Cyber Security Policy Specification and Management

18 - Windows Server 2003 Security Management

Effectively managing security policies in a large distributed Web Services environment is the key to secure e-business transactions. Security policy must ensure the end-to-end agreement for many-to-many interoperation; ensure the versioning interoperability and privacy of collaborating partners; and ensure the dynamic establishment of security policies because any statically defined security policy tends to be unsecured after a certain period of time. The traditional security policy configuration mechanisms, either the local configuration mechanism or the centralized configuration mechanism, cannot fully meet the above requirements. In this paper we describe a solution for managing security policies in a collaborative Web Services environment. This solution is based on ebXML CPP/CPA model and uses Interoperability Contract Document (ICD). It allows the collaboration parties to establish security policy dynamically for each individual interoperation; makes the selected policy confidential; and addresses the software, message, and policy versioning and interoperability issues. Our experience reveals the advantages of this approach over others.

It is our great pleasure to welcome you at the 3rd International Conference on Security of Information and Networks -- SIN 2010, organized in technical cooperation with the ACM Special Interest Group on Security, Audit and Control (SIGSAC). The conference, similar to SIN 2009 and SIN 2007, covers practically all aspects of security of information and networks. The SIN 2009 Conference had such sections as "Security Assessment, Policies, Educational Programs", "Security and Integrity Management and Models", "Cryptography, Security and Networks", "Access Control and Security Assurance", and "Attacks, Intrusion Detection". Based on accepted submissions, the following sections are presented at SIN 2010: Security Assessment, Policies, Privacy, and Educational Programs (12 papers);Management and Models of Security and Integrity (9 papers);Cryptography, Security, and Networks (10 papers);Attacks and Intrusion Detection (7 papers). We received 73 submissions of which only a small portion was accepted based on at least two independent reviews. At times three, even four, reviews were secured before a decision could be made. Among all the submissions, 31 were accepted as full papers (42%), 6 as short (8%), and 1 as a position statement (1%). The authors of the submitted papers hail from China, France, Germany, India, Iran, Italy, Japan, North Cyprus, Philippines, Portugal, Russia, Turkey, Ukraine, and USA. The papers of "Security Assessment, Policies, Privacy, and Educational Programs" section consider such topics as security standards and regulations, privacy, anonymity, educational issues, and digital forensics. "Management and Models of Security and Integrity" section papers consider various security management policies, models and architectures. "Cryptography, Security, and Networks" section features papers on cryptographic algorithms and protocols, as well as networks security. And finally, "Attacks and Intrusion Detection" section combines the papers discussing the detection and prevention of intrusions. SIN 2010 Conference gives researchers and practitioners a unique opportunity to share their perspectives with others interested in the various aspects of security of information and networks. We hope that these proceedings will serve as a valuable reference for security researchers and developers.

Resolve Security Policies Conflicts Through Semantics Matching Alignment

Traditionally, a security policy is defined from an informal set of requirements, generally written using natural language. It is then difficult to appreciate the compatibility degree of the manually generated security policy with the informal requirements definition. The idea of this paper is to automate the process of deriving the formal security policy, using a more structured specification of the security objectives issued by the administrator of the information system to be secured. We chose the goal-oriented methodology KAOS to express the functional objectives, then based on the results of a risk analysis, we integrate the security objectives to the obtained KAOS framework. Finally, through a process of transformation applied to this structured security objectives specification, we automatically generate the corresponding security policy. This policy is consistent with the access control model OrBAC (Organization Access Control).

Many researchers have considered security policy management, including how to configure policies manually and even how to automatically generate security policies based on security requirements. Both can be error prone, especially when properties of the network topology change, because security requirements are usually not bound to any particular route path. Our DETER lab emulation results show that conflicts could be caused by these factors. Therefore, a systematic way to validate the correctness of the security policies is essential. This paper presents an approach, CLID (conflict and looping identification and detection), to verify whether a set of security policies (e.g. IPSec/VPN tunnels) satisfy the given security requirements, without causing any conflicts. This approach utilizes the definition of a security policy lo include network routing data as well as traffic selector information, thus it works for general network topologies. We also analyze and justify the correctness of the approach. The paper concludes with our simulation results and addresses future work.

This textbook places cyber security management within an organizational and strategic framework, enabling students to develop their knowledge and skills for a future career. The reader will learn to: • evaluate different types of cyber risk • carry out a threat analysis and place cyber threats in order of severity • formulate appropriate cyber security management policy • establish an organization-specific intelligence framework and security culture • devise and implement a cyber security awareness programme • integrate cyber security within an organization’s operating system Learning objectives, chapter summaries and further reading in each chapter provide structure and routes to further in-depth research. Firm theoretical grounding is coupled with short problem-based case studies reflecting a range of organizations and perspectives, illustrating how the theory translates to practice, with each case study followed by a set of questions to encourage understanding and analysis. Non-technical and comprehensive, this textbook shows final year undergraduate students and postgraduate students of Cyber Security Management, as well as reflective practitioners, how to adopt a pro-active approach to the management of cyber security. Online resources include PowerPoint slides, an instructor’s manual and a test bank of questions.

Network function virtualization (NFV) is a new networking paradigm that virtualizes single network functions. NFV introduces several advantages compared to classical approaches, such as the dynamic provisioning of functionality or the implementation of scalable and reliable services (e.g., adding a new instance to support demands). NFV also allows the deployment of security controls, like firewalls or VPN gateways, as virtualized network functions. However, currently there is not an automatic way to select the security functions to enable and to configure the selected ones according to a set of user's security requirements. This paper presents a first approach towards the integration of network and security policy management into the NFV framework. By adding to the NFV architecture a new software component, the Policy Manager, we provide NFV with an easy and effective way for users to specify their security requirements and a process that hides all the details of the correct deployment and configuration of security functions. To perform its tasks, the Policy Manager uses policy refinement techniques.

Policies that address security and privacy are pervasive parts of both technical and social systems, and technology that enables both organizations and individuals to create and manage such policies is a critical need in information technology (IT). This paper describes the notion of end-to-end policy management and advances a framework that can be useful in understanding the commonality in IT security and privacy policy management.

Policy enforcement in the workplace

Rules are used as a way of managing and configuring firewalls to fulfill security requirements in most cases. Managers have to specify their organizational security policies using low level and order-dependent rules. Furthermore, dependency of firewalls to the network topology, frequent changes in network topology (specially in dynamic networks), and lack of a method for analysis and verification of specified security policy may reduce to inconsistencies and security holes. Existence of a higher level environment for security policy specification can rectify part of the problems. In this paper we present a language for high level and formal specification of security policy in firewalls. Using the language, a security manager can configure its firewall based on his required security policy independent of the network topology. The language is used as a framework for analysis and verification of security policies. We designed and implemented a tool based on theorem proving for detecting inconsistencies, coverage, as well as applying a query on the specified policy. Results of analysis can be used to detect security vulnerabilities.KeywordsFirewallFormal SpecificationSecurity Policy

In the globalized business world, financial information security management (FISM) and corporate risk management (CRM) have become critical elements for ensuring business sustainability and gaining a competitive advantage. The security of financial information not only protects the financial integrity of businesses but also supports long-term success by enhancing reputation management, regulatory compliance, and stakeholder trust. However, the necessity of addressing the relationship between financial information security and corporate risk management within a holistic framework has not been sufficiently emphasized in the literature, especially with the increasing threats in cybersecurity. This gap creates uncertainties regarding how businesses should integrate financial information security into their risk management strategies. The purpose of this study is to analyze the interaction between financial information security management and corporate risk management and to provide a practical and applicable framework for integrating financial information security into business risk management strategies. The study examines how financial information security management is integrated into corporate risk management processes (risk identification, assessment, response, and monitoring) and its impact on organizational performance (cost reduction, efficiency improvement, and competitive advantage). Considering major financial crises and cyberattacks, the global impact of financial information security threats on businesses, national economies, and the global financial system is increasingly being discussed. In this context, the study highlights the critical importance of FISM and CRM for businesses and presents concrete examples of the risks that may arise if these two concepts are not considered together (data breaches, financial losses, reputational damage, legal sanctions). The study systematically reviews existing approaches in the literature (such as ISO 27001 and the NIST Cybersecurity Framework) to contribute to the development of effective financial security and risk management policies for businesses.This study employs qualitative research methods, including a literature review and expert opinions. By analyzing current studies and industry reports, the relationship between financial information security and corporate risk management is examined in depth.In conclusion, integrating financial information security management with effective corporate risk management policies plays a crucial role in enhancing business sustainability, gaining a competitive advantage, and reducing costs. Businesses must adopt a holistic management approach that incorporates cybersecurity measures, financial risks, and regulatory requirements. This comprehensive approach is essential for ensuring long-term success and maintaining a competitive edge in today's dynamic business environment.

This document describes the problem space and solution requirements for developing an IP Security Policy (IPSP) configuration and management framework. The IPSP architecture provides a scalable, decentralized framework for managing, discovering and negotiating the host and network security policies that govern access, authorization, authentication, confidentiality, data integrity, and other IP Security properties. This document highlights such architectural components and presents their functional requirements.

The common security policies of access control and resource management are based upon a central managing authority, called the system administration, that is ultimately responsible for the management of a usage policy. This management is usually done with some combination of mandatory access control and discretionary access control methods, where each user is granted (or denied) privileges and resources depending on the usage policies enforced at that particular system. System administration includes the management of system resources, user accounts, and user privileges. This security policy is typified by an operating system such as UNIX, and it introduces several dificulties when working in a distributed computing environment. This paper addresses distributed resource management and access control. It proposes a new version of the “Distributed Compartment Model” (DChf), first developed by Greenwald in his 1994 doctoral dissertation. DCM consists of two major components: Handles, a method for role based access control, and Distributed Compartments, a method allowing users to manage resources within a distributed system across administrative domain boundaries. This new version of DCM discussed in this paper is a refinement of the original formal security policy model. This paper concentrates on the history and background of the problems motivating the creation of DCM, describes the informal security policy, proposes some ezample scenan’os as to how DCM could be used, and concludes with a discussion of the results of this research.

Security policy management is critical to meet organizational needs and reduce potential risks because almost every organization depends on computer networks and the Internet for their daily operations. It is therefore important to specify and enforce security policies effectively. However, as organizations grow, so do their networks increasing the difficulty of deploying a security policy, especially across heterogeneous systems. In this paper, we introduce a policy framework called Chameleos-x which is designed to enforce security policies consistently across security-aware systems with network services-primarily operating systems, firewalls, and intrusion detection systems. Throughout this paper, we focus on the design and architecture of Chameleos-x and demonstrate how our policy framework helps organizations implement security policies in changing, diversity-rich environments. We also describe our experimentation of Chameleos-x to demonstrate the feasibility of the proposed approach.