Security

Security Awareness
Termphong Tanakulpaisal

Technical Manager – IT Distribution Co.,LTD

 Agenda

• Introduction to network security

– How many type of assets in IT system?
– Which’s the most important asset?
– Why protect information? (most important one)
– So we need information security
– How to achieve the information security >> CIA concept
– Key success factor summary
• Network threats
– What’s threat and example?
– How to overcome threat? (with security protection concept)
– How to overcome threat? (with tools)
• Network based protection system
• Host based protection system
• Case Study
 Company Assets

• Hardware (Physical Assets)

• Software
• System interfaces (e.g., internal and external
connectivity)
• Data and information
• Persons who support and use the IT system
• System mission (e.g., the processes performed by
the IT system)
• System and data criticality (e.g., the system’s value
or importance to an organization)
• System and data sensitivity

NIST SP 800-30
 Information Assets

• Information is an asset which, like

other important business assets,
has value to an organization and
consequently needs to be suitably
protected
» ISO/IEC17799: 2000
 Why Information Assets are the most important?

• Business Requirements
– Client / customer / stakeholder
– Marketing
– Trustworthy
– Internal management tool
• Legal Requirements
– Revenue Department
– Stock Exchange of Thailand
– Copyright, patents, ….
 Why Information Assets are the most
important?(2)

• Contractual Security Obligations

– Intranet connections to other BU
– Extranets to business partners
– Remote connections to staff
– VPN
– Customer networks
– Supplier chains
– SLA, contracts, outsourcing arrangement
– Third party access
 Why we need information Security?

• Information security protects information from

wide range of threats in order to
– Ensure Business Continuity
– Minimize Business Damage
– Maximize ROI and Business Opportunities
• Business : Stable service to customer
• Education : Availability of resources and integrity of
information e.g. grade, profile, etc.
» ISO/IEC17799: 2000 page iii, Introduction
 How much should we spend on IT security?

Q: How much for that each

company should spend or plan
for their Information System?

A: …………… Baht / year

Q: How much for that each

company should spend or plan
for their Information Security?

A: …………… Baht / year

 Why we need information Security?(2)
Business impact Analysis

How much does it cost per hour if people in your organization

cannot access their information?

(Business Impact Analysis)

One big Organization -> approx 10 mil / day

-> working hours 8 hrs
-> 1.25 mil / hr
-> 10% margin = 125k / hr
if we’ve got 10 sale persons it means that we’ve lose
12,500 baht / hr if 1 salesperson can’t access their information
 …. some more calculations…

• 100 people start their day clearing junk mails, each receives 20 junk
mails per day, each mail needs 10 seconds to open/read/delete
• Each of these staffs gets average THB18,000 income/month from
the company
– Company pays THB 102.27/staff/hr
– 100 people x 10 sec/mail x 20 mails/day x 220 days/yr = 1,222.2
hrs/year
– Company pays for this “clearing junk mail” 125,000 Baht/year
• Do you believe that
– There are only 20 junk mails per day?
– Average time spent is only 10 seconds/junk mail?
– You pay only 18,000 Baht/month?
 …. some more calculations…

• What is a typical cost when the system is attack by

virus / worm?
– Amount of data destroyed and its cost
– Man-hour of support staff to clean the virus
– Idle time of other staff waiting for the system to come back
– Your customers’ satisfaction
– Your company’s reputation
 So, a company spends …….. Baht each time the
virus attacks
 Security Concept

• Security is preservation of confidentiality, integrity

and availability of information
• Confidentiality
– Ensuring that information is accessible only to those
authorized to have access
• Integrity
– Safeguarding the accuracy and completeness of
information and processing methods
• Availability
– Ensuring that authorized users have access to information
and associated assets when required
» BS7799-2: 2002 page3, 3.1, 3.2, 3.3
 Key success to obtain CIA

• Policy/Process/Pocedure
– Clear
– Coverage
– Compliance – Legal, Standard, guideline etc.
• People
– Awareness (e.g. Password on screen)
– Discipline
• Technology
– Enablers
– Management Tools
 What is Threat?

• Could be anything that harm your system

e.g.
– User
– Hacker/ cracker
– Virus
– Spam
– Etc.
 Key Factors Driving Threat over network

• Internet connection speeds are increasing for SMB as prices and

technology improves:
– DSL, cable modem, T1 (business class connection services)
• Increase in real-time Internet applications
– Web apps, VoIP, downloads, etc. require real-time security processing
• Everything become online
 Nowadays threat to you IT system

• Non-Computerized system
– Masquerade
– Social Engineering
– Theft
– System malfunction (disaster, power interruption)
• IT Network Threat
– Network Level
– Application Level
 Threat – Network Level

• Denial of Services
– Services has been disable by excessive
workload.
• Information sniffing
– Information has been tapped and viewed by
unauthorized person
• Unauthorized access
– Low level worker can access to critical
information.
 Sample of Threats

 Snooping

202.104.10.5

m-y-p-a-s-s-w-o-r-d
203.152.145.121

Telnet 203.152.145.121
username:daeng
password:
 Sample of Threats (cont.)

 3-way handshake
3-way handshake

SYN REQ
WWW
SYN ACK

ACK

DATA TRANSFER
 Sample of Threats (cont.)

 SYN attack

202.104.10.5 2 203.152.145.121
SYN ACK D=202.104.10.5 S=203.152.145.121
WAIT

Internet WWW

Attacker

1
SYN REQ D=203.152.145.121 S=202.104.10.5
 Sample of Threats (cont.)

 Smurf Attack

ICMP REPLY D=203.152.149.1 S=192.168.1.1

ICMP REPLY D=203.152.149.1 S=192.168.1.2

ICMP REPLY D=203.152.149.1 S=192.168.1.3 Internet

203.152.149.1
ICMP REPLY D=203.152.149.1 S=192.168.1.4
ICMP REPLY D=203.152.149.1 S=192.168.1.5

ICMP REPLY D=203.152.149.1 S=192.168.1.6

ICMP REPLY D=203.152.149.1 S=192.168.1.7

ICMP REPLY D=203.152.149.1 S=192.168.1.8

192.168.1.0

ICMP REQ D=192.168.1.255 S=203.152.149.2

 Threat – Application Level - Virus

• Virus vs Worms..?
– Virus
• Viruses are computer programs that are designed to spread
themselves from one file to another on a single computer.
• A virus might rapidly infect every application file on an
individual computer, or slowly infect the documents on that
computer,
• but it does not intentionally try to spread itself from that
computer to other computers.

– Worms
• Worms, on the other hand, are insidious
• because they rely less (or not at all) upon human behavior in
order to spread themselves from one computer to others.
• The computer worm is a program that is designed to copy
itself from one computer to another over a network (e.g.
by using e-mail).
 Threat – Application Level – Spam Mail

• E-mail spoofing
– Pretend to be someone e.g.
[email protected],
• Spam Mail
– Unsolicited or unwanted e-mail or Phising
 Threat – Application Level - Desktop

 Desktop Threat
 Viruses, worms, Trojan, Backdoor
 Cookies
 Java Script and Java Applet
 Zombies network
 Key logger (Game-Online)
 How to overcome Threat?

• We need “control” which are

– Policy & Process security control to provide
guideline and framework
– People to control user behavior
– Technology will be a tool in order to enforced
Policy throughout the organization effectively.
 Policy & Process Control

• Policy Compliance
– ISO 17799
• Compliance Checking
– CobiT Audit Tools
• NIST security standard guideline
– NIST – 800 series
• Organization Control
– Business Continuity Plan
 People Control

• Security Awareness Training

• Security Learning Continuum
– Awareness, Training, Education
• Responsibility Control
– Need to know basis
 People Control - Example (2)

• Don't install free utilities on your computer

• Run the current version of supported antivirus
software and set it for regular, automatic updates
• Assign a complex, hard-to-guess password to your
computer (on-screen, pool)
• Be alert for "phishing" scams that can result in
identity theft
• Promptly apply security "patches" for your operating
system.
• Activate your system’s firewall (Windows XP &
Macintosh OS X)
 Technology Control

• Computer Security is the process of preventing

and detecting unauthorized use of your computer
• Prevention measures help you to stop unauthorized
users (intruders) from accessing any part of you
computer network
• Detection helps you to determine whether or not
someone attempted to break into your system, if
they were successful, and what they may have
done.
• Network and Host Based Security
– Security Devices (Hardware) or Security Software
 Network Security Protection

• Firewall (Access control)

• IDS/IPS
• VPN & SSL VPN (Data Encryption)
• Anti-Spam (preventing un-wanted email)
• QoS (Quality of Services - Bandwidth
Management)
• Web Content Filtering
• IM & P2P
 Firewall (Access Control)

Web Traffic—
customers, partners, employees

Email Traffic

Applications/Web Services Traffic

partners, customers, internal

VPN Traffic
Remote user remote and mobile users

Internal security threat

Contractors/disgruntled employees
 Type of firewall
Packet Filter

• Type of firewall
– Packet filtering
Screened Host
– Application Firewall
– Stateful Inspection
• Type of implementation Dual home Host

– Packet Filter
– Screened host
– Dual home Host Screened Subnet
– Screen Subnet (DMZ)
References: CISSP Certification
Basic Firewall Implementation
Intrusion Detection & Intrusion Prevention Solution

Known Zero-day
DOS/DDOS
Attacks Attacks

Laptop Desktop Server Core Edge Branch Office

Host IPS Network IPS

 IDS/IPS

• Detection & Prevention System

• Signature & Behavior & Anomaly based
 Virtual Private Network (VPN)

• Encryption & Decryption

• Public Key & Private Key
• Encryption Technology
– DES
– 3DES
– AES
Anti-Spam

Source: Symantec/
Brightmail
 How serious spam is?

• Why do they spam?

– 0.0005$ vs 1.21$ -> 0.02B vs 48.4B
– 1/100,000 count as success
• How much does spam is? <spamcorp.net>
– ~6 e-mail/sec 360 e-mail/min 21,600 e-mail/hr
• How do they get my e-mail?
– Webboard, forum, etc.
• Does spam legal?
• How to Protect yourself from getting spam?
 Why Spam Matters for Business

• Before: a nuisance -> Today: a serious business problem

Problems Symptoms Business Impacts

• Employees are spending 50 or more

• Employees deleting spam
1) Lost Employee hours per year dealing with spam
• Employees complaining
Productivity • With AntiSpam solutions costing $10-15
about spam
per year – significant positive ROI

• IT administrator salary • IT administrators responding to help desk

2) Unnecessary • Mail server CPU tickets to fight spam with no tools
IT Costs • Storage • Spam requiring constant upgrading of
• Bandwidth mail infrastructure capacity

• Employees and customers • Damage to brand

3) Phishing and
falling victim to fraud and
email fraud
identify theft • Support cost
Phising Example
Phising Example
Phishing Example (2)
Spam control
 Web-Content Filtering

• Cracks and Hacks Tools Website

– Spyware, Trojan, Virus, etc.
• Banner & Advertising
– Adware, Toolbar, Spam – Subscribe, Credit card
no., etc.
• Drugs, Gambling, Weapon, etc.
• Pornography, Nude, Adult Materials
• Shopping Online (Credit card issues)
 FortiGuard Web Filtering Enhancements

• Block Override
– Authoritative user logs in to enable
site block override
– Bypasses filter block on a user’s
session and lasts until timer expires
• Rate Image
– URL rating capabilities are extended
to include image URLs contained in
web page – rates gif, jpeg, png,
bmp, and tiff images
• Web Filter Consolidation
– Web filter menu items of URL
Exempt, URL Block, and Web
Pattern have been consolidated to a
single menu item to speed
configuration
• Active Directory Integration
– Single sign-on
– Policy based on AD User/Group
– Requires FSAE agent software
Web Filtering: Banned Word
 Desktop Security

• Anti – Virus
• VPN - Client
• Personal Firewall
• IDS
• Web-Filtering
– Small group, Home used, Computer Laboratory,
etc.
URL Filtering
 Instant Messaging(IM)/Peer-to-Peer(P2P)

• IM
– Virus
– Exploit
– Voice Chat
• P2P
– Bandwidth Usage
– Spyware
– BackDoor
 Enterprise IM, P2P Challenges

Worms programmed to chat Viruses, worms

Virus via malicious URL
Rootkit via file install

Internet
Traffic bottlenecks

Confidentiality breech

Lack of visibility / management tools

• Lack of usage & user controls

• Protecting against new threats
• Gaining control of bandwidth usage
• Management & reporting insight
IM & P2P Access Control
Gartner’s Analysis
Regulations Don’t Matter, but Auditors Do
Convergence Brings Evolutionary Efficiencies
Cyberthreat Hype Cycle
 Conclusion

• PPT
• Security system without performance degradation
• "You don't put brakes on a car to go slower, you put
brakes on a car to go faster, more safely. Along the
same lines, IT security is not meant to slow down a
company, but rather to enhance and facilitate the
growth of a company... safer growth."--Quoted from
Gartner Group's Information Security Show, June
2001