2008, May 29). Security Policy for the use of handheld devices in corporate environments. Retrieved September 19, 2017, from https://www.sans.org/reading-room/whitepapers/pda/security-policy-handheld-devices-corporate-environments-32823.

Johnson, R. (2015). Security Policies and Implementation Issues (2nd ed.). Burlington, MA: Jones & Bartlett Learning.

The post Security Policy Template for Hand-Held Devices appeared first on .

The following is a list of recommended Virtual Private Network monitoring and security controls:

• Use firewalls and Intrusion Detection/Prevention Systems (IDS/IDPS) in order to monitor VPN connections.
• Use anti-malware and personal firewalls on remote clients and servers.
• All VPN connections require authentication.
• Logging enabled and auditing performed on a regular basis in order to detect possible attacks.
• Establish user and administrator security training requirements.
• VPN’s placed within a Demilitarized Zone (DMZ) to isolate them from internal protected networks.
• Split tunneling to allow local internet access on remote hosts should be prohibited.
• Use strong authentication mechanisms to include certificates, smart cards, or tokens.
• Access privileges granted on as-needed basis.
• Use strong alternative authentication mechanisms such as Terminal Access Controller Access Control System (TACACS), and Remote Authentication Dial-In User Service (RADIUS).
• Remote access computers physically secure.
• Use strong industry proven encryption with sufficient key strength to protect confidentiality.

It is important to note that even though Virtual Private Networks provide secure communications over insecure networks, client-side security must also be addressed in order to ensure end-to-end security.

References

HKSAR-The Government of the Hong Kong Special Administrative Region. (2008, February). VPN Security. Retrieved September 20, 2017, from https://www.infosec.gov.hk/english/technical/files/vpn.pdf.

Oracle Docs. Defining a VPN. https://docs.oracle.com/cd/E19047-01/sunscreen32/806-6347/6jfa0g87q/index.html.

Tech Target. Virtual Private Network. http://searchnetworking.techtarget.com/definition/virtual-private-network.

The post Virtual Private Network (VPN) Security and Monitoring Controls appeared first on .

• Basic principles of information security
• Awareness of information security threats and risks
• How to recognize and react to unexpected risks and security events
• How to report suspicious activity
• Builds a security culture throughout the organization

Techniques to keep security awareness fresh in user minds include:

• Ensure executive and management support. When top executives and management provide noticeable vocal support, it provides a sense of the importance of information security organization-wide.
• Use awareness aids such as posters, newsletters, email tips, blogs, and other reminders. People are different and learn in different ways. Using different types of aids helps ensure that the message gets through to employees in many different areas of the organization.
• Focus on changing behaviors. The goal is to create a culture of security. One way of doing this is relating awareness to employee’s personal life, family, and home. This allows employees to share security materials and information outside of work with family and friends making information security a part of their personal life as well. Make awareness engaging or interactive. This can often be fun for employees.
• Solicit ideas and feedback. Ask employees how security awareness can be improved. This gets employees directly involved in security programs.
• Measure success and growth. Track training completion. Get feedback on what employees like about training and what could use improvement.

References

Johnson, R. (2015). Security Policies and Implementation Issues (2nd ed.). Burlington, MA: Jones & Bartlett Learning.

Lohrmann, D. (2014, March 09). Ten Recommendations for Security Awareness Programs. Retrieved September 20, 2017, from http://www.govtech.com/blogs/lohrmann-on-cybersecurity/Ten-Recommendations-for-Security-Awareness-Programs.html.

The post Basics of Security Awareness: Users are the Weakest Link appeared first on .

COBIT

• COBIT allows much broader scope and takes into account all IT management processes.
• Geared towards a method of successfully executing key policies and procedures. It is often used to tie together controls, technical issues and risks, within an organization.
• COBIT is managed by the Information Systems Audit and Control Association (ISACA) so it is kept up to date with current technology, and is globally accepted.
• Allows scope to extend beyond IT and into management of the organization.

ISO 27002

• ISO 27002 provides best practice recommendations for an Information Security Management System (ISMS) standard. The 27001 and 27002 are used together to provide a management system, and specify industry-related controls. The ISO 27002 is an IT department focused standard.
• Allows system managers to identify and mitigate gaps and overlaps in coverage.
• Limited in scope compared to other standards.

NIST

• NIST is a Federal Government standard that covers a Risk Management Framework which addresses security controls in accordance with the Federal Information Processing Standard (FIPS) 200. This means that the standard has been through a very stringent review process and is very thorough.
• Provides a level of detail for organizations not wanting to do a lot of customization. Comprehensive.
• Like the ISO standard, NIST is limited in scope to information security.

When comparing COBIT to the other standards, it does have some appealing advantages. Since it allows for a wide-scope to include management outside of IT, it makes it easier to customize and integrate into the organization. COBIT is a good choice for an organization-wide framework allowing flexibility. Both ISO and NIST are restricted in scope to IT, and are not as flexible. A notable point is that all Government agencies and contractors must adhere to NIST standards. Much depends on the organization, its purpose, and if it is private or Government affiliated. For large private enterprises with no Government ties, COBIT is a desirable framework because of its broad scope, and flexibility.

References

Agnosticator. (2013, December 09). A Comparison of COBIT, ITIL, ISO 27002 and NIST. Retrieved September 9, 2017, from http://agnosticationater.blogspot.com/2013/12/a-comparison-of-cobit-itil-iso-27002.html.

Gallagher, P. D. (2013, April). NIST Special Publication 800-53 Revision 4. Security and Privacy Controls for Federal Information Systems and Organizations. Retrieved September 9, 2017, from http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r4.pdf.

The post Primary Advantages of COBIT, ISO 27000, and NIST appeared first on .

Typical business areas commonly involved with policy framework include; development, maintenance, and compliance. Some of the common roles associated with policy framework include; Chief Information Security Officer (CISO), Information Resources Manager, and Security Manager.

The SANS Reading Room publication; Information Security Policy – A Development Guide for Large and Small Companies, describes a guideline rather than specific roles.  The guideline describes a two-part structure consisting of primary involvement members, and secondary involvement members.

Primary Involvement:

• Information Security Team. The team or parts of the team should be assigned overall responsibility for developing framework, and policies. Overall control is normally given to a designated member with others in supporting roles as needed. The primary team guides policy framework and policy from development through to revision as the cycle dictates.
• Technical Writers(s). Many companies have technical writers on staff. Even though they probably will not take an active role in development, they can be an invaluable resource when it comes to planning and structure of the project.

Secondary Involvement:

• Technical Staff: In addition to security staff, it is probable that expertise from other areas will be needed. Staff from these areas will have in-depth knowledge of day-to-day operations, and knowledgeable of technical issues in their areas.
• Legal Counsel should review policy documents when complete. They can also provide guidance on industry regulations such as the Health Information Portability and Accountability Act (HIPAA), and Sarbanes Oxley (SOX).
• Human Resources (HR) should also review all policies to ensure they comply with company HR policies.
• Audit and Compliance. Departments responsible for internal audits will likely be involved in monitoring policies. They should be involved in the development of frameworks and policies to ensure that they are enforceable.
• User Groups. During revision stages users can provide a good indication on how successful a policy has been, and what parts might need revision. They often notice where improvements can be made in style, layout, and wording.

References

Diver, S. (06, July 12). Information Security Policy – A Development Guide for Large and Small Companies. Retrieved September 7, 2017, from https://www.sans.org/reading-room/whitepapers/policyissues/information-security-policy-development-guide-large-small-companies-1331.

The post IT & Security Framework and Policy Development Team appeared first on .