Admin at 12:25, 25 January 2017

2017-01-25T12:25:25Z

Admin: Created page with "{{DISPLAYTITLE: The Three Pillars of Information Security}} == Business Security Services == '''Compliance & Reporting Services:''' Measure the performance of the business and..."

2017-01-25T10:57:06Z

Created page with "{{DISPLAYTITLE: The Three Pillars of Information Security}} == Business Security Services == '''Compliance & Reporting Services:''' Measure the performance of the business and..."

New page

{{DISPLAYTITLE: The Three Pillars of Information Security}}
== Business Security Services ==
'''Compliance & Reporting Services:''' Measure the performance of the business and IT systems against the metrics established by the business. This uses audited and other information regarding overall system activity to compare actual system behaviors against expected system behavior.

'''Identity & Access Services:''' Manage the creation and deletion of user identities across the enterprise. Often, they also ensure self-management of that identity after it is created.

'''Data Protection, Privacy, and Disclosure Control Services:''' Deal with the protection of data across all five domains. The control points of these services are areas such as publishing a privacy policy, managing user consent to these policies, capturing user preferences around how to be contacted, and reporting on who has accessed what information.

'''Trust Management Services:''' Manage the identification of trusted relationships between various differing entities within a business; for example, relationships among user ID’s, security domains, or different applications. A set of well managed business rules is defined that permits the related entities to transfer information and do business together.

'''Non-Repudiation Services:''' Ensure that any two parties involved in a transfer of data between each other cannot falsely deny that the communication has taken place. Note that it does not protect the data itself but does ensure that the two parties involved have received and sent the data and cannot refute this claim.

'''Secure Systems & Network Services:''' Cover areas such as intrusion detection, operating system security, malware detection, and patch management processes.

== IT Security Services ==
'''Identity Services:''' Usually, Identity Services must be able to manage the core function associated with storing and managing information around organizational entities, such as user, a role or user groups. This information is stored in some form of repository such as an LDAP directory. There might be multiple repositories within the enterprise, and these might need synchronizing through provisioning policies to ensure that identity information is consistent across the enterprise.

'''Authentication Services:''' Authenticating the users within the enterprise is done through Authentication Services. These services could support multiple different approaches such as user name and password, hardware token based, or even biometric solutions to authenticate an individual based on fingerprinting or retinal pattern recognition.

'''Authorization Services:''' After any authentication service, generally, an authorization service follows. This service determines if the user is authorized to perform the requested operation on the target resource. To allow authenticated users to perform tasks for which they have been authorized, there must be policies in place that describe the authorization decision for the appropriate authenticated service.

'''Audit Services:''' For example, to meet certain compliance requirements or to perform incident analysis, audit trails must be available to show who accessed what and when. Audit Services maintain logs of critical activities. Typical examples of logged activity can be login failures, unauthorized attempts to access systems, modification of security and identity policies, and so on.

'''Integrity Services:''' This service group attempts to monitor traffic intra- and inter-enterprise-wide to identify if data has been maliciously altered in some manner. Typically cryptographic techniques such as message integrity codes, authentication codes, and digital signatures are used.

'''Confidentiality Services:''' They are applied to prevent disclosure of sensitive information traveling through untrusted communication networks, widely used over the Web. Even if a user is authenticated and authorized, the data requested must still be protected as it moves across systems boundaries.

== Security Policy Management ==
'''Policy Administration Services:''' They maintain changes to security policies over the lifetime of the application. The policies need to be described in terms that make sense to the underlying architecture. For example, if used in an SOA context, then the policy Metadata should contain information about the services used and other information like the strength of encryption.

'''Policy Distribution & Transformation Services:''' They distribute policies defining access to the applications or services themselves to the places where they are enforced. The policies themselves can be deployed using known standards such as WS-Policy or WS-Security Policy, so that the service or requestor can enable the security using its own local techniques.

'''Policy Decision & Enforcement Services:''' They are logically connected to Policy Enforcement Points (PEP), which admin users use to update security requirements. The PEP’s in turn rely on Policy Deployment Points (PDP) or nodes to physically administer the policies across the enterprise. Challenges of multiple PDP’s and PEP’s are that different entities might administer them and coordination can become difficult. A central decision function that oversees these functions can sometimes assist greatly.

'''Monitoring & Reporting Services:''' This function ensures the business can take the business policies and map them down to the IT services and report successfully on the degree of compliance by the IT Services deployed. It is necessary to keep track of current policies, historic policies, and compliance assessments against corporate policies. Traceability from the corporate policies down to the mechanism utilized to achieve those policies is critical to this function. Changes should be tightly controlled, access to them traced through reporting and monitoring, and audit trails supplied at any point in the process.

[[File:The Three Pillars of Information Security.png|thumb|800px|Figure 1: The Three Pillars of Information Security.]]

[[Category: Cyber Security]]
[[Category: Information Architecture]]
[[Category: Regulation]]
[[Category: System Architecture]]

@@ Line 44: / Line 44: @@
 [[Category: Information Architecture]]
 [[Category: Regulation]]
 [[Category: System Architecture]]

LEAD Reference Content:The Three Pillars of Information Security - Revision history

Admin at 12:25, 25 January 2017

Admin: Created page with "{{DISPLAYTITLE: The Three Pillars of Information Security}} == Business Security Services == '''Compliance & Reporting Services:''' Measure the performance of the business and..."