XMind

CCIE SEC Security General

1. 1. Policies - Security Policy Best Practices

2. 2. Information Security Standards (ISO 17799, ISO 27001, BS7799)

   1. Common Criteria

      1. Provides a security framework whereby...

         1. Users can specify what they want

         2. Vendors can implement it

         3. Labs can test vendors claims

      2. derrived from BS7799

3. 3. Standards Bodies

4. 4. Common RFCs (e.g. RFC1918, RFC2827, RFC2401)

5. 5. BCP 38

6. 6. Attacks, Vulnerabilities and Common Exploits - recon, scan, priv escalation, penetration, cleanup, backdoor

   1. Buffer Overflow

      1. When Data written to a memory buffer, due to insufficient bounds checking, Corrupts data vales in memory address adjacent to the buffer

         1. Bounds Checking: Checks if data is "appropriate for storage"

7. 7. Security Audit & Validation

8. Risk Assessment

   1. Quantitative

      1. A Risk calculation based on figures

      2. The probablility of an event, and the estimated cost if it does

         1. The Outputs of this....

            1. ALE Annual Loss Expectancy

            2. EAC Estimated Annual Cost

      3. + A number is generated and risks can easily be ranked by importance

      4. - Probability is rarely accurate / precice, an incorrect calculations can promote complacency

   2. Qualitative

      1. Only Potential Loss is Calculated

      2. Compenents....

         1. Threats

            1. Things that "can go wrong" or "attacks"

            2. e.g. Fire, Fraud

         2. Vulnerabilities

            1. Weaknesses or things that make a threat more likely

            2. e.g. paper in the building = FIRE

         3. Controls

            1. Countermeasus for Threats & Vuln's

               1. Deterrent

                  1. Reduce probability

               2. Preventative

                  1. Prevent sucess if happens

               3. Corrective

                  1. Reduces effectiviness

               4. Detective

                  1. Discovers if happens

                  2. May trigger Corrective

9. 9. Change Management Process

10. 10. Incident Response Framework

11. 11. Computer Security Forensics