Lecture Security + Guide to Network Security Fundamentals - Chapter 10 include objectives: Harden physical security with access controls, minimize social engineering, secure the physical environment, define business continuity, plan for disaster recovery.
Chapter 10: Operational Security Security+ Guide to Network Security Fundamentals Second Edition Objectives • Harden physical security with access controls • Minimize social engineering • Secure the physical environment • Define business continuity • Plan for disaster recovery Hardening Physical Security with Access Controls • Adequate physical security is one of the first lines of defense against attacks • Protects equipment and the infrastructure itself • Has one primary goal: to prevent unauthorized users from reaching equipment to use, steal, or vandalize Hardening Physical Security with Access Controls (continued) • Configure an operating system to enforce access controls through an access control list (ACL), a table that defines the access rights each subject has to a folder or file • Access control also refers to restricting physical access to computers or network devices Controlling Access with Physical Barriers • Most servers are rack-mounted servers • A rack-mounted server is 1.75 inches (445 cm) tall and can be stacked with up to 50 other servers in a closely confined area • Rack-mounted units are typically connected to a KVM (keyboard, video, mouse) switch, which in turn is connected to a single monitor, mouse, and keyboard Controlling Access with Physical Barriers (continued) Controlling Access with Physical Barriers (continued) Controlling Access with Physical Barriers (continued) • In addition to securing a device itself, you should also secure the room containing the device • Two basic types of door locks require a key: – A preset lock (key-in-knob lock) requires only a key for unlocking the door from the outside – A deadbolt lock extends a solid metal bar into the door frame for extra security • To achieve the most security when using door locks, observe the good practices listed on pages 345 and 346 of the text Controlling Access with Physical Barriers (continued) • Cipher locks are combination locks that use buttons you push in the proper sequence to open the door • Can be programmed to allow only the code of certain people to be valid on specific dates and times • Basic models can cost several hundred dollars each while advanced models can run much higher • Users must be careful to conceal which buttons they push to avoid someone seeing the combination (shoulder surfing) Controlling Access with Physical Barriers (continued) • Other physical vulnerabilities should be addressed, including: – Suspended ceilings – HVAC ducts – Exposed door hinges – Insufficient lighting – Dead-end corridors Understanding Business Continuity (continued) • The basic steps in creating a BCP: – Understand the business – Formulate continuity strategies – Develop a response – Test the plan Maintaining Utilities • Disruption of utilities should be of primary concern for all organizations • The primary utility that a BCP should address is electrical service • An uninterruptible power supply (UPS) is an external device located between an outlet for electrical power and another device – Primary purpose is to continue to supply power if the electrical power fails Maintaining Utilities (continued) • A UPS can complete the following tasks: – Send a special message to the network administrator’s computer, or page or telephone the network manager to indicate that the power has failed – Notify all users that they must finish their work immediately and log off – Prevent any new users from logging on – Disconnect users and shut down the server Establishing High Availability through Fault Tolerance • The ability to endure failures (fault tolerance) can keep systems available to an organization • Prevents a single problem from escalating into a total disaster • Can best be achieved by maintaining redundancy • Fault-tolerant server hard drives are based on a standard known as Redundant Array of Independent Drives (RAID) Creating and Maintaining Backups • Data backups are an essential element in any BCP • Backup software can internally designate which files have already been backed up by setting an archive bit in the properties of the file • Four basic types of backups: – Full backup – Differential backup – Incremental backup – Copy backup Creating and Maintaining Backups (continued) Creating and Maintaining Backups (continued) • Develop a strategy for performing backups to make sure you are storing the data your organization needs • A grandfather-father-son backup system divides backups into three sets: – A daily backup (son) – A weekly backup (father) – A monthly backup (grandfather) Creating and Maintaining Backups (continued) Planning for Disaster Recovery • Business continuity is concerned with addressing anything that could affect the continuation of service • Disaster recovery is more narrowly focused on recovering from major disasters that could cease operations for an extended period of time • Preparing for disaster recovery always involves having a plan in place Creating a Disaster Recovery Plan (DRP) • A DRP is different from a business continuity plan • Typically addresses what to if a major catastrophe occurs that could cause the organization to cease functioning • Should be a detailed document that is updated regularly • All DRPs are different, but they should address the common features shown in the outline on pages 367 and 368 of the text Identifying Secure Recovery • Major disasters may require that the organization temporarily move to another location • Three basic types of alternate sites are used during or directly after a disaster – Hot site – Cold site – Warm site Identifying Secure Recovery (continued) • A hot site is generally run by a commercial disaster recovery service that allows a business to continue computer and network operations to maintain business continuity • A cold site provides office space but customer must provide and install all equipment needed to continue operations • A warm site has all equipment installed but does not have active Internet or telecommunications facilities Protecting Backups • Data backups must be protected from theft and normal environmental elements • Tape backups should be protected against strong magnetic fields, which can destroy a tape • Be sure backup tapes are located in a secure environment that is adequately protected Summary • Adequate physical security is one of the first lines of defense against attacks • Physical security involves restricting with access controls, minimizing social engineering attacks, and securing the environment and infrastructure • Business continuity is the process of assessing risks and developing a management strategy to ensure that business can continue if risks materialize Summary (continued) • Disaster recovery is focused on recovering from major disasters that could potentially cause the organization to cease operations for an extended period of time • A DRP typically addresses what to if a major catastrophe occurs that could cause the organization to cease functioning ... Availability through Fault Tolerance • The ability to endure failures (fault tolerance) can keep systems available to an organization • Prevents a single problem from escalating into a total disaster •... is to continue to supply power if the electrical power fails Maintaining Utilities (continued) • A UPS can complete the following tasks: – Send a special message to the network administrator’s... subject has to a folder or file • Access control also refers to restricting physical access to computers or network devices Controlling Access with Physical Barriers • Most servers are rack-mounted