Risk Analysis Methodology for New IT Service IT Infrastructure Protection Division IT Infrastructure Protection Division IT Infrastructure Protection Planning Team IT Infrastructure Protection Planning Team Korea Information Security Agency Korea Information Security Agency
Content � Related research Analyses of major domestic and foreign risk analysis � techniques ITU-T X.805 � � New IT service information protection risk management methodology � Proposed frame of the methodology � Example � BcN VoIP Service � Conclusion � Concept, characteristics & advantages of the methodology being presented 2
Analyses of major domestic and foreign risk analysis techniques NIST GMITS BS7799 CSE OCTAVE KISA Methodology � hardware � information & data � information � information � information � information & � software � hardware � software � process � system data � system � software � physical equipment � platform � software � documents interphase � telecommunication � service � interface � hardware � hardware Target Target � information & s equipment � documents � human � human � software data � palmware � human � environment information information � human � documents � company image, � material asset � system � capital reputation � immaterial asset assets that � manufactured assets that Classificat products ion of � service are in are in � confidence and assets trust in service operation operation � environmental equipment � manpower � organization image There are There are - � environment and � employee security � external � server � Management Existing Existing basic facilities � physical � systems � network � policy, fundamental � hardware environment security � Objects � security system organization, fundamental Classificat classification classification � software � management of � manpower � desktop human resources limitations to ion of � telecommunication computer & networks � PC � building, facilities, limitations to s � Maintain system � notebook etc. that are in that are in weakness � documents access control & � storage device � Technical applying applying � human development � wireless LAN, es operation operation � general mobile phone them to weaknesses � etc them to future future � threat from � planned � ‘infected/bad’ � non-human � human � Executor oriented IT nature � coincidental software not allowed � random (navure) � System � Human oriented IT � threat from � environmental to access the system � planned (human) � Hardware � non-human humans � human or network � Artificial � software � access route service � consideration � software operation � Internal � Etc � Network service of intention of malfunction � External � natural disaster � phical Classificat threat � Sending of not � communication � Intention � threat from allowed message obstacle � Coincidence ion of environment � re-sending of � physical � intentional message by 3 rd party •Weaknesses environmental � result of damage threats •Weaknesses � fire obstacle � Change � burglar � Vulnerability and threats and threats � employee mistake � Destruction � Inturruption are evaluated are evaluated to calculate to calculate � standard � standard matrix for � standard matrix for � scenario of threat � risk evaluation � standard matrix the degree of the degree of matrix for calculating degree calculating degree of � Asset -> threat standard for calculating calculating of risk risk (motive, ability to established by degree of risk risk were little degree of risk � Asset � � Asset � weakness execute) -> situation � Asset � risk were little Calculatio � Asset � weakness � threat � threat � degree weakness (severity, � Important assets- weakness � frequency of � degree of risk of risk vulnerability) -> >threat profile- threat � degree of different n method different threat � degree of risk >weakness - risk of degree severity of >threat (degree of threat � level damage, of risk of threat frequency of threat) 3
ITU-T X.805 ITU-T X.805 Module 2: Infrastructure Layer, Control Plane Security Dimension Security Objectives Access Control Ensure that the network device will only accept control information messages from authorized network devices Authentication Verify the identity of the person or device observing or modifying control information resident in the network device. Provide a record identifying each individual or device that observed or modified control information in the network device and the Non-repudiation action that was performed. This record can be used as proof of access to or modification of the control information. Protect control information resident in a network device or in offline storage from Data confidentiality unauthorized access or viewing Communication Flow Ensure that control information being transported across the network only flows between the source of the control information and Security its desired destination. The control information is not diverted or intercepted as it flows between these endpoints Data Integrity Protect control information resident in network devices, in-transit across the network, or stored Ensure that network devices are always available to receive control information from Availability authorized sources Ensure that information that can be used to identify the network device or communications link is not available to unauthorized Privacy personnel or devices 4
ITU-T X.805 Security Layers Applications Security Layer: Applications Security Applications Security • Network-Based Applications Accessed by End- Users THREATS THREATS • Includes: – Fundamental Applications (e.g., Web Interruption Interruption Services Security Services Security Browsing) Interception Interception VULNERABILITIES VULNERABILITIES – Basic Applications (e.g., Directory Modification Modification Assistance and Email) Fabrication Fabrication Vulnerabilities Can Exist – High-End Applications (e.g., E-Commerce) In Each Layer Infrastructure Security Infrastructure Security ATTACKS ATTACKS Services Security Layer: Infrastructure Security Layer: • Services Provided to Customers or End- • Fundamental Building Blocks of Networks, Users Services, and Applications. • Range from Basic Transport to High-End, • Individual Network Elements and the Value-Added Services. Interconnecting Communications Facilities • Examples: • Examples: – Carrier Facilities (DS-1, DS-3, etc.) – Individual Routers, Switches, Servers – Frame Relay, ATM, IP Connectivity – Point-to-Point WAN Links – VoIP, QoS, IM, Location Services – Ethernet Links – 800-Services 5
ITU-T X.805 Security Planes Security Layers Security Layers Applications Security Applications Security THREATS THREATS End-User Security Plane: • How Customers Access and Use the Network Interruption Interruption Services Security Services Security Interception Interception • Represents End-User Data At Rest and In Motion VULNERABILITIES VULNERABILITIES Modification Modification Vulnerabilities Can Exist • End-Users May Use the Network For: In Each Layer and Plane Fabrication Fabrication – Basic Connectivity/Transport Infrastructure Security Infrastructure Security ATTACKS ATTACKS – Value-Added Services (VPN, VoIP, etc.) – Access to Network-Based Applications (e.g., Email). End User Security End User Security Security Planes Security Planes Control/Signaling Security Control/Signaling Security Management Security Management Security Management Security Plane: Control/Signaling Security Plane: • Concerned with OAM&P of Network Elements, • Enables the Efficient Delivery of Information, Transmission Facilities, Operations/Business Services, and Applications Across the Network Systems • Machine-to-Machine Communications to Determine • Concerned with Management and Provisioning of How to Best Route or Switch Traffic Across the Network Services and Applications Network • Supports the FCAPS Functions • May Be In-Band or Out-of-Band • May Be In-Band or Out-of-Band 6
Recommend
More recommend
