# Presentation: 544013

## Session # 48

**Security on Your Campus: How to Protect Privacy Information**
- Robert Ingwalson

## Slide 2

## We Implement Security Based on Cost vs. Risk

## Protecting personal information is Everybody’s Job!

**Protecting personal information is Everybody’s Job!**

***Personally Identifiable Information (PII):***
**Information about an individual including but not limited to, Education, Employment, Financial Transactions, Medical History, and Criminal Background information which can be **used** to distinguish or trace and individual’s identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc, including any other personal information that can be linked to an individual.**

**Don’t become a headline!**

## In the Office
On the System
Data Transfers
Remote Users
Assess Your Security

**On the System**
**Data Transfers**
**Remote Users**
**Assess Your Security**

**Protecting Personally Identifiable Information**

## In the Office
Document handling and storage
Phones and Faxes
Land Shipments
Physical Office Security
Personnel Security
Policy and Training

**Document handling and storage**
**Phones and Faxes**
**Land Shipments**
**Physical Office Security**
**Personnel Security**
**Policy and Training**

**Protecting Personally Identifiable Information**

## In the Office
Document Handling and Storage
Limit printing of PII
Clean Desk
Sensitivity Identification
Shredding
Monitoring
Secure storage

**Document Handling and Storage**
- Limit printing of PII
- Clean Desk
- Sensitivity Identification
- Shredding
- Monitoring
- Secure storage

**Protecting Personally Identifiable Information**

## In the Office
Phones
Limit PII conversations 
Don’t leave PII voicemails
Prevent listeners 
Faxes
Limit faxing of PII
Confirm fax number
Two way communication before sending and upon receipt
Monitor the Fax
Safeguard document

**Phones**
- Limit PII conversations
- Don’t leave PII voicemails
- Prevent listeners
**Faxes**
- Limit faxing of PII
- Confirm fax number
- Two way communication before sending and upon receipt
- Monitor the Fax
- Safeguard document

**Protecting Personally Identifiable Information**

## In the Office
Land Shipments
Limit shipments of PII
Encrypt sent media 
Double package
Send by reputable shipping agent
Include a manifest inside the package.
Communicate shipment with receiver 

**Land Shipments**
- Limit shipments of PII
- Encrypt sent media
- Double package
- Send by reputable shipping agent
- Include a manifest inside the package.
- Communicate shipment with receiver

**Protecting Personally Identifiable Information**

## In the Office
Physical Office Security
Staffed reception counter
After hours?
Card/key access 
Change combinations & keys
Logs
Added Security
Cameras
Entry and exit checks 

**Physical Office Security**
- Staffed reception counter
- After hours?
- Card/key access
- Change combinations & keys
- Logs
- Added Security
- Cameras
- Entry and exit checks

**Protecting Personally Identifiable Information**

## In the Office
Personnel Security
Know who should be there
Challenge others
Personnel background checks
Criminal
Employment history
Credit
Train shortly after employment begins and then refresh periodically

**Personnel Security**
- Know who should be there
- Challenge others
- Personnel background checks
- Criminal
- Employment history
- Credit
- Train shortly after employment begins and then refresh periodically

**Protecting Personally Identifiable Information**

## In the Office
Personnel Security
Know who should be there
Challenge others
Personnel background checks
Criminal
Employment history
Credit
Train shortly after employment begins and then refresh periodically

**Personnel Security**
- Know who should be there
- Challenge others
- Personnel background checks
- Criminal
- Employment history
- Credit
- Train shortly after employment begins and then refresh periodically

**Protecting Personally Identifiable Information**

## In the Office
Policy and Training
Policy provides basis for controls and a roadmap to follow
Based on requirements and good practice
Individuals need training on policy - Include in Personnel training 

**Policy and Training**
- Policy provides basis for controls and a roadmap to follow
- Based on requirements and good practice
- Individuals need training on policy - Include in Personnel training

**Protecting Personally Identifiable Information**

## On the System (Defense in Depth)
Policy
Personnel Security
Physical Security
Network Security
Host based Security
Application Security

**Policy**
**Personnel Security**
**Physical Security**
**Network Security**
**Host based Security**
**Application Security**

**Protecting Personally Identifiable Information**

**   **_[www.macroview.com/solutions/infosecurity/](http://www.macroview.com/solutions/infosecurity/)_

**Notes:**
Protecting an enterprise's network and data resources requires a "multi-layer" approach in design and implementation of security solutions. Individual layers defense the enterprise from a specific set of attacks and these layers complement with each other to offer a complete protection.

network security solutions start with helping an enterprise to develop its own corporate security policy. A full array of security facilities will then be designed and implemented around the enterprise's network resources including:
User and/or Site authentication and authorization mechanisms 
Encryption and data integrity protection 
Firewall and virus scanning 
Intrusion detection 
Proactive vulnerability scanning 
Application Security Solutions
PKI, public key infrastructure, is one of the most important development in resolving the security issue related to e-commerce. PKI enables a highly scalable trust model that can support the rapid booming of e-commerce in our economy. 

PKI-ready application security solutions for both Internet-commerce and WAP-commerce. 
Customer-supplier chain protection 
Secured web access 
Secured database access 
Secured email and FTP 

## On the System
Policy
Technical, Managerial, Operational control requirements
Tells what needs to be done, not how
Procedures provide the road maps on how to comply with policy    
Covers all other aspects of Security
Personnel
Physical
Network Security
Host based Security
Application Security

**Policy**
- Technical, Managerial, Operational control requirements
- Tells what needs to be done, not how
- Procedures provide the road maps on how to comply with policy
- Covers all other aspects of Security
- Personnel
- Physical
- Network Security
- Host based Security
- Application Security

**Protecting Personally Identifiable Information**

**Notes:**
Security Domain
Definition
Management Controls
Security policies and techniques established for use of and access to the GSS or MA and its resources. 
Operational Controls
Processes and procedures established that focus on mechanisms implemented to maintain security of system(s) and that are executed by people. 
Technical Controls 
Procedures and safeguards established for securing processing, storage, and transmission of information, usually executed from within the GSS or MA.

## On the System
Personnel Security
The same as in the office:
Know who should be there
Challenge others
Personnel background checks
Criminal
Employment History
Credit
Train shortly after employment begins and then refresh periodically

**Personnel Security**
- The same as in the office:
- Know who should be there
- Challenge others
- Personnel background checks
- Criminal
- Employment History
- Credit
- Train shortly after employment begins and then refresh periodically

**Protecting Personally Identifiable Information**

## On the System
Physical Security 
Includes environmental Security
Access control
Badges / Keycards
Access lists and entry logs
Escorted access
Higher level of control for some areas
Metal detectors and scanners
Backup power
Cameras

**Physical Security**
- Includes environmental Security
- Access control
- Badges / Keycards
- Access lists and entry logs
- Escorted access
- Higher level of control for some areas
- Metal detectors and scanners
- Backup power
- Cameras

**Protecting Personally Identifiable Information**

**Notes:**
We also ensue physical security of our facilities.  With physical security you can also include environmental security.  We make sure there are physical access controls, temperature control for hardware and equipment, power backups, and other emergency measures to keep system safe and operational. 

## On the System
Network Security 
Firewalls
NIDs (Network Intrusion Detection)
Auditing 
IPS (Intrusion Prevention System)
Honeypots  

**Network Security**
- Firewalls
- NIDs (Network Intrusion Detection)
- Auditing
- IPS (Intrusion Prevention System)
- Honeypots

**Protecting Personally Identifiable Information**

## On the System
Host based Security
Configuration compliance
Internal Firewalls
Access control
HIDs (Host Based Intrusion Detection)
Anti-Virus and Anti-Spyware
Patch management
Logging

**Host based Security**
- Configuration compliance
- Internal Firewalls
- Access control
- HIDs (Host Based Intrusion Detection)
- Anti-Virus and Anti-Spyware
- Patch management
- Logging

**Protecting Personally Identifiable Information**

**Notes:**
From Ray Zadjmool (MCSE, CISSP, CCNA) is President and founder of Tevora Business Solutions Inc. (www.tevora.com) a network security consulting firm out of Irvine California.

“Just a few years ago, the focus of enterprise security was primarily split between perimeter security and authentication controls. Security engineers spent their time mulling over firewall implementations, access rights, and the occasional implementation of encryption technologies. A new movement though has overtaken the industry as security breaches have become more and more common despite perimeter defenses, thus forcing enterprises to start reassessing security again from a host based perspective.”

## On the System
Application Security
Develop Application Security Plan
Test for known vulnerabilities prior to implementation
Authorize access
Rules of behavior
Secure Web interface  
Limit PII entries and displays

**Application Security**
- Develop Application Security Plan
- Test for known vulnerabilities prior to implementation
- Authorize access
- Rules of behavior
- Secure Web interface
- Limit PII entries and displays

**Protecting Personally Identifiable Information**

**Notes:**
Application – At Federal Student Aid, application controls are built around the level of data sensitivity the application has and impact the system would have if it failed.  To insure that the proper controls are in place, we Certify and Accredit our applications every three years or sooner if there’s been a major change.  The C&A our applications based on the controls identified NIST SP 800-53.   
However, neither NIST nor any Department of Education control guide explicitly discuss the vulnerabilities that we need to protect systems from.  So lets discuss some of those vulnerabilities as they apply to application development.   

## Data Transfers

Electronic File Transfers
Tapes and CDs
Thumb Drives
Email
*Laptops

- Electronic File Transfers
- Tapes and CDs
- Thumb Drives
- Email
- *Laptops

**Protecting Personally Identifiable Information**

## Data Transfers
Encryption
Encrypt with strong Algorithms
AES, Advance Encryption Standard or Triple DES, Data Encryption Standard
Use large key length, 256 or greater
If passwords are used: make them strong 
Complex with a mixture of numbers, upper and lower alpha characters, and special characters
8-12 characters in length
No dictionary words or names 
Send separate from the data transfer
Mask entry

- Encryption
- Encrypt with strong Algorithms
- AES, Advance Encryption Standard or Triple DES, Data Encryption Standard
- Use large key length, 256 or greater
- If passwords are used: make them strong
- Complex with a mixture of numbers, upper and lower alpha characters, and special characters
- 8-12 characters in length
- No dictionary words or names
- Send separate from the data transfer
- Mask entry

**Protecting Personally Identifiable Information**

## Remote Users
Two types of remote users: Students and Staff

Problem
Work from personal or public PCs and laptops
Data downloads need to be monitored
Infected with viruses and spyware
Open to phishing and pharming
*Subject to Keylogger attacks

Resolution
Limit PII displayed or entered on the screen
Employ two factor authentication for application access
Provide Web site notices 
Offer assistance

- Two types of remote users: Students and Staff
- Problem
- Work from personal or public PCs and laptops
- Data downloads need to be monitored
- Infected with viruses and spyware
- Open to phishing and pharming
- *Subject to Keylogger attacks
- Resolution
- Limit PII displayed or entered on the screen
- Employ two factor authentication for application access
- Provide Web site notices
- Offer assistance

**Protecting Personally Identifiable Information**

## Remote Users
Keylogger attacks
What are Keyloggers?
Why are we singling this threat out?
What can be done about the Keylogger threat?
Limit the amount of PII entered or displayed on the web site.  
Make sure that user passwords are changed frequently.  
Limit privileged users remote access.
Use Two Factor authentication.  
Include warning banners on your web sites that provide a warning and instructions for prevention.  
Let users know not to use computers with unknown security.  Cyber Cafes and other publicly accessible computers should be avoided when accessing PII.

**Keylogger attacks**
- What are Keyloggers?
- Why are we singling this threat out?
- What can be done about the Keylogger threat?
- Limit the amount of PII entered or displayed on the web site.
- Make sure that user passwords are changed frequently.
- Limit privileged users remote access.
- Use Two Factor authentication.
- Include warning banners on your web sites that provide a warning and instructions for prevention.
- Let users know not to use computers with unknown security.  Cyber Cafes and other publicly accessible computers should be avoided when accessing PII.

**Protecting Personally Identifiable Information**

**Notes:**
Two-factor authentication
Human authentication factors are generally classified into three cases:
Something the user has (e.g., ID card, security token, software token, phone, or cell phone) 
Something the user knows (e.g., a password, pass phrase, or personal identification number (PIN)) 
Something the user is or does (e.g., fingerprint or retinal pattern, DNA sequence (there are assorted definitions of what is sufficient), signature or voice recognition, unique bio-electric signals, or another biometric identifier) 
Often a combination of methods is used, e.g., a bankcard and a PIN, in which case the term 'two-factor authentication' is used. In 2006, several scientists at RSA Laboratories published a paper exploring social networking as a fourth factor of human authentication.
Historically, fingerprints have been used as the most authoritative method of authentication, but recent court cases in the US and elsewhere have raised fundamental doubts about fingerprint reliability. Other biometric methods are promising (retinal and fingerprint scans are an example), but have shown themselves to be easily spoof able in practice 

## Assess Your Security
Identify data sensitivities for CIA
Identify Likelihood
Likelihood = threat*motivation 
Identify security risks 
Risk level = Impact*Likelihood 
Controls = level of risk
Identify test methods based on risk level
Documentation reviews
Interviews
Observations
Technical tests (network, OS and application scans, log reviews, penetration testing, password cracking)
Use Baseline Security Requirements
Complete testing and identify weaknesses / unmitigated vulnerabilities
Create remediation plan

**Identify data sensitivities for CIA**
**Identify Likelihood**
- Likelihood = threat*motivation
**Identify security risks **
- Risk level = Impact*Likelihood
**Controls = level of risk**
**Identify test methods based on risk level**
- Documentation reviews
- Interviews
- Observations
- Technical tests (network, OS and application scans, log reviews, penetration testing, password cracking)
**Use Baseline Security Requirements**
**Complete testing and identify weaknesses / unmitigated vulnerabilities**
**Create remediation plan**

**Protecting Personally Identifiable Information**

## Protecting personal information is Everybody’s Job!

**Protecting personal information is Everybody’s Job!**

***Personally Identifiable Information (PII):***
**Information about an individual including but not limited to, Education, Employment, Financial Transactions, Medical History, and Criminal Background information which can be **used** to distinguish or trace and individual’s identity, such as their name, social security number, date and place of birth, mother’s maiden name, biometric records, etc, including any other personal information that can be linked to an individual.**

**Don’t become a headline!**

## Resources

**Vulnerabilities:**
- OWASP (_http://www.owasp.org_)
- SANS Top 20 (_www.sans.org/top20_)
- National Vulnerability Database (_http://nvd.nist.gov_)
- cgisecurity (_http//www.cgisecurity.com_)
**Guidance:**
- National Institute of Standards and Technology (NIST) Computer Security Resource Center  (_[http://csrc.nist.gov/publications/](http://csrc.nist.gov/publications/nistpubs)__[nistpubs](http://csrc.nist.gov/publications/nistpubs)_/)
- Center for Internet Security (CIS) _(__[http://www.cisecurity.org/](http://www.cisecurity.org/)__)_
- Educause _(http://connect.educause.edu/term_view/Cybersecurity)_

## Contact Information

- We appreciate your feedback and comments. We can be reached at:
- Bob Ingwalson
- Phone: 202.377.3563
- Email:  robert.ingwalson@ed.gov
- Fax:  202.275.0907