• structured process of denying advesaries to critical info

1. ID Critical Information
2. Analyze Threat
3. Analyze Vulnerabilities
4. Assess risk
5. Apply suitbale OPSEC measures

1. User safeguard info; protect credentials
2. System Admin implement operational environment for applications & users; AVAILABILITY; backup & restore, maintenance
3. Security Admin pw maintenance, review logs, FW admins, review SW updates, maintain audit logs

1. Security Clearance
   
   
2. PW/PW Mgt issue pw, how often change, enforce strong pw
3. Account Characteristics usernames, pw, age limits, account status, user groups like Admin/Server Operators/Account Operators/Print Operators
4. Special Privileges need to know & least privilege, advice from owners

• description of security relevent elements about each user in system
• username
• group memberships
• PW strength, requirements

1. Redundancy
   
2. Fault tolerance
   
3. Backup and restore
   
4. Material safeguarding safeguarding classified info; AC
5. Material Destruction
   
6. Material Reuse

• Preventive
• Detective
• Corrective
• Directive
• Recovery
• Deterrent
• Compensating

• SoD
• Need to Know
• Least Priv
• Job Rotation
• Mandatory Vacations
• Antivirus Mgt
• Audit
• Closed Shop
• Change Ctrl

• practice of recording sec.-relevant events in audit file for future analysis
• internal/ext
• system/app/user-level
• admin enables
• admin selects events
• record in log

• reduce log size
• eliminates more media storage
• set limit on # of logs for incident

1. ID Event
2. Time of Event
3. ID of individual/process causing event

System logs:

• login attempt
• login success/fail
• logouts
• applicatin accessing
• file creations/deletions/modificaitons
• account creation/modification/deletion

Application/DB Audit Logs:

• transaction processed
• data status before/after transactions
• transaction failures/backout

• practice of monitoring operations controls to ID abnormal computer activity
• IDS/Penetration Testing/Violation Processing

• tracks anomalies in user activity
• also known as violation processing/tracking
• uses clipping levels

• source
• frequency
• severity
• response

• disclosure
• destruction
• interruption of service
• corruption/modification
• theft
• espionage
• hacker/crackers
• malicious code

1. Physical unauth access to facility/theft/damage/disconnect electric&com
2. Logical pw crack/man-in-middle/insert virus/pw compromising/social engineering

• System cleaning clean of attack to return to operational state (trusted recovery);virus removal/restore/reload SW & data
• Assessing training/awareness
  
• Evaluating protection updating security policies; testing current security
• Vulnerability testing ID system flaws