Module - 2 - Security Device Management.ppt

Security Device Management

1. BCSE354E: Information
Security Management
Security Device Management
A. Avinash, Ph.D.
School of Computer Science and Engineering
Vellore Institute of Technology (VIT), Chennai

2. Types of Information security devices
1,2
•Access control
•Antivirus and anti-malware software
•Application security
•Behavioral analytics
•Data loss prevention
•Distributed denial of service prevention
•Email security
•Firewalls
•Mobile device security
•Network segmentation
•Security information and event management
•Web security
References:
1. Network Security Essentials: Applications and Standards by William Stallings
2. Computer Security: Principles and Practice by William Stallings and Lawrie Brown

3. Access control
•Access control is a critical component of information security that ensures
authorized users have the appropriate permissions to access resources
while preventing unauthorized access.
•Common information security devices related to access control and their
functions
1. Access Control Lists (ACLs):
Function: ACLs define rules specifying which users or system processes are
granted access to objects, as well as what operations are allowed on given
objects.
Example: Network routers and switches use ACLs to control traffic flow
based on IP addresses or protocols.

4. Access control
2. Biometric Access Control Systems:
Function: Biometric systems use unique physiological or behavioral
characteristics for user authentication.
Example: Fingerprint scanners, iris scanners, and facial recognition
systems are used in access control systems.
3. Smart Cards and Token-Based Authentication:
Function: Smart cards and tokens generate one-time passwords or provide
cryptographic authentication.
Example: RSA SecurID uses token-based authentication for secure access to
networks.

5. Access control
4. Role-Based Access Control (RBAC):
Function: RBAC assigns permissions to roles rather than individual users,
streamlining access management.
Example: Microsoft Active Directory employs RBAC to assign roles and
permissions to users within an organization.
5. Firewalls:
Function: Firewalls control access between networks based on predefined
rules.
Example: A network firewall may restrict external access to specific IP
addresses or services.

6. Access control
6. Identity and Access Management (IAM) Systems:
Function: IAM systems manage user identities, roles, and access privileges.
Example: Okta and Microsoft Azure Active Directory are IAM platforms
used for centralized access management.
7. Two-Factor Authentication (2FA) Devices:
Function: 2FA adds an extra layer of security by requiring two forms of
identification for access.
Example: Google Authenticator or YubiKey devices are used for 2FA to
secure various online accounts.

7. Access control
8. Web Application Firewalls (WAF):
Function: WAFs filter and monitor HTTP traffic between a web application
and the internet.
Example: Cloudflare and Imperva provide WAF solutions to protect web
applications from unauthorized access.
9. Bluetooth/Wi-Fi Access Control Systems:
Function: Control access to Bluetooth or Wi-Fi networks based on
authentication.
Example: Wi-Fi routers often use WPA3 for secure wireless access control.

8. Antivirus and anti-malware software
•Antivirus and anti-malware software are essential components of
information security designed to detect, prevent, and remove malicious
software threats.
•Common information security devices related to antivirus and anti-
malware software, along with their functions
1. Antivirus Software:
Function: Detects, prevents, and removes known types of malware such as
viruses, worms, and Trojans.
Example: McAfee provides real-time scanning, automatic updates, and
protection against various types of malware.

9. Antivirus and anti-malware software
2. Anti-Malware Software:
Function: Protects against a broader range of malicious software, including
newer and less-known threats.
Example: Malwarebytes offers real-time protection against malware,
ransomware, and other advanced threats.
3. Cloud-Based Security Solutions:
Function: Leverages cloud infrastructure for real-time threat intelligence and
quick updates.
Example: Panda Security combines local and cloud-based detection for
advanced threat prevention.

10. Antivirus and anti-malware software
4. Heuristic Analysis Tools:
Function: Identifies new and unknown threats by analyzing patterns and
behaviors.
Example: Kaspersky employs heuristic analysis to detect and prevent
emerging malware threats.
5. Network-Based Antivirus/Anti-Malware:
Function: Scans network traffic for malware before it reaches endpoints.
Example: FortiGate provides network-based security with antivirus and
intrusion prevention capabilities.

11. Antivirus and anti-malware software
6. Browser Security Extensions:
Function: Adds an additional layer of security by scanning websites and
blocking malicious content.
Example: Avast offers a browser extension that helps protect users while
browsing by blocking malicious websites.
7. Centralized Management Platforms:
Function: Centralizes management and monitoring of antivirus and anti-
malware solutions across an organization.
Example: Sophos Central provides a cloud-based platform for managing
endpoint protection and other security features.

12. Application security
•Application security is crucial to protect software applications from
various threats and vulnerabilities.
•Common information security devices related to application security, along
with their functions
1. Web Application Firewalls (WAF):
Function: Protects web applications from common web exploits and attacks
such as SQL injection, cross-site scripting (XSS), and cross-site request
forgery (CSRF).
Example: ModSecurity is an open-source web application firewall that helps
protect web applications from various attacks.

13. Application security
2. Static Application Security Testing (SAST) Tools:
Function: Analyzes source code, bytecode, or binaries for security
vulnerabilities without executing the program.
Example: Checkmarx, a SAST tool that identifies and fixes security
vulnerabilities in source code during the development process.
3. API Security Gateways:
Function: Secures application programming interfaces (APIs) by controlling
access, monitoring traffic, and protecting against API-specific threats.
Example: Apigee (by Google), an API management platform that includes
security features for API protection.

14. Behavioral analytics
•Behavioral analytics in information security involves analyzing patterns of
behavior to detect anomalies or potential security threats.
•Common information security devices related to behavioral analytics,
along with their functions
1. User and Entity Behavior Analytics (UEBA):
Function: Monitors user and entity behavior to identify unusual activities or
deviations from normal patterns.
Example: Splunk UBA (User Behavior Analytics): Provides real-time
visibility into user activities and helps detect abnormal behavior indicative
of security threats.

15. Behavioral analytics
2. Network Traffic Analysis (NTA):
Function: Analyzes patterns in network traffic to identify abnormal or
malicious behavior.
Example: Darktrace uses machine learning to analyze network traffic and
detect anomalies that may indicate cyber threats.
3. Insider Threat Detection Solutions:
Function: Monitors user activities to identify potential insider threats or
malicious actions from within the organization.
Example: ObserveIT (now part of Proofpoint): Focuses on detecting and
preventing insider threats through user behavior analysis.

16. Data Loss Prevention
•Data Loss Prevention (DLP) solutions are critical for safeguarding
sensitive data and preventing unauthorized disclosure.
•Common information security devices related to DLP, along with their
functions and real-time examples:
1. Endpoint DLP Agents:
Function: Monitors and controls data transfers on endpoint devices to prevent
unauthorized data exposure.
Example: McAfee Total Protection includes endpoint DLP features to
secure data on laptops, desktops, and other devices.

17. Data Loss Prevention
2. Network DLP Appliances:
Function: Monitors network traffic and applies DLP policies to prevent data
leaks.
Example: Forcepoint DLP provides network DLP solutions to safeguard
data in transit across the network.
3. Cloud DLP Solutions:
Function: Extends DLP capabilities to protect data stored in cloud
applications and services.
Example: Microsoft Cloud App Security integrates with Microsoft 365 to
extend DLP protection to cloud-based data.

18. Data Loss Prevention
4. Email DLP Solutions:
Function: Monitors and controls the transfer of sensitive data via email to
prevent data leaks.
Example: Symantec Email Security cloud offers DLP features to secure
email communications and attachments.
5. Database Activity Monitoring (DAM):
Function: Monitors database activities and prevents unauthorized access or
data exports.
Example: Imperva SecureSphere provides DAM capabilities to monitor and
protect databases from security threats.

19. Distributed Denial of Service (DDoS)
prevention
•Distributed Denial of Service (DDoS) prevention solutions are designed to
protect networks, websites, and online services from disruptive DDoS
attacks.
•Common information security devices related to DDoS prevention, along
with their functions
1. DDoS Mitigation Services:
Function: Detects and mitigates DDoS attacks by rerouting traffic through
specialized scrubbing centers to filter malicious traffic.
Example: Cloudflare DDoS Protection offers cloud-based DDoS mitigation
services to protect websites and online applications.

20. Distributed Denial of Service (DDoS)
prevention
2. Web Application Firewalls (WAF):
Function: Protects web applications from DDoS attacks by filtering and
monitoring HTTP traffic.
Example: Akamai Kona Site Defender offers WAF capabilities to protect
web applications from various threats, including DDoS attacks.
3. Rate Limiting and Traffic Shaping:
Function: Controls the rate of incoming traffic to prevent sudden spikes and
mitigate DDoS attacks.
Example: F5 BIG-IP Traffic Management allows organizations to
implement rate limiting and traffic shaping to manage and control incoming
traffic.

21. Distributed Denial of Service (DDoS)
prevention
4. Anycast Routing:
Function: Distributes incoming traffic across multiple servers or data centers,
making it harder for attackers to overwhelm a single target.
Example: Verisign DDoS Protection Services utilizes Anycast routing to
distribute and mitigate DDoS attacks across a global network.
5. IP Reputation and Threat Intelligence Feeds:
Function: Utilizes threat intelligence feeds to block traffic from known
malicious IP addresses and sources.
Example: Arbor Networks Threat Intelligence integrates threat intelligence
to enhance DDoS detection and mitigation.

22. Email security
•Email security is essential to protect organizations from various cyber
threats, including phishing, malware, and data breaches.
•Common information security devices related to email security, along with
their functions
Email Gateway Security:
Function: Scans incoming and outgoing emails for malicious content,
attachments, and URLs to prevent email-based threats.
Example: Proofpoint Email Protection offers email gateway security with
advanced threat detection and protection against phishing and malware.

23. Firewalls
•Firewalls are fundamental network security devices that monitor and
control incoming and outgoing network traffic based on predetermined
security rules.
•Common types of firewalls and their functions
1. Packet Filtering Firewalls:
Function: Examines packets of data and filters them based on predefined
rules, such as source and destination IP addresses and ports.
Example: iptables (Linux) widely used packet filtering firewall for Linux
systems that allows administrators to define packet filtering rules.

24. Firewalls
2. Stateful Inspection Firewalls:
Function: Keeps track of the state of active connections and makes decisions
based on the context of the traffic.
Example: Cisco Adaptive Security Appliance (ASA) employs stateful
inspection to monitor and control traffic flow, providing enhanced security for
networks.
3. Proxy Firewalls:
Function: Acts as an intermediary between clients and servers, forwarding
requests and filtering content to enhance security.
Example: Squid Proxy widely used open-source proxy server that provides
content filtering and caching capabilities.

25. Firewalls
4. Next-Generation Firewalls (NGFW):
Function: Combines traditional firewall functionalities with advanced
features such as intrusion prevention, application awareness, and VPN
support.
Example: Palo Alto Networks Next-Generation Firewall offers advanced
threat protection, application visibility, and control in a single integrated
platform.
5. Cloud Firewalls:
Function: Protects cloud-based assets and applications by filtering and
controlling incoming and outgoing traffic.
Example: Amazon Web Services (AWS) Web Application Firewall
(WAF) designed to protect web applications from common web exploits.

26. Mobile device security
•Mobile device security is essential for protecting smartphones, tablets, and
other mobile devices from various cyber threats.
•Common information security devices related to mobile device security,
along with their functions.
1.Mobile Device Management (MDM)
Function: Manages and secures mobile devices by enforcing policies,
configuring settings, and remotely monitoring device status.
Example: VMware Workspace ONE UEM provides MDM capabilities for
managing and securing mobile devices across different platforms.

27. Mobile device security
2. Secure Containers:
Function: Creates isolated and encrypted containers on mobile devices to
secure corporate data and applications.
Example: Samsung Knox provides secure containers for protecting sensitive
data on Samsung mobile devices.
3. Mobile VPN (Virtual Private Network):
Function: Secures mobile device communication by encrypting internet
traffic, especially when connecting to public Wi-Fi networks.
Example: ExpressVPN offers a mobile VPN app to secure internet
connections on mobile devices.

28. Network segmentation
•Network segmentation is a security strategy that involves dividing a network
into smaller, isolated segments to enhance security by controlling and
restricting access to sensitive resources.
•Common information security devices related to network segmentation,
along with their functions
1. Software-Defined Networking (SDN):
Function: Provides a centralized approach to network management, allowing
dynamic segmentation and policy enforcement.
Example: VMware NSX utilizes SDN to enable micro-segmentation, providing
granular control over network traffic.
2. Zero Trust Network Access (ZTNA):
Function: Implements a zero-trust model by verifying the identity and security
posture of users and devices before granting access to network segments.
Example: Zscaler Private Access (ZPA) offers ZTNA solutions for secure and
segmented network access

29. Security Information and Event Management
•Security Information and Event Management (SIEM) solutions play a
crucial role in monitoring, analyzing, and responding to security events
within an organization's IT infrastructure.
•Common SIEM devices, along with their functions
1. SIEM Platform:
Function: Aggregates and correlates security events and log data from various
sources to provide a centralized view of an organization's security posture.
Example: Splunk Enterprise Security a comprehensive SIEM platform that
enables real-time analysis and correlation of security data.
2. Security Analytics:
Function: Utilizes advanced analytics and machine learning to identify
patterns and anomalies in security event data.
Example: IBM Qradar employs security analytics to detect and respond to
threats through behavior analysis.

30. Web security
•Web security encompasses a range of devices and technologies designed to
protect web applications and users from various cyber threats.
•Common information security devices related to web security, along with
their functions
1. Web Application Firewall (WAF):
Function: Protects web applications from common web exploits, such as SQL
injection, cross-site scripting (XSS), and other OWASP Top Ten
vulnerabilities.
Example: Imperva Web Application Firewall offers real-time protection for
web applications and APIs against a wide range of cyber threats.

31. Web security
2. Secure Sockets Layer (SSL) and Transport Layer Security (TLS)
Appliances:
Function: Encrypts and secures data transmitted between web servers and
clients, ensuring confidentiality and integrity.
Example: F5 BIG-IP SSL/TLS provides SSL/TLS offloading and
termination for enhancing web security.
3. Bot Detection and Mitigation:
Function: Identifies and blocks malicious bots and automated attacks
targeting web applications.
Example: Distil Networks (now part of Imperva) provides bot detection
and mitigation solutions for web security.

32. Technical and configuration specifications
3,4
•Security device management involves the configuration, monitoring, and maintenance of
security devices within an organization's network.
•These devices play a crucial role in safeguarding the organization's information systems
and data.
•Here are the technical and configuration specifications for effective security device
management:
1. Firewalls:
•Technical Specifications:
–Stateful inspection, packet filtering, proxy services.
–Intrusion Prevention System (IPS) capabilities.
–Virtual Private Network (VPN) support.
•Configuration Practices:
–Define and implement firewall rules.
–Regularly update rule sets based on emerging threats.
–Configure VPN settings for secure remote access.
References:
3. Network Security Essentials: Applications and Standards by William Stallings:
4. Information Security Management Principles by David Alexander, M. D. Whittaker and Jim Blyth

33. Technical and configuration specifications
2. Antivirus and Anti-Malware Solutions:
•Technical Specifications:
–Real-time scanning.
–Heuristic analysis.
–Regular updates for virus definitions.
•Configuration Practices:
–Schedule regular scans.
–Configure automatic updates.
–Implement email and web filtering.
3. Virtual Private Network (VPN) Solutions:
•Technical Specifications:
–Secure tunneling protocols (e.g., IPsec, SSL/TLS).
–Multi-factor authentication.
•Configuration Practices:
–Configure encryption parameters.
–Implement multi-factor authentication.
–Regularly update VPN client software.

34. Technical and configuration specifications
2. Security Information and Event Management (SIEM) Systems:
•Technical Specifications:
–Log aggregation and correlation.
–Real-time event monitoring.
•Configuration Practices:
–Define log sources and collection methods.
–Configure correlation rules.
–Customize dashboards for specific needs.
3. Encryption:
•Technical Specifications:
–Full disk encryption.
–Transport layer security (TLS) for communication.
•Configuration Practices:
–Enable full disk encryption on endpoints.
–Configure TLS for secure communications.
–Manage encryption key policies.

35. Architecture
5,6
•Architecture plays a pivotal role in designing systems that are robust, scalable, and secure.
Here are some key architecture concepts specifically relevant to security device management:
1. Centralized Management:
•Concept:
–Centralize the management of security devices to provide a unified control point.
•Benefits:
–Streamlines configuration changes and updates.
–Facilitates consistent policy enforcement.
–Simplifies monitoring and reporting.
2. Multi-Tenancy:
•Concept:
–Implement multi-tenancy to allow multiple entities (e.g., departments, clients) to use the
same security device management infrastructure.
•Benefits:
–Efficient resource utilization.
–Isolation of data and configurations between tenants.
–Scalable support for diverse user bases.
References:
5. Information Security
Architecture: An Integrated
Approach to Security in the
Organization by Jan Killmeyer
Tudor
6. Security in Computing by Charles
P. Pfleeger and Shari Lawrence
Pfleeger

36. Architecture
3. Cross-Platform Compatibility:
•Concept:
–Ensure compatibility with different operating systems and device types.
•Benefits:
–Enables the management of a heterogeneous device environment.
–Supports diverse deployment scenarios.
–Enhances interoperability.
4. Automated Remediation:
•Concept:
–Integrate automated remediation capabilities to address security issues without manual
intervention.
•Benefits:
–Speeds up the response to security incidents.
–Reduces the workload on security teams.
–Enhances overall system efficiency.

37. Patterns
7,8
•Design patterns provide reusable solutions to common problems in security
device management
•Design patterns help create scalable, maintainable, and secure systems.
•Some design patterns that can be relevant in the context of security device
management:
1. Singleton Pattern:
•Description:
–Ensures a class has only one instance and provides a global point of
access to it.
•Application:
–Ensure a single point of control or coordination for security device
management operations, preventing multiple conflicting
configurations.
References:
7. Security Engineering: A Guide to Building Dependable Distributed Systems by Ross J. Anderson
8. Information Security Management Principles by David Alexander, M. D. Whittaker, and Jim Blyth

38. Patterns
2. Composite Pattern:
•Description:
–Composes objects into tree structures to represent part-whole hierarchies.
•Application:
–Represent hierarchical security policies or configurations using composite
structures, allowing for easy traversal and application.
3. Command Query Responsibility Segregation (CQRS):
•Description:
–Separates read and write operations, allowing for different models and
optimizations for each.
•Application:
–Implement separate models for querying device status and configurations
versus issuing commands, optimizing performance and scalability.

39. Overall contribution: Security of design
and devices
•Resilience to Attacks: The combination of secure communication,
authentication, and access control mechanisms contributes to the overall
resilience of the system against unauthorized access and attacks.
•Visibility and Control: Centralized management, real-time
monitoring, and RBAC provide administrators with enhanced visibility
and control over security device configurations and operations.
•Adaptability to Change: Microservices architecture and design patterns
such as Observer and Decorator enhance the system's adaptability to
changes in security requirements and device types.
•Scalability and Performance: Scalability is achieved through
architectural concepts like multi-tenancy and microservices, ensuring
that the system can handle a growing number of devices while maintaining
performance.