Network Perimeter Security: Building Defense In-Depth

2.8 Proteris Security Standards and Procedures

2.8.1 Abstract

The purpose of this document is to provide detailed information supporting the Proteris Security policy. The Proteris Security policy can be found electronically at http://house.proteris.com.

2.8.2 Context

Proteris maintains a worldwide reputation for quality technical training and consulting. Our clients expect and receive…

2.8.3 Standards and Procedures

2.8.3.1 Administrative Security: Password Standards.

The confidentiality of information is a critical element in the success of Proteris' business model. To support this confidentiality, all passwords shall meet the following requirements.

2.8.3.2 Technology/Network/Computer Systems Standards: Router Security Standards.

Routers serve a critical role in the transfer of information on the Proteris network. As such, their configuration will reflect their central nature in the confidentiality, integrity, and availability of Proteris information assets. All log-ins must be done through unique usernames and authenticated through RADIUS. In the event of an emergency or failure of the RADIUS system, local log-on to the router shall be allowed through the use of unique user names and passwords for each authorized router administrator.

2.8.3.3 Physical Security Standards: External Boundary Protection Standards.

Information security is part of a process that includes many different elements of security. For Proteris to meet its information security requirements, it must take steps to reduce the risks of physical trespass and unauthorized entry to Proteris offices. Proteris will install lighting sufficient to illuminate the Proteris office perimeters to a minimum of eight feet in height and two feet from the external wall.

Each of these sections would be much longer and contain details for all the security elements of their respective categories. Information in the Standards and Procedures, AUP, Incident Response, and Disaster Recovery and Planning documents should all have similar forms. This information, while discussing the specific countermeasures to be used for reducing risk to the Proteris network is still not specific enough to actually guide the implementation. Instead, a Security Configuration Guide is required. Along with the information above, a definitions section and a table of contents or index should be included as well.

Like the Standards and Procedures document, the Security Configuration Guide is broken into specific sections. For the sake of simplicity, I generally use the actual requirements set out in the Standards and Procedures document to organize the Security Configuration Guide. For example, from the section on router security, we might see something like this:

2.8.3.4 All Passwords on the Router Will Be Kept in Encrypted Form.

The configuration statement service password-encryption will be included as part of the standard Cisco router configuration. For a complete sample template with annotations, refer to Cisco Router IOS 12.2(5) Proteris Secure Template ver 1.25.

2.8.3.5 All Services Not Essential to the Forwarding and Logging Functions of the Router Will Be Disabled.

The following configuration statements disable unnecessary Cisco router functions:

For a complete sample template with annotations, refer to Cisco Router IOS 12.2(5) Proteris Secure Template ver 1.25.

The configuration guidelines would continue for this section and each countermeasure or control utilized by the network. The information would be as specific as possible for two reasons. The first is to ease configuration and installations of new systems or recover from failures. The second is to ensure that new administrators continue to configure the network to the level of security demanded by the site security policy.

A security policy is not an easy document to create. The process of identifying assets, performing risk analysis, and selecting risk management countermeasures is not a straightforward matter of "put in the numbers and out pops the answer." Properly done, an information security policy takes time, effort, and the involvement of many of the people in your company. Alone, a security policy does nothing to increase the security of your network — it is, after all, just words. Nevertheless, a security policy is the best way to ensure that the process of securing your network achieves the goal of information security and reduces the risk to your network while complementing your company objectives.

Related

Категории