2012 Risk Assessment Workshop Agenda Risk Assessment Strategy for Texas State Device Registration Application Risk Assessment using ISAAC Review Server Management responsibilities 1
Risk Assessment Strategy at Texas State What s happening in 2012 Device Registration ISAAC (Information Security Awareness, Assessment, and Compliance) minor modifications Penetration Testing by IT Security Core Impact, open source tools, 3 rd party assessment Confidential Information Discovery Identity Finder Firewall exception process - new Risk Assessment Strategy at Texas State Results from 2011 Review trend data 2
ISAAC Risk Assessment what s new Modified questions reflecting the updated TAC 202 Using the Template method for your ISAAC assessment again this year Device Registration Device Registration application https://tim.txstate.edu/ndmrs/ Secure application (HTTPS) Search feature Activate/Inactivate feature 3
ISAAC ISAAC Assess Texas Administration Code (TAC) 202 compliance Accepted method for conducting risk assessment https://isaacs.tamu.edu/ Risk Assessment Checklist Update Device Registration https://tim.txstate.edu/ndmrs/ Make sure all current devices registered for your department are active Update ISAAC Registration Open your 2012 assessment templates Review questions in ISAAC and mark complete 4
Server Management Responsibilities Policies UPPS 04.01.09 Security policy http://www.txstate.edu/effective/upps/upps-04-01-09.html UPPS 04.01.09 Server Management http://www.txstate.edu/effective/upps/upps-04-01- 09.html DIR Requirements annual risk assessment Confidential information handling Disposal of electronic media Risk Assessments and Compliance Annual process for all servers Servers are considered devices that offers services to other computers such as: Web and secure-web services (http, https) File sharing services and secure print servers (devices storing confidential data) Completed by Data Custodian (sysadmin) and Data Owner Other compliance issues PCI, HIPAA 5
Services and Protocols Services that are not required for the server to meet its mission must be disabled whenever the server is connected to the university network Demonstrate how to disable services and protocols in Windows Server 2008 Services and Protocols 6
User Account Management Demonstrate disabling, renaming, deleting user accounts in Windows Server 2008 Managing passwords User Account Management 7
Windows Permissions Share Permissions Security Permissions Security permissions are more granular permissions on the folders and files inside the share Beware "Inherit Permissions" Intrusion Protection Anti-virus Network IPS Host-based firewalls Tipping Point and Palo Alto Special reports available 8
Event Log Management and Notification Backup and Recover Data Center backup Windows server backup 9
Logon Banner Configuration Demo OS and Anti-Virus Updates In general, vulnerability patches should be applied within 72 hours Anti-virus protection for servers Configure for automatic updates from antivirus server 10
Physical Security Environmental monitoring Physical access controls: Escorts Video monitoring Card reader access Theft protection Remote Access Encryption Virtual Private Network Available to all University faculty and staff Secure remote access from public networks https://ive1.txstate.edu/ 11
Centrally Managed Services Security incident management Report suspected incidents to IT Security Penetration testing and vulnerability scanning and VPN Perimeter firewalls Data Center consolidation Secure grant data storage File share cluster Backup and recovery SCCM http://security.vpit.txstate.edu itsecurity@txstate.edu Hands-On Device Registration And ISAAC Assessment 12
Tools and References IT Security Website SANS Security Checklists Open source tools for web site scanning OWASP project www.owasp.org Security Configuration Benchmarks (CIS) Microsoft Security Baseline Analyzer (MSBA) microsoft.com/technet/security/tools/mbsahom e.mspx Nmap for Windows (nmap.org) Windows Defender Sysinternals http://live.sysinternals.com/ Identity Finder www.tr.txstate.edu/software/download/identityfinder.html http://security.vpit.txstate.edu itsecurity@txstate.edu Q & A 13