3.10F Security Architecture
It is important for a risk practitioner to evaluate the system architecture in terms of appropriateness of controls and other forms of risk response. System architecture should be robust enough to provide assurance against malicious activity.
Security architecture provides overview and relationship between systems and hence it is very useful in complex security deployment.
Primary purpose for developing a security architecture is to align the security strategy between the functional areas of the organization and external parties.
Platforms and Operating Systems
Organizations should purchase the IT equipment from trusted vendors to avoid the risk of infected devices. Also, new devices should be tested thoroughly before implementation. This helps to address the risk of hardware infected with back doors and security vulnerabilities during the manufacturing or delivery process.
If a hardware is not certified by the vendor or the manufacturer, there remains an unknown risk.
Vendors provided default accounts and passwords should be disabled or changed.
Strong authentication is required for privilege accounts such as administration.
Organization should ensure use of licensed operating software and regular updation of patch and configuration.
Patch management policy should be available. Patch should be tested before deployment. In exceptional cases, pre-testing of patches may not be feasible due to business emergency, in such cases organization should have a rollback plan to roll back the patches from the system in case of adverse impact of patch deployment.
Operating software should be hardened to disable all the unused services.
Applications
Adoption of secure coding practices is necessary to address the flaws or bugs in the coding of the application.
Application should have proper design, coding and testing to address the vulnerabilities.
Organizations should study the common vulnerabilities published by the Open Web Application Security Project (www.owasp.org) and should address these vulnerabilities.
Applications can be made secured by adopting following practices:
Sensitive data should be masked
Restricted access for the users
Input controls such as range checks, reasonableness checks etc.
Reconciliation and balancing for proper processing of transaction
Use of digital certificates for authentication
Encryption of stored as well as in transit data
Secure coding practices
Use of middleware to isolate direct access and manage data input/output
Network isolation and secure communications channels
Absence of validation checks for data input fields is a major vulnerability. It provides an opportunity for attackers to exploit the system by way of SQL injection attack. Attackers can submit a part of a structured query language statement to gain access to the application and database. They can deface or even disable the web applications.
Organization to evaluate the risk associated with legacy systems and should be controlled by use of middleware, network isolation and secure communication channels.
Error messages should not be displayed in such a way that they might provide information to an attacker that can be used to modify the attack. Error messages should have different code that can be understood by IT department only for rectification.
Use of multiple factors of authentication for critical systems such as biometric access and a password.
User account should be automatically locked out after a number of failed login attempts.
When an application is developed from a third party, it is always recommended to conduct a security code review for the entire application to detect all the malware including back doors.
Key aspects from CRISC exam perspective
Flashcards - 3.10F Security Architecture
Practice Questions - 3.10F Security Architecture