Chapter 10 IT Infrastructure Security Policy – Airlines Paper Topic- Airlines Pick an industry for the team to work on -Begin an initial search for infor

Chapter 10 IT Infrastructure Security Policy – Airlines Paper Topic- Airlines

Pick an industry for the team to work on

-Begin an initial search for information about the industry and writing an IT Infrastructure Security Policy

Please chose 4 topic from chapter 10 slide which in attachment

All 4 topic should cover this Document format follow title, version-date, purpose, background, roal and responsibilities, effective dates, information assistance, Aproval, Associated resources

-Determine the issues that will be discussed

-Create an outline for the paper

Paper should be more than 20 pages which contents, references etc are not included.

Presentation must be 10slides.

No 0% Plagiarism

please follow requirement with time frame Security Policies and
Implementation Issues
Lesson 10
IT Infrastructure Security Policies
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Learning Objective
Describe the different information security
systems (ISS) policies associated with the IT
infrastructure.
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 2
Key Concepts
? Elements of an infrastructure security policy
? Policies associated with various domains of a
typical IT infrastructure
? Best practices in creating and maintaining IT
policies
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 3
Key Purpose of an IT Infrastructure
Policy
Provide technical knowledge of:
The
interaction
of various
layers of the
network
Security Policies and Implementation Issues
The
placement
of key
controls
The types of
risks to be
detected and
guarded
against
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 4
Three Ways to Organize Policies
Domain
Functional Area
Layers of Security
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 5
Seven Domains of a Typical IT
Infrastructure
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 6
Policy Organization
? Requirements may cross domains
? Malware protection
? Password/Authentication requirements
? Requirements may conflict between domains
? Policies will vary among organizations
? Use standard document types to identify
domain security control requirements
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 7
Creating Policy Documents
? Documents should
? Differentiate between core requirements and
technological requirements
? Follow a standard format
? Remain relevant without constant modification
? Not contain duplicate content
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 8
Policy Documents
Control Standards
• Policy statements concerned with
core requirements
Baseline Standards
• Minimum security requirements for
specific technologies
Procedure
Documents
• Implementation processes; each
baseline standard needs a
procedure
Guidelines
• Recommendations
Dictionary
Security Policies and Implementation Issues
• Used in the policies that define the
scope and meaning of terms used
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 9
Workstation Domain
? Control Standards
Workstation
? Device management
? User permissions
• End user devices
• Laptops, desktops, mobile devices
• Focus on physical and logical security
? Align with functional
responsibilities
? Baseline Standards
? Specific technology requirements for each device
? Review standards from vendors or organizations
? Procedures
? Step-by-step configuration instructions
? Guidelines
? Acquisitions (e.g., preferred vendors)
? Description of threats and countermeasures
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 10
LAN Domain
? Control Standards
LAN
• Local area network infrastructure
• Servers, network infrastructure
• Focus on connectivity and traffic
management
? Firewalls
? Denial of Service
? Align with functional
responsibilities
? Baseline Standards
? Specific technology requirements for each device
? Review standards from vendors or organizations
? Procedures
? Step-by-step configuration
? Guidelines
? Acquisitions (e.g., preferred vendors)
? Description of threats and countermeasures
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 11
LAN-to-WAN Domain
? Control Standards
LAN to WAN
? Access control to the
• Connects LAN to outside network (e.g.,
Internet)
• Focus on securing resources that
bridge internal and external networks
Internet
? Traffic filtering
? Baseline Standards
? Specific technology requirements for perimeter devices
? Procedures
? Step-by-step configuration
? Guidelines
? DMZ, IDS/IPS, content filtering
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 12
WAN Domain
? Control Standards
WAN
? WAN management,
Domain Name Services,
router security, protocols,
Web services
• Wide Area Network (e.g., Internet)
services and hardware
• Focus on WAN connection
management, DNS
? Baseline Standards
? Review standards from vendors or organizations
? Procedures
? Step-by-step configuration of routers and firewalls
? Change management
? Guidelines
? When and how Web services may be used
? DNS management within the LAN and WAN environments
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 13
Remote Access Domain
? Control Standards
? VPN connections
Remote Access
? Multi-factor authentication
• End user remote connection technology
• Focus on authentication and connection
? Baseline Standards
? VPN gateway options
? VPN client options
? Procedures
? Step-by-step VPN configuration and debugging
? Guidelines
? Description of threats
? Security of remote computing environments, such as working from
home
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 14
System/Application Domain
? Control Standards
System/Application
? Firewalls
• Data processing and storage technology
• Focus on security issues associated
with applications and data
? Denial of Service
? Align with functional
responsibilities
? Baseline Standards
? Specific technology
requirements for each device
? Review standards from
vendors or organizations
? Procedures
? Step-by-step configuration
? Guidelines
? Acquisitions (e.g., preferred vendors)
? Description of threats and countermeasures
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 15
Telecommunications Policies
? Control Standards
Telecommunications
? Protect with FIPS encryption
? Segregation of data and
voice networks
• Technology, service, or system that
provides transmission of electronic data
and information
? Baseline Standards
? Specific technology
requirements for each device
? Review standards from
vendors or organizations
? Procedures
? Step-by-step configuration
? Guidelines
? May include VoIP systems architecture and security guidelines
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 16
Best Practices for IT Infrastructure
Security Policies
Select a framework, such as ISO or COBIT
Develop requirements and standards
based on the framework
Review and adapt
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 17
Best Practices for IT Infrastructure
Security Policies (Continued)
Make policies/standards available to all
Keep content cohesive
Keep content coherent
Maintain the same “voice” throughout
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 18
Best Practices for IT Infrastructure
Security Policies (Continued)
Add only necessary information
Stay on message
Make your library searchable
Federate ownership to where it best belongs
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 19
Roles and Responsibilities
? Information Security (IS) Manager
? Policy creation, application, and alignment with
organizational goals
? IT Auditor
? Ensuring that controls are in place per policy
? System/Application Administrator
? Applying controls to Workstation, LAN, and LANto-WAN Domains
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 20
Lack of Controls
? With lack of controls all of the following and
more are possible:
• Workstations would have different
•
•
•
•
configurations
LANs would allow unauthorized traffic
WANs would have vulnerabilities
Network devices would not be configured the
same
Users would have access to data they are not
directly working with
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 21
Summary
? Elements of an infrastructure security policy
? Policies associated with various domains of a
typical IT infrastructure
? Best practices in creating and maintaining IT
policies
Security Policies and Implementation Issues
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Page 22

Purchase answer to see full
attachment