Slide 1Slide 2Slide 3Slide 4Slide 5Slide 6Slide 7Slide 8Slide 9Slide 10Slide 11Slide 12Slide 13Slide 14Slide 15Slide 16Slide 17Slide 18Slide 19Slide 20Slide 21Slide 22Slide 23Slide 24Security ArchitecturesCyber Security LabSpring 2008Security Policy•A security policy is a formal statement of the rules by which people who are given access to an organization's technology and information assets must abide – RFC 2196•Security policy separates the world into secure and insecure states–What is the information to be protected?–Who is responsible?•Dictating what not how•Must be feasible to implementSecurity Policy•The organizational security policy guides the requirements for a security design–The security policy is an English document–Hopefully rather precise–Defines the goals of the security implementation•Often there is a hierarchy of policy–From broad organizational policy–To more detailed technology specific security guidelinesSecurity Policy References•RFC 2196 – Site Security Handbook–Discusses policy and more general design and implementation issues. Published in 1997, so some of the technology references are dated, but the general recommendations are still valid •SANS policy examples– http://www.sans.org/resources/policies/•Information Security Policies and Procedures, Thomas Peltier–In the library5U of I Security Policies•U of I System Information Security Policies–System wide policy–Brief, Identifies what, not how–http://www.obfs.uillinois.edu/manual/central_p/sec19-5.html•CITES Policies and Guidelines–http://www.cites.uiuc.edu/edtech/policies_guidelines/index.html•CITES Network procedures and guidelines–http://www.cites.uiuc.edu/guidelines/network/What is a security architecture?•A framework that guides the security implementation–Guided by the security policy–Breaks the problem into modular pieces•Can implement and perfect a module •Can repeat implementation of proven modules and organization grows, e.g. remote office module•Abstracting from implementation specifics aids in understanding the guiding structure of the systemArchitecture Abstractions•May be useful to think in terms of physical analogs–Data in file cabinets•Drawer granularity•Locks–Fortresses or silos •Gates or guards at limited access points•Toll boothsSecurity Architectures•Can generalize security architecture for classes of systems•Can be found for many general system elements–J2EE applications–Client server applications–.Net applicationsCisco SAFE •A series of network security architecture blueprints–Identifies frameworks for particular scenarios–Analyzes placement of security enforcement devices in the network design•Even if you don’t use these modules, the analysis can help you understand reasons for using mechanisms at various points•Modules enable people to incorporate portions of the blueprint into their environment•Following diagrams are from the SAFE Enterprise document–Copies handed out in classCisco Icon Overview•Complete overview at http://www.cisco.com/warp/public/503/2.htmlOverall Enterprise DesignEnterprise CampusManagement ModuleBuilding Distribution ModuleBuilding ModuleServer ModuleEdge Distribution ModuleSecond portion of architecdtureMore of the second portionCorporate Internet ModuleCorporate Internet – Another ViewVPN/Remote Access ModuleE-Commerce ModuleE-Commerce Module, another
View Full Document
Unlocking...