Information security versus network security in the Internet as critical infrastructure Security of Internet and Critical Infrastructures: European

Transcription

1 Information security versus network security in the Internet as critical infrastructure Security of Internet and Critical Infrastructures: European Experiences, Rome, 13 June 2011

2 Objectives Describe information security Describe network security They are not the same! Discuss criticality and the internet Discuss internet security

3 Information security Information systems process, store and exchange information Information security is about enforcing appropriate access to information You could add: Ensuring that the information is not altered without authorisation Ensuring that the information system functions But does this add anything?

4 Information security taxonomy Identification and Authentication Access Control Accountability Audit Object Reuse Accuracy Reliability of Service Data Exchange* [Source: IT Security Evaluation Criteria, 1991] *Network Security in RED

5 Information security management taxonomy Risk assessment Security policy Organization of information security Asset management Human resources security Physical and environmental security Communications and operations management Access control Information systems acquisition, development and maintenance Information security incident management Business continuity management Compliance [Source: ISO27002]

6 Information security taxonomy Access Control Authentication Non-repudiation Data Consistency Communication Security Data integrity Availability Privacy [Source: ITU Recommendation X.800, 1991]

7 Networks A network is a mechanism for transmission of information Networks comprise: Data infrastructure (communication paths) Signalling infrastructure (routing/switching) Management infrastructure (configuration/maintenance) Variety of technologies dependent on size and quality of service and speed requirements

8 Network security Network security is about ensuring that the network infrastructure: preserves the confidentiality and integrity of the data and remains available against attack

9 Network security Network security is about ensuring that the network infrastructure: preserves the confidentiality and integrity of information transmitted across the network and remains available against attack

10 Comparison INFORMATION SECURITY Transformation of information Two types of system o Processing o Storage Access control focussed NETWORK SECURITY Preservation of information Three types of system o Communication transmission o Signalling o Management Focussed on integrity of the infrastructure

11 Why does it matter? Because: The distinction between networks and systems is disappearing (agents, clouds, grids) Attackers typically access a system via a network It is important to develop a secure network architecture Standards tend not to focus on network security

12 The internet as an example The internet is a public network of networks Designed for resilience Data paths are not persistent (packet switched) Signalling is via routing protocols, for example: Open Shortest Path First (OSPF) for within an ISP Border Gateway Protocol (BGP) for between ISPs Management is usually via the Simple Management Network Protocol (SNMP)

13 Criticality The UK view is that: Criticality=Impact of loss National criticality is the impact of loss at a national level Focus on: Single points of failure Common mode failures Risk is much broader, a function of impact and likelihood of realisation

14 Critical parts of the internet? Internet exchange points (transfer of traffic between ISPs) Cabling infrastructure Global inter ISP routing table (BGP) Global addressing services (Domain Name System) Management infrastructure (SNMP)

15 Internet security Network resilience Mesh/dual ring topologies Self-healing networks (Synchronous Digital Hierarchy, SDH) Separacy (separate cabling) Diversity of network equipment (network elements)

16 Internet security Access control on network elements Physical security of network elements Personnel security Separation between data/signalling/ management functions No bridging to management networks from operational network Data traffic not to be treated as meta data (signalling or management)

17 Internet security Signalling format verification Protocols with security functions (DNSSec, SNMP v3) Configuration of network elements Robustness/vulnerability testing of all network services and protocols

18 Questions Contact: