Access Control
Access Control Procedure prevents unauthorized access to—and use of—your company's information. The access control procedure ensures your information's security, integrity and availability to appropriate parties.
Activities Covered in the IT Access Control Procedure
- Planning IT Access Control
- IT Access Control Plan
- IT Access Control Plan Review
- IT access Control Plan Update
References Used in the IT Access Control Procedure
- ISO 17799:2005- Information Technology- Code of Practice for Information Security Management, Clause 9 (Access Control)
- IEEE 802.1X- Port-Based Network Access Control Standard
- IEEE Special Publication 802.12- An Introduction to Computer Security- The NIST Handbook
Forms Included in the IT Access Control Procedure
- IT Access Control Plan Form
- IT User Access Control Database Form
- Access Control Log Form
- User Account Conventions Form
Email Security
• Threats to the security of e-mail itself
– Loss of confidentiality
• E-mails are sent in clear over open networks
• E-mails stored on potentially insecure clients and mail servers
– Loss of integrity
• No integrity protection on e-mails; body can be altered in transit or on mail server
– Lack of data origin authentication
– Lack of non-repudiation
– Lack of notification of receipt
• sure of sensitive information
• Exposure of systems to malicious code
• Denial-of-Service (DoS)
• Unauthorized accesses etc.
Worldwide attack trend
Code Red doubled its infection rate every 37 minutes. Slammer doubled every 8.5 seconds, and infected 90% of unprotected servers in 10 minutes!
Exploits now appearing just 5 days after the vulnerability is publicly disclosed!
At its peak, 1 out of every 12 emails was infected with MyDoom!
How to protect?
• Secure the server to client connections (easy thing first)
– POP, IMAP over ssh, SSL
– https access to webmail
– Very easy to configure
– Protection against insecure wireless access
• Secure the end-to-end email delivery
– The PGPs of the world
– Still need to get the other party to be PGP aware
– Practical in an enterprise intra-network environment
· Email based attack
• Active content attack
– Clean up at the server (AV, Defang)
• Buffer over-flow attack
– Fix the code
• Shell script attack
– Scan before send to the shell
• Trojan Horse Attack
– Use “do not automatically use the macro” option
• Web bugs (for tracking)
– Mangle the image at the mail server
· Email SPAM
• Cost to exceed $10 billion
• SPAM filtering
– Content based – required hits
– White list
– Black list
– Defang MIME
PGP
• PGP=“Pretty Good Privacy”
• First released in 1991, developed by Phil Zimmerman
• Freeware: OpenPGP and variants:
• OpenPGP specified in RFC 2440 and defined by IETF OpenPGP working group.
– www.ietf.org/html.charters/openpgp-charter.html
• Available as plug-in for popular e-mail clients, can also be used as stand-alone software.
• Functionality
– Encryption for confidentiality.
– Signature for non-repudiation/authenticity.
• Sign before encrypt, so signatures on unencrypted data - can be detached and stored separately.
• The sending PGP entity performs the following steps:
– Signs the message:
• PGP gets sender’s private key from key ring using its user id as an index.
• PGP prompts user for passphrase to decrypt private key.
• PGP constructs the signature component of the message.
– Encrypts the message:
• PGP generates a session key and encrypts the message.
• PGP retrieves the receiver public key from the key ring using its user id as an index.
• PGP constructs session component of message
• The receiving PGP entity performs the following steps:
– Decrypting the message:
• PGP get private key from private-key ring using Key ID field in session key component of message as an index.
• PGP prompts user for passphrase to decrypt private key.
• PGP recovers the session key and decrypts the message.
– Authenticating the message:
• PGP retrieves the sender’s public key from the public-key ring using the Key ID field in the signature key component as index.
• PGP recovers the transmitted message digest.
• PGP computes the message for the received message and compares it to the transmitted version for authentication.
