CISA All in one 2010 Guide

Chapter 6: Information Asset Protection 325 • Roles and responsibilities The employment agreement should define the employee’s roles and responsibilities, as well as the responsibilities of the employer. This will be similar to what is found in the job description. • Confidentiality The employee agrees to keep all company secrets confidential, even after termination of employment. • Compliance The employee must agree to comply with all applicable laws and regulations, as well as with all organization policies. The employment agreement should state the consequences of failing to comply with laws, regulations, and policies. • Termination The employment agreement should include the conditions and circumstances by which the organization or the employee can sever the agreement.During EmploymentOrganizations need to enact several safeguards during the span of employment for eachemployee. These safeguards ensure that each employee’s behavior is appropriate andthat each employee is able to do only what is required of him or her. These safeguardsinclude: • Periodic renewal of employment agreements Documents signed at the time of hire, including nondisclosure, employment, security policy, and other agreements, should be renewed periodically. Organizations that employ this practice do this annually. • Repeat background checks Occasionally, repeating background checks helps to ensure that each employee’s background (criminal history in particular) is still acceptable. • Access changes when transferred Any employee who is transferred from one position to another should have their accesses for the former position removed. This helps to prevent the accumulation of privileges over time. • Awareness training Employees should undergo periodic training on important topics, including security awareness training, so that they will continue to be aware of security procedures and requirements.Policy and Discipline During their service, employees, contractors, temps, andother workers are expected to comply with the organization’s security policy and otherpolicies. The organization’s security management program needs to include monitor-ing and internal auditing to ensure that policies are adhered to. When policy violationsoccur, human resources will need to invoke its disciplinary action process as needed. Disciplinary action that is related to security policy violations should not be treateddifferently from any other disciplinary matter. IS security may be asked to provide factsabout the matter, but should otherwise not be involved. Discipline is usually a matterbetween an employee’s manager and the employee; human resources should be in-volved only if the matter is serious enough to warrant a letter in the employee’s employ-ment file, suspension, demotion, or termination of employment.

CISA Certified Information Systems Auditor All-in-One Exam Guide326 Equipment The organization should keep records regarding any equipment, soft- ware, licenses, or other assets that are entrusted to the employee, particularly when the asset will be used away from company premises, such as in the employee’s home. Each time an asset is issued to an employee, a simple checkout document should be com- pleted that describes the asset, the employee’s name, the date issued, and an agreement that the asset will be returned to the employer on request. The employee should be re- quired to sign this document, and a copy placed in his or her employment file. If the employee transfers to another position or department, or leaves the organiza- tion altogether, human resources should retrieve all equipment checkout forms and make sure that the employee returns each asset. Transfers and Terminations When employees are transferred from one position or department to another, they may be required to return certain assets entrusted to their care if they are no longer needed in the new role. Similarly, after transfer, an employee’s access rights should be reviewed and any accesses from the old position that are not required in the new position be removed. This is covered in more detail in the earlier section, “Access Controls.” When an employee’s employment is terminated, his or her access to information systems and business premises should be immediately revoked. All equipment, docu- ments, software, and other assets in the employee’s care should be returned and ac- counted for. The access badge and other identifying items should also be returned. Contractors and Temporary Workers Contractors, consultants, temps, and other workers should be required to conform to many of the same organization policies that are required of employees, including: • Nondisclosure agreement • Security policy agreement • Other policies Computer Crime Computers are involved in many criminal acts and enterprises. This section discusses the uses of computers in criminal activities. Roles of Computers in Crime Being the flexible, multipurpose tools that they are, computers can be used in several different ways in the commission and support of crimes. And because some computers contain valuable information, they are the targets of crimes. There are three main ways in which a computer is involved in a crime: • Target of a crime. A computer or its contents are the target of a crime. Some of the possible crimes are: • Equipment theft The computer itself (or related equipment or media) is stolen.

Chapter 6: Information Asset Protection 327 • Equipment vandalism Computer equipment may be damaged or destroyed. • Data theft Data that is stored on the computer or related media may be stolen. This is a more difficult crime to detect, since thieves usually steal a copy of the data, leaving the original data intact and untouched. • Data vandalism Data that is stored on a computer may be deliberately altered, sometimes in ways that go undetected for a time. • Trespass Someone enters the computer system without permission or authorization. • Instrument in a crime A computer is used as a weapon or tool to commit a crime. Some of the types of crimes that can be perpetrated include: • Trespass This is the unauthorized and unlawful entry into a computer or network. • Data theft and vandalism Intruders enter computers or networks and steal or destroy data and programs. • Sabotage Intruders destroy computer hardware, software, or data. • Child pornography This is the unlawful storage or distribution of child pornography content. • Libel and slander These are communications that make claims that give a subject a negative image. • Espionage An individual or group obtains information considered a military, political, or industrial secret. • Eavesdropping A computer can be used to eavesdrop on electronic messaging, such as e-mail, instant messaging, and even voice over IP (VoIP). • Spam Computers are used to generate and deliver millions of spam messages every day. • Support of a crime Computers can be used to support criminal activities. Some of the ways that this can occur include: • Recordkeeping Computers can be used to record criminal activities. For example, a petty thief who breaks into houses can track the items he steals and then resells in a spreadsheet program. • Aid and abet Computers can be used to provide support for other criminals. For instance, a computer can be used to send helpful information and funds to a criminal in hiding. • Conspiracy A computer can be used to document the plans for a crime. Criminals can use word processing tools, such as “track changes,” to perfect their criminal schemes. It should be easy to imagine that computers can play multiple roles in crimes: Theycan be used as weapons as well as recordkeeping systems, for instance.

CISA Certified Information Systems Auditor All-in-One Exam Guide328 Categories of Computer Crime Cybercrime comes in a lot of flavors, primarily because computers are used as targets for so many purposes. It may be helpful to remember that the information stored in computers has some value—and the nature and value of that information will attract various types of criminal elements. Computer crimes are roughly analogous to crimes in the physical world: People rob banks to get the money; they deface statues in public places to embarrass government and make a political point; they attack public trans- portation systems in acts of terrorism; and they steal purses in order to get quick cash and maybe a few usable credit cards. The categories of computer crime can be thought of in this way: • Military and intelligence Here, attackers are attempting to obtain military or intelligence secrets or disrupt military or intelligence operations. These attacks may occur at any time—during wartime, periods of hostility, or when there are no apparent tensions between governments. These attacks may be carried out by governments as well as nongovernment-sanctioned civilian groups. • Political This type of attack may be carried out by one state against another, but more typically, the attacker is a state-sponsored or independent group. • Terrorist Here, attackers are attempting to induce fear and panic among a populace by damaging or disrupting critical infrastructure that is controlled or monitored by computers, including utilities, government services, financial services, health care, education, and other organizations. • Financial In this type of attack, perpetrators are carrying out activities in an attempt to steal funds, credit card numbers, bank account numbers, or perpetrate fraud. Targets include financial institutions and all other organizations that store or process financial data. • Business This represents a wide variety of purposes, including espionage, extortion, theft, vandalism, denial of service, and any attacks designed to weaken or embarrass a business organization. • Grudge As the name implies, a grudge attack is generally motivated by feelings of revenge that an individual or group wishes to exact upon an organization. • Amusement This type of attack is carried out primarily for fun. Nevertheless, these attacks can still be lethal and cause significant damage or embarrassment. Most attacks are a blend of two or more of the categories discussed here. Under- standing these categories can help an organization better understand how to prepare for possible cyberattacks. Threats of Cybercrime on Organizations Organizations that use computers to store information of value (whether tangible value or not) need to take steps to protect that information. The nature of the information does have a bearing on the types of threats that will be most prevalent for a given orga- nization. In general, the threats include:

Chapter 6: Information Asset Protection 329• Financial Organizations that store financial-related information, particularly credit card numbers and bank account numbers, are more likely to be the target of crimes where criminals will attempt to steal this information. Organizations may also be the target of one or more types of financial fraud, including: • Transferring funds A web site that is used to send or receive funds will be the target of attackers, who will attempt to trick the application—or its other users—into transferring funds to attackers’ accounts. • Stealing service Intruders may attempt to trick a web site into providing free service. For instance, a flaw in a site’s payment acceptance program may permit a user to receive service without paying for it. • Account hijacking This can occur through malware that sniffs user IDs and passwords from existing customers, or phishing schemes that entice customers to click on links that take them to imposter sites that appear to be financial institutions. • Click fraud Many online advertisers pay for clicks on their online ads. Attackers can build malware to generate clicks from victim computers in order to collect payments. • Social engineering Attackers will attempt to trick people into responding to e-mails purporting to be invoices or refund requests, providing their valuable login credentials to a phony web site.• Disclosure of sensitive information If an organization has sensitive information, intruders will attempt to steal or deface it. Sensitive information can be almost anything of value, including bank account and credit card numbers, intellectual property, personally identifiable information, and military and government secrets. Perpetrators might either try to steal or deface this information, or simply discover how to do that and disclose that technique to others.• Blackmail If hackers or organized crime enterprises are able to successfully break in to an organization’s computers or networks, they may be able to encrypt or remove sensitive information and then demand payments to restore that information.• Sabotage Hackers may wish to break in to computers or networks in order to damage their ability to perform their function. This kind of an attack could range from damaging operating systems, application software, or information—whatever it takes to damage or destroy a system.• Reputation Intruders may be inclined to break in to an organization’s computers or networks in some visible way simply for the opportunity to embarrass the organization and damage its reputation.• Legal Security breaches may invite lawsuits from customers, business partners, and shareholders.

CISA Certified Information Systems Auditor All-in-One Exam Guide330 Perpetrators of Cybercrime Many different types of individuals and groups will commit cybercrimes if they have sufficient motivation. The nature of the organization and the data that it stores on its computers will influence which groups and individuals will be more likely to attack the organization’s systems. In no particular order, the perpetrators of cybercrimes include: • Hackers Usually lone combatants who have the skills and the tools to break in to computer systems and networks. They can steal or deface information, or plant software in an organization’s computers for a variety of purposes. • Cybercriminal gangs and organized crime Lured by big profits, organized crime has moved headlong into the cybercrime business with profits that exceed those from drug trafficking, according to the U.S. Treasury Department. Cybercrime organizations are well organized with investors and capital, research and development budgets, supply chains, employees on payroll, and profit sharing. • Spies and intelligence agents People in intelligence organizations may attempt to break in to the computers or networks in target governments or industries in order to collect intelligence information. Often these agents will employ hackers to perform information-gathering activities. • Terrorists State-sponsored, privately sponsored, and just plain rogue groups of individuals perpetrate cybercrimes against populations in order to induce fear and intimidation, and eventually to precipitate changes in a nation’s foreign policy. There have not been many spectacular terrorism-based cybercrimes (none that we know of anyway), but it’s likely just a matter of time. • Script kiddies Inexperienced computer hackers obtain hacking tools from others. The term “script kiddies” refers to usually adolescents (kiddies) or simply inexperienced would-be hackers, who obtain hacking tools (scripts) in order to break in to computers for fun or just to pass the time. • Social engineers These clever individuals will use a variety of means to gain information about an organization’s inner workings that they use to exploit the organization. Social engineers frequently use pretexting (pretending to be someone they aren’t) in order to get employees to give up secrets that help them break in to systems. • Employees People who work in an organization have the means and often have opportunities to steal equipment and information from their employers. Usually all they need is motivation. Employers often deliver motivation on a silver platter as a result of draconian policies and working conditions. • Former employees People who used to work in organizations know its secrets, vulnerabilities, and inner workings. Terminated and laid-off employees sometimes have sufficient motivation to steal from or embarrass their former employers as a way of getting even for losing their job. • Knowledgeable outsiders These are persons who have some knowledge about an organization’s internal systems, architecture, or vulnerabilities. These

Chapter 6: Information Asset Protection 331 individuals can gain their knowledge through espionage, social engineering, eavesdropping, or from current or former employees. The point is they know more than most outsiders. • Service provider employees Personnel employed at service providers are another class of knowledgeable outsiders; through their business relationship with the organization, they possess information about the organization’s people, processes, and technology that they can use to harm the organization through criminal means. Because cybercrime can be perpetrated by so many different types of people, it isquite a challenge to “think like a cybercriminal” in order to prepare one’s defenses.While such an approach will still be helpful, it requires broad reflection on the part ofsecurity analysts and engineers who are responsible for protecting an organization’svaluable assets.Security Incident ManagementA security incident is defined as any event that represents a violation of an organiza-tion’s security policy. For instance, if an organization’s security policy states that it is notpermitted for one person to use another person’s computer account, then such a usethat results in the disclosure of information would be considered a security incident.There are several types of security incidents: • Computer account abuse Examples include willful account abuse, such as sharing user account credentials with other insiders or outsiders, or one person stealing a password from another. • Computer or network trespass Here, an unauthorized person accesses a computer network. The methods of trespass include malware, using stolen credentials, access bypass, or gaining physical access to the computer or network and connecting to it directly. • Interception of information An intruder devises a means for eavesdropping on communications. The intruder may be able to intercept e-mail messages, client- server communication, file transfers, logon credentials, and network diagnostic information. Some of the methods that can be used for eavesdropping include malware, installing sniffing programs on compromised computers, or direct connection to computers or networks. • Malware A worm or virus outbreak may occur in an organization’s network. The outbreak may disrupt normal business operations simply through the malware’s spread, or the malware may also damage infected systems in other ways, including destroying or altering information. Malware can also eavesdrop on communications and send intercepted sensitive information back to its source. • Denial of service (DoS) attack An attacker can flood a target computer or network with a volume of traffic that overwhelms the target so that it is unable to carry out its regular functions. For example, an attacker can flood an online

CISA Certified Information Systems Auditor All-in-One Exam Guide332 banking web site with so much traffic that the bank’s depositors are unable to use it. • Distributed denial of service (DDoS) attack Similar to a DoS attack, a distributed denial of service attack emanates simultaneously from hundreds to thousands of computers. A DDoS attack can be difficult to withstand because of the volume of incoming messages, as well as the large number of attacking systems. • Equipment theft Here, computer or network equipment is stolen. Information contained in stolen equipment may be easy to extract unless it is encrypted. • Disclosure of sensitive information Any sensitive information that is disclosed to any unauthorized party. The examples here should give you an idea of the nature of a security incident. Other types of incidents may be considered security incidents in some organizations. NOTE A vulnerability that is discovered in an organization is not an incident. However, the severity of the vulnerability may prompt a response that is similar to an actual incident.Vulnerabilities should be fixed as soon as possible to prevent future incidents. Phases of Incident Response An effective response to an incident is organized, documented, and rehearsed. The phases of a formal incident response plan are: • Planning This step involves the development of written response procedures that are followed when an incident occurs. • Detection This is the time when an organization is first aware that a security incident is taking place or has taken place. Because of the variety of events that characterize a security incident, an organization can become aware of an incident in several ways, including: • Application or network malfunction • Application or network slowdown • Intrusion detection system alerts • Logfile alerts • Media outlets • Notification from an employee or business partner • Anonymous tips • Initiation This is the phase where response to the incident begins. Typically, this will include notifications that are sent to response team members so that response operations may begin. • Evaluation In this phase, response team members analyze available data in order to understand the cause, scope, and impact of the incident.

Chapter 6: Information Asset Protection 333 • Eradication In this phase of incident response, responders are taking steps to remove the source of the incident. This could involve removal of malware, blocking incoming attack messages, or removal of an intruder. • Recovery When the incident has been evaluated and eradicated, often there is a need to recover systems or components to their pre-incident state. This might include restoring data or configurations, or replacing damaged or stolen equipment. • Remediation This activity involves any necessary changes that will reduce or eliminate the possibility of a similar incident to occur in the future. This may take the form of process or technology changes. • Closure Closure occurs when eradication, recovery, and remediation are completed. Incident response operations are officially closed. • Post-Incident Review Shortly after the incident closes, incident responders and other personnel meet to discuss the incident: its cause, impact, and the organization’s response. Discussion will range from lessons learned to possible improvements in technologies and processes to further improve defense and response.Testing Incident ResponseIncident response plans should not only be documented and reviewed—they need tobe periodically tested. Incident response testing helps to improve the quality of thoseplans, which will help the organization to better respond when an incident occurs. Similar to disaster recovery and business continuity planning, there are varioustypes of tests that should be carried out: • Document review In this review, individual subject matter experts (SMEs) carefully read incident response documentation to better understand the procedures and to identify any opportunities for improvement. • Walkthrough This is similar to a document review, except that it is performed by a group of subject matter experts, who talk through the response plan. Discussing each step helps to stimulate new ideas, which could lead to further improvements in the plan. • Simulation Here, a facilitator describes a realistic security incident scenario and participants discuss how they will actually respond. A simulation usually takes half a day or longer. It is suggested that the scenario be “scripted” with new information and updates introduced throughout the scenario. A simulation can be limited to just the technology aspects of a security incident, or it can involve corporate communications, public relations, legal, and other externally facing parts of the organization that may play a part in a security incident that is known to the public. These tests should be performed once each year or even more often. In the walk-through and simulation tests, someone should be appointed as note-taker so that anyimprovements will be recorded and the plan can be updated.

CISA Certified Information Systems Auditor All-in-One Exam Guide334 If the incident response plan contains the names and contact information for re- sponse personnel, the plan should be reviewed more frequently to ensure that all contact information is up-to-date. Incident Prevention With the right processes and controls, many incidents can be prevented from occurring in the first place. Incident prevention is primarily accomplished through knowledge of vulnerabilities and actions to remove them. With fewer vulnerabilities, some threats are reduced or neutralized altogether. Important elements in the prevention of security incidents include: • Vulnerability and threat monitoring This involves close monitoring of security advisories published by vendor and vendor-independent services such as US-CERT, Secunia, and Bugtraq. These advisories are publications of newly discovered flaws in computer hardware and software, as well as announcements of new threats that are seen in the wild. • Patch management This is a systems management process that utilizes tools used to install security patches in operating systems, database management systems, applications, and network devices. Many threats are realized through published vulnerabilities. Sometimes hackers are able to fashion tools to exploit vulnerabilities within hours of publication. It is therefore important that an organization be prepared to quickly deploy some security patches when it is known that specific vulnerabilities are being exploited in the wild. Patch management is discussed in more detail in the section, “Logical Access Controls.” • System hardening This is the technique of configuring a system so that only its essential services and features are active and all others are deactivated. This helps to reduce the “attack surface” of a system to only its essential components. On a hardened system, only the essential components need to be configured to resist attack; all other components are disabled and removed, resulting in less effort and fewer vulnerabilities. System hardening is discussed in more detail in the section, “Logical Access Controls.” • Intrusion detection Software programs and hardware appliances known as intrusion detection systems (IDS) can give early warnings of network- or computer-based attacks. Intrusion prevention systems (IPS) go one step further by actively blocking activities that resemble attacks. NOTE A relatively modest effort at incident prevention can help to stave off many otherwise-damaging security incidents. Forensic Investigations Forensic investigations are required when a security incident has occurred and it is nec- essary to gather evidence to determine the facts of the evidence. Because the informa- tion gathered in an investigation may later be used in a legal proceeding, the forensic

Chapter 6: Information Asset Protection 335investigator must follow strict procedures when gathering, studying, and retaining in-formation.Chain of CustodyThe key to an effective and successful forensic investigation is the establishment ofa sound chain of custody. The major considerations that determine the effectivenessof a forensic investigation are: • Identification A description of the evidence that was acquired, and the tools and techniques used to acquire it. Evidence may include digital information acquired from computers, network devices, and mobile devices, as well as interviews of involved persons. • Preservation A description of the tools and techniques used to retain evidence. This will include detailed records that establish the chain of custody, which may be presented and tested in legal proceedings. • Analysis A description of the examination of the evidence gathered, which may include a reconstruction of events that are a subject of the investigation. • Presentation A formal document that describes the entire investigation, evidence gathered, tools used, and findings that express the examiner’s opinion of the events that occurred (or did not occur). The entire chain of custody must be documented in precise detail and include howevidence was protected against tampering through every step of the investigation. Any“holes” in the information acquisition and analysis process will likely fail in legal pro-ceedings, possibly resulting in the organization’s failure to convince judicial authoritiesthat the event occurred as described.Forensic Techniques and ConsiderationsComputer and network forensics requires several specialized techniques that ensure theintegrity of the entire forensic investigation and a sound chain of evidence. Some ofthese techniques are: • Data acquisition This is the process of acquiring data for forensic analysis. Subject data may reside on a computer hard drive, mobile device memory, or in an application’s audit log. Several tools are used for forensic data acquisition, including media copiers, which are tools that acquire a copy of a computer’s hard drive, USB memory stick, or removable media such as a floppy disk or CD/DVD-ROM. • Data extraction If data is being acquired from a running system or from a third party, a secure method must be used to acquire the data that demonstrates the integrity of the process. This must be done in a way that proves the source of the data and that it was not altered during the extraction process. • Data protection Once data is acquired, the forensic investigator must take every step to ensure its integrity. Computers used for forensic analysis must be physically locked so that no other persons have access to them. They must not be connected to any network that would allow for the introduction of

CISA Certified Information Systems Auditor All-in-One Exam Guide336 malware or other agents that could alter acquired data and influence the investigation’s outcome. • Analysis and transformation Often, tools are required to analyze acquired data and search for specific clues. Also, data must frequently be transformed from its native state into a state that is human- or tool-readable; in many cases, computers store information in a binary format that is not easily read and interpreted by humans. For example, the NTUSER.DAT file used in Windows is a binary representation of the HKEY_LOCAL_USER branch of the system’s registry. This file cannot be directly read, but requires tools to transform it into human-readable form. Logical Access Controls Logical access controls are used to control whether and how subjects (usually persons) are able to access objects (usually data). Logical access controls work in a number of different ways, primarily: • Subject access Here, a logical access control uses some means to determine the identity of the subject that is requesting access. Once the subject’s identity is known, the access control performs a function to determine if the subject should be allowed to access the object. If the access is permitted, the subject is allowed to proceed; if the access is denied, the subject is not allowed to proceed. An example of this type of access control is an application that first authenticates a user by requiring a user ID and password before permitting the user to access the application. • Service access Here, a logical access control is used to control the types of messages that are allowed to pass through a control point. The logical access control is designed to permit or deny messages of specific types (and possibly it will also permit or deny based upon origin and destination) to pass. An example of this type of access control is a firewall or screening router that makes pass/block decisions based upon the type of traffic, origin, and destination. An analogy of these two types of access is a symphony hall with a parking garage. The parking garage (the “service access”) permits cars, trucks, and motorcycles to enter, but denies oversized vehicles from entering. Upstairs at the symphony box office (the “subject access”), persons are admitted if they possess a photo identification that matches a list of prepaid attendees. Access Control Concepts In discussions about access control, security professionals often use terms that are not used in other IS disciplines. These terms are: • Subject, object These are pronouns that refer to access control situations. A subject is usually a person, but it could also be a running program or a computer. In typical security parlance, a subject is someone (or something)

Chapter 6: Information Asset Protection 337 that wants to access something. An object (which could be a computer, application, database, file, record, or other resource) is the thing that the subject wants to access. • Fail open, fail closed This refers to the behaviors of automatic access control systems when they experience a failure. For instance, if power is removed from a keycard building access control system, will all doors be locked or unlocked? The term fail closed means that all accesses will be denied if the access control system fails; the term fail open means that all accesses will be permitted upon failure. Generally, security professionals like access control systems to fail closed, because it is safer to admit no one than it is to admit everyone. But there will be exceptions now and then where fail open might be better; for example, building access control systems may need to fail open in some situations to facilitate emergency evacuation of personnel or entrance of emergency services personnel. • Least privilege This is the concept where an individual user should have the lowest privilege possible that will still enable them to perform their tasks. • Segregation of duties This is the concept that specifies that single individuals should not have combinations of privileges that would permit them to conduct high-value operations on their own. The classic example is a business accounting department where the functions of creating a payee, requesting a payment, approving a payment, and making a payment should rest with four separate individuals. This will prevent any one person from being able to easily embezzle funds from an organization. In the context of information technology, functions such as requesting user accounts and provisioning user accounts should reside with two different persons so that no single individual could create user accounts on his own. • Split custody This is the concept of splitting knowledge of a specific object or task between two persons. One example is splitting the password for an important encryption key between two parties: one has the first half and the other has the second half. Similarly, the combination to a bank vault can be split so that two persons have the first half of the combination while two others have the second half.Access Control ModelsSeveral access control models have been developed since the 1970s. These models aresimple mechanisms that are used to understand and build access control systems. Theearly models include Biba, Bell-La Padula, Clark-Wilson, Lattice, Brewer and Nash, Take-Grant, and Non-Interference. The models that are of interest to the IS auditor include: • Mandatory Access Control (MAC) This access model is used to control access to objects (files, directories, databases, systems, networks, and so on) by subjects (persons, programs, etc.). When a subject attempts to access an object, the operating system examines the access properties of the subject and object to determine if the access should be allowed. The operating system then

CISA Certified Information Systems Auditor All-in-One Exam Guide338 permits or denies the requested access. Access is administered centrally, and users cannot override it. • Discretionary Access Control (DAC) In this access model, the owner of an object is able to determine how and by whom the object may be accessed. The discretion of the owner determines which subjects will be permitted access. NOTE The MAC and DAC models each have their advantages and disadvantages.While DAC permits flexibility by permitting an owner to set access rights, abuse or errors could lead to exposure of sensitive information. MAC’s centralized administration and inflexibility is also its strength: Users cannot override MAC settings and potentially expose sensitive information to others. Threats Because access controls are often the only means of protection between protected assets and users, access controls are often attacked. Indeed, the majority of attacks against computers and networks containing valuable assets are attacks against access controls in attempts to trick, defeat, or bypass them. Threats represent the intent and ability to do harm to an asset. Threats against access controls include: • Malware This includes viruses, worms, Trojan horses, root kits, and spyware. Malware is malicious code that is used to perform unauthorized actions on target systems. It is often successful because of known vulnerabilities that can be exploited. Vulnerabilities are discussed in more detail in the next section. • Eavesdropping Here, attackers will install network- or system-based sniffing tools to listen to network communications in order to intercept key transmissions such as user IDs and passwords used to access sensitive or valuable information. Usually, attackers will need to use some means such as malware or social engineering to install sniffing tools on a target system. In some instances, however, attackers will have access to the physical network and can directly connect sniffing tools to the network cabling. • Logic bombs and back doors Computer instructions inserted by programmers or others in the software development process can result in an application that contains unauthorized code. A logic bomb is a set of instructions that is designed to perform some damaging action when a specific event occurs; a popular example is a time bomb that alters or destroys data on a specified date in the future. Some programmers install time bombs in code that they manage and periodically advance the date in the time bomb. If the programmer is fired from his job, the time bomb will activate after his termination, and the programmer will have gotten his revenge on his former employer. A back door is a section of code that permits someone to bypass access controls and access data or functions. Back doors are commonly placed in programs during development but removed before programming is

Chapter 6: Information Asset Protection 339 complete. Sometimes, however, back doors are deliberately planted so that the developer (or someone else) can access data and functions. • Scanning attacks Here, an attacker performs active or passive scanning in an attempt to discover weak access controls. For example, an attacker can use a port scanning tool to discover open and possibly vulnerable ports on target systems. Or, an attacker can listen to Wi-Fi network traffic to look for vulnerable wireless access points in an activity known as war driving. NOTE The potency and frequency of threats on a system is directly proportional to the perceived value of assets that the system contains or protects.VulnerabilitiesVulnerabilities are the weaknesses that may be present in a system that allow a threat tobe more easily carried out. Vulnerabilities by themselves do not bring about actual harm. Instead, threats andvulnerabilities work together. Most often, a threat exploits a vulnerability because it iseasier to attack a system at its weakest point. Common vulnerabilities include: • Unpatched systems Security patches are designed to remove specific vulnerabilities. A system that is not patched still has vulnerabilities, many of which are easily exploited. Attackers can easily enter and take over systems that lack important security patches. • Default system settings Default settings often include unnecessary services that increase the chances that an attacker can find a way to break in to a system. The practice of system hardening is used to remove all unnecessary services and to make security configuration changes on a system to make it as secure as possible. • Default passwords Some systems are shipped with default administrative passwords that make it easy for a new customer to configure the system. One problem with this arrangement is that many organizations fail to change these passwords. Hackers have access to extensive lists of default passwords for practically every kind of computer and device that can be connected to a network. • Incorrect permissions settings If the permissions that are set up for files, directories, databases, application servers, or software programs are incorrectly set, this could permit access—and even modification or damage—by persons who should not have access. • Application logic Software applications—especially those that are accessible via the Internet—that contain inadequate session management and input testing controls can potentially permit an intruder to take over a system and steal or damage information.

CISA Certified Information Systems Auditor All-in-One Exam Guide340 Familiarity with Technology Is Key to IS Audit The IS auditor needs to be highly familiar with information technologies to be effective. Without in-depth knowledge of security threats and vulnerabilities, the IS auditor will not be able to detect any unsafe practices in a technology environ- ment. Furthermore, without a depth of understanding, IS auditors will not be able to ask probing questions in walkthroughs or be able to correctly interpret evidence. The IS auditor must understand information technology in general, but she must also understand the technology architecture in the specific environment that she is examining. In an environment that has the appearance of being highly secure, a configuration error in a single device can betray that security like a trai- tor. Only an IS auditor with a thorough understanding of information technology would have a chance to detect such a weakness. Access Points and Methods of Entry Computing and network resources must be accessed in order to provide value. The majority of information-based resources are accessed via TCP/IP networks; some re- sources are accessed using other technologies, such as direct hardwired connections (as in the case of some mainframe computers) and non-TCP/IP network technologies. Then there are desktop computers that sometimes themselves contain information and resources. Modern LAN environments are protected from outside threats with firewalls. Many larger organizations also employ internal firewalls that create separate zones of trust within the organization. But generally speaking, LANs are a lot like highway systems within individual countries: Once you pass a border checkpoint and show a passport or other credential, you can roam freely inside that country unhindered. Points of Entry The main point of entry in most organizations is the internal corporate LAN. A user who can connect to the corporate LAN is able to logically reach virtually every comput- ing resource in the organization—subject to the access controls associated with each resource. This makes the notion of protecting corporate accesses by controlling access to the LAN an important topic. The ease of connectivity to the corporate LAN highlights a number of important security issues. Probably the biggest issue is the ability for non-organization-owned computers to connect to the network and access network-based resources. By permit- ting non-organization-owned systems to connect to the network, the organization is essentially giving up control of the network. By letting any computer or device connect to the network, this creates risks, including:

Chapter 6: Information Asset Protection 341 • Exposure to malware Any computer that is not actively managed by centralized antivirus software could be carrying malware that would attempt to propagate itself inside the corporate network. Indeed, worms such as Nimda and Code Red were able to spread in just this way. Laptops that were the personal property of employees would become infected on home networks and then spread the infection inside the corporate LAN in “typhoid Mary” style. Many instances of malware being imported on vendor-owned computers (for “demo” purposes) are also known. • Eavesdropping While the IT department can exert some level of control over desktop and server computing by prohibiting (and even preventing) the installation of network sniffing programs, IT cannot easily control whether non-organization-owned computers have network sniffing programs (or malware that does the same thing!). • Open access A corporate LAN that permits any device to connect will permit a wireless access point to connect to the network. This, in turn, may permit anyone with a Wi-Fi client to connect to the network. Permitting any type of device to connect could also permit the use of dial-in modems (although these would be a bit more difficult to set up, since analog phone lines would also be needed). Technologies are now available that are used to control the systems that are permit-ted to connect to the corporate LAN. The 802.1X network access control protocol isused to control whether a system is permitted to connect to corporate network resourc-es. 802.1X uses an authentication mechanism to determine if each new device is per-mitted to connect. If the device lacks the necessary credentials, it cannot connect. This is not the same as whether the device is able to physically connect. Rather,network switches play a role in 802.1X; if a device is not permitted onto the network,the workgroup switch will not route any packets from the denied workstation into theLAN. The workstation remains logically disconnected.Remote AccessRemote access is defined as the means of providing remote connectivity to a corporateLAN through a data link. Remote access is provided by most organizations so that em-ployees who are temporarily or permanently off-site can access LAN-based resourcesfrom their remote location. Remote access was initially provided using dial-up modems that included authen-tication. While remote dial-up is still provided in some instances, most remote accessis provided over the Internet itself, and typically uses an encrypted tunnel known as avirtual private network (VPN) to protect transmissions from any eavesdroppers. VPNsare so prevalent in remote access technology that the terms VPN and remote access havebecome synonymous. Remote access architectures are depicted in Figure 6-1.

CISA Certified Information Systems Auditor All-in-One Exam Guide342 Figure 6-1 Remote access architectures The two security controls that are essential for remote access are: • Authentication It is necessary to know who is requesting access to the corporate LAN. Authentication may consist of the same user ID and password that personnel use when on-site, or they may be required to provide additional credentials, such as a group or site password, token, or biometric. • Encryption Many on-site network applications do not encrypt sensitive traffic because it is all contained within the physically and logically protected corporate LAN. However, since remote access gives the same function as being on the corporate LAN, and because the applications themselves usually do not provide encryption, the remote access service itself usually provides encryption. Encryption may use SSL, IPsec, L2TP, or PPTP. These controls are needed because they are a substitute (or compensating control) for the physical access controls that are usually present that control which personnel may enter the building to use the on-site corporate LAN. When personnel are on-site, their identity is confirmed through keycard or other physical access controls. When person- nel are off-site using remote access, since the organization cannot see the person on the far end of the remote access connection, the authentication that is used is the next best thing.

Chapter 6: Information Asset Protection 343Identification, Authentication, and AuthorizationTo control access, computing resources are protected by mechanisms that ensure thatonly authorized subjects are permitted to access protected information. Generally, thesemechanisms first identify who (or what) wants to access the resource, and then theywill determine if the subject is permitted to access the resource and either grant or denythe access. This section discusses the matter of identifying the subject. Several terms are used todescribe various activities, including identification, authentication, and authorization,and are explained here.IdentificationIdentification is the act of asserting an identity without providing any proof of it. Thisis analogous to one person walking up to another and saying, “Hello, my name is ______.” Because it requires no proof, identification is not usually used to protect high-value assets or functions. Identification is often used by web sites to remember someone’s profile or prefer-ences. For example, a nationwide bank’s web application may use a cookie to store thecity in which the customer lives. When the customer returns to the web site, the applica-tion will display some photo or news that is related to the customer’s location. Butwhen the customer is ready to perform online banking, this simple identification isinsufficient to prove the customer’s actual identity. Identification is just the first step in the process of gaining entry to a system or applica-tion. The next steps are authentication and authorization, which are discussed next.AuthenticationAuthentication is similar to identification, where a subject asserts an identity. In identi-fication, no proof of identity is requested or provided, but with authentication, someform of proof of the subject’s identity is required. That proof is usually provided in theform of a secret password or some means of higher sophistication and security, such asa token, biometric, smart card, or digital certificate. Each of these is discussed later inthis section.AuthorizationAfter a subject has been authenticated, the next step is authorization. This is the processby which the system determines whether the subject should be permitted to access therequested resource. To determine if the subject is permitted to access the resource, thesystem will perform some type of a lookup or other business rule. For instance, an accesscontrol table associated with the requested resource may have a list of users who arepermitted to access it. The system will read through this table to see whether the subject’sidentity appears in the table. If so (and if the type of requested access matches the typepermitted in the table), the system will permit the subject to access the resource. If theuser’s identity does not appear in the table, the subject will be denied access. The preceding example is simplistic, but is often the means used to determine ifa user is authorized to access something. Typically, permissions are centrally storedby the operating system and administered by system administrators, although some

CISA Certified Information Systems Auditor All-in-One Exam Guide344 environments permit the owners of resources to administer user access. See the sec- tions on Mandatory Access Control (MAC) and Discretionary Access Control (DAC) earlier in this chapter. NOTE The terms identification, authentication, and authorization are often misused by IT professionals, who may not realize the differences between them. Security professionals and IS auditors need to understand the differences. User IDs and Passwords User IDs and passwords are the most common means for users to authenticate them- selves to a resource, whether it is a network, server, or application. User IDs In most environments, a user’s user ID will not be a secret; in fact, user IDs may be a derivation of the user’s name or their identification number. Some of the common forms of a user’s user ID are: • First initial and last name For example, the user ID for John Toman would be jtoman. Some systems may have a limitation on the permitted length of a user ID—for instance, eight characters. If two users’ user IDs would be the same (John Brown and James Brown, for example), the IT department could assign “jobrown” and “jabrown,” or “jbrown” and “jbrown2.” • First and middle initials and last name Similar to first initial and last name, but with fewer chances for “collisions” (two persons who would have the same user ID). User Howard W. Chang would have a user ID “hwchang.” • First and last name together Systems that permit longer user IDs with special characters such as “.” can adopt the common first.last form. User Rajendra Patel would have the user ID “rajendra.patel.” • Employee ID number Some organizations assign unique identifying numbers to its employees, and these can be used as user IDs if those numbers are not kept secret. One advantage of using an ID number is that the user’s name becomes a characteristic of the user ID and not the user ID itself; in many cultures, a woman’s name changes when she marries, but in an organization that uses ID numbers, the user ID need not change (or reflect a name she no longer has). NOTE Confidential numbers such as social insurance (Social Security in the United States) or driver’s license numbers should not be used as user IDs, as these identifying numbers are generally meant to be kept confidential. Passwords Whereas a user ID is not necessarily kept confidential, a password al- ways is kept confidential. A password, also known as a pass phrase, is a secret combina- tion of letters, numbers, and other symbols that is known only to the user who uses it. End users are typically advised the following about passwords:

Chapter 6: Information Asset Protection 345 • Selecting a password Users should select a password that is easy for them to remember but difficult for others to guess. Passwords should not contain common words or words that are the names of their family members or pets, nor should they contain numeric combinations representing birthdays or wedding anniversaries. Many environments require passwords of a minimum length (typically eight characters), and they require that passwords contain some combination of lowercase letters, uppercase letters, numbers, and symbols. Many environments also require that passwords be changed periodically, typically every 90 days. They also forbid the use of recently used passwords, which lowers the risk of someone else using a previous password. • Sharing passwords Users should be told that they should never share any password with any other person, for any reason! User accounts must be used only by the person to whom they are assigned and by no one else in any situation. In many organizations, sharing passwords can result in termination of employment. • Transmitting passwords Passwords should never be sent in an e-mail message. An eavesdropper or any person who intercepts the message would then know the password and may be able to use it, compromising the integrity of the user account and possibly of some sensitive business information as well. • Writing down passwords In environments with many applications, there can be many passwords to remember. Users will be tempted to write them down or save them in a spreadsheet or text file on their workstation. It would be acceptable for users to write down their passwords, provided they keep the paper with those passwords locked away or on their person always. • Electronic password vaulting With so many complex passwords to remember, users could store their passwords in an electronic password vault; a number of good ones are available, including Password Safe and KeePass. NOTE Users should be advised to not store their passwords in any online password archival service. • Managing passwords in multiple environments Users are urged to not use the same password for every application. If anyone should discover or learn their password in one environment, they could try that same password in other applications and possibly be able to log in. Difficult as it is, users should use unique passwords in each environment.User Account Provisioning When a user is issued a new computer or networkuser account, somehow they need to know the password. Generating and transmittingan initial password to a user can be tricky (because passwords should never be sent inan e-mail message). A sound practice for initial user account provisioning would in-volve the use of a limited-time, one-time password that would be securely given to theuser; upon first use, the system would require that the user change the password to avalue that no one else would know.