- Introduction
- Vulnerabilities of Data on the Wire
- Vulnerabilities of Data at Rest
- How Can We Protect Our Data?
- Summary
Like this article? We recommend
Like this article? We recommend
Like this article? We recommend
How Can We Protect Our Data?
How do we defend against so many possible attack vectors? The key is to focus on the data. The first step should be data-sensitivity analysis as part of an overall risk-assessment process. Data-sensitivity analysis begins by identifying an organization's critical data and ways in which that data is used. Once the sensitivity of data has been classified, the organization can reach decisions about the necessary level of protection for that data. Your tendency may be to apply the greatest level of protection available, but that level may be neither necessary nor cost-effective. For example, you wouldn't spend $100,000 on a firewall to protect an expected loss of only $5,000. You can get a better idea of how to apply countermeasures if you include a loss/impact analysis as part of the risk-assessment process.
Simple Approach
A simple approach to data protection looks at the various layers of security that can be applied. Consider the following starting checklist:
Data repository:
Do you need to encrypt the data repository?
Do you need a hash of the transactions for integrity purposes?
Should you digitally sign transactions?
Make sure that database logging is enabled and properly configured.
Server considerations:
Harden the operating system.
Disable unnecessary services and close ports.
Change system defaults.
Don't use group or shared account passwords.
Lock down file shares.
Restrict access to only necessary personnel.
Consider host-based firewalls and intrusion detection for critical servers.
Maintain proper patch procedures.
Network segment:
Use switches rather than routers or hubs as much as possible.
Lock down unused router/switch ports.
Consider MAC filters for critical systems.
Establish logical subnets and VLANs.
Set up access control lists (ACLs) for access routes.
Use ingress/egress filters, anti-spoof rules.
Determine appropriate location and functionality for network-based firewalls and intrusion detection.
Use encrypted logins or SSL for web-based sessions.
Physical security for data:
Establish input/output handling procedures.
Use physical access logs for server rooms and network operations centers.
Document tape-handling procedures, tape rotation, offsite storage.
Consider an alternate data center.
Archiving: Where does your data go to rest in peace?
Data destruction: Degauss, erase/overwrite, physical destruction?
How is data handled when equipment is sent out for repair, replacement, or end of life?
This is just a quick list of points to consider. Fortunately, folks much smarter than I am have developed a much more comprehensive approach.
Structured Approach
Security standards and guidance are available, especially for organizations that are part of or do business with the U.S. government. Through the work of various organizations, the government has put together a program known as Certification & Accreditation (C&A). Standards have been and continue to be developed that provide guidance on the performance of risk assessments, development of security plans, and the application of security controls.
The Computer Security Division of the National Institute of Standards and Technology (NIST) has been assigned this important multi-part task:
Improving federal information-systems security by raising awareness of IT risks, vulnerabilities, and protection requirements, particularly for new and emerging technologies
Researching, studying, and advising agencies of IT vulnerabilities and devising techniques for the cost-effective security and privacy of sensitive federal systems
Developing standards, metrics, tests, and validation programs
Developing guidance to increase secure IT planning, implementation, management, and operation
The C&A process is explained and documented in NIST's publications. NIST's guidelines provide an excellent framework for selecting, specifying, employing, and evaluating the security controls in information systems.