Alignment of Organizational Security Policies Theory and Practice

236 Pages·2012·1.62 MB·English

Alignment of Organizational Security Policies
Theory and Practice
TrajceDimkov
CompositionoftheGraduationCommittee:
Prof.Dr.Ir. A.J.Mouthaan UniversiteitTwente
Prof.Dr. P.H.Hartel UniversiteitTwente
Prof.Dr. R.J.Wieringa UniversiteitTwente
Prof.Dr. M.Junger UniversiteitTwente
Prof.Dr. D.Gollmann HamburgUniversityofTechnology
Dr. C.W.Probst TechnicalUniversityofDenmark
Prof.Dr. E.R.Verheul RadboudUniversiteitNijmegen
This research is supported by the Sentinels program of the
Technology Foundation STW, applied science division of
NWO and the technology programme of the Ministry of
EconomicAffairsunderprojectsnumberTIT.7628.
CTITPh.D.ThesisSeriesNo.12-218
CentreforTelematicsandInformationTechnology
P.O.Box217,7500AE
Enschede,TheNetherlands.
IPADissertationSeriesNo. 2012-04
Theresearchreportedinthisthesishasbeencarriedout
undertheauspicesofIPA,theDutchResearchSchool
forProgrammingresearchandAlgorithmics.
ISBN:978-90-365-3331-7
ISSN:1381-3617(CTITPh.D.-thesisseriesNo. 12-218)
DOInumber: 10.3990/1.9789036533317
OfficialURL:http://dx.doi.org/10.3990/1.9789036533317
TypesetwithLATEX. Coverphoto: DraganSiskov.
Copyright(cid:2)c 2012TrajceDimkov,Enschede,TheNetherlands.
Allrightsreserved.Nopartofthisbookmaybereproducedortransmitted,inanyformorbyany
means,electronicormechanical,includingphotocopying,microfilming,andrecording,orbyany
informationstorageorretrievalsystem,withoutthepriorwrittenpermissionoftheauthor.
ALIGNMENT OF ORGANIZATIONAL SECURITY
POLICIES
THEORY AND PRACTICE
DISSERTATION
toobtain
thedegreeofdoctorattheUniversityofTwente,
ontheauthorityoftherectormagnificus,
prof.dr.H.Brinksma,
onaccountofthedecisionofthegraduationcommittee,
tobepubliclydefended
onThursday,23rdofFebruary2012at14:45
by
TrajceDimkov
bornon20thofJune1983,
inKavadarci,Macedonia
Thedissertationisapprovedby:
Prof.Dr. P.H.Hartel (promotor)
Abstract
To address information security threats, an organization defines security policies
that state how to deal with sensitive information. These policies are high-level
policies that apply for the whole organization and span the three security do-
mains: physical, digital and social. One example of a high-level policy is: ”The
salesdatashouldneverleavetheorganization.”Thehigh-levelpoliciesarerefined
bytheHumanResources(HR),PhysicalSecurityandITdepartmentsintoimple-
mentable,low-levelpolicies,whichareenforcedviaphysicalanddigitalsecurity
mechanisms and training of the employees. One example of low-level policy is:
”Thereshouldbeafirewalloneveryexternal-facingsystem”.
Theerroneousrefinementofahigh-levelpolicyintoalow-levelpolicycanintro-
ducedesignweaknessesinthesecuritypostureoftheorganization. Forexample,
although there is a low-level policy that places firewalls on every external-facing
system, anadversarymaystill obtainthesales datathroughcopyingiton aUSB
stick. Inaddition,theerroneousenforcementofalow-levelpolicyusingaspecific
securitymechanismsmayintroduceimplementationflaws. Forexample,although
there might be a firewall on every external-facing system, the firewall might not
be configured correctly. The organization needs assurance that these errors are
discoveredandmitigated.
In this thesis we provide methods for testing whether (a) the high-level policies
are correctly refined into low-level policies that span the physical, digital and
socialdomain,and(b)whetherlow-levelpoliciesarecorrectlyenforcedisspecific
mechanisms. Ourcontributionscanbesummarizedasfollows:
1. Weproposeaformalframework, Portunes, whichaddressesthecorrectre-
finementofhighlevelpoliciesbygeneratingattackscenariosthatviolatea
high-level policy without violating any low-level policies. Portunes binds
thethreesecuritydomainsinasingleformalismandenablestheanalysisof
policiesthatspanthethreedomains. Weprovideaproofofconceptimple-
mentationofPortunesinatoolandpolynomialtimealgorithmstogenerate
theattackscenarios.
2. Weproposeamodallogicfordefiningmoreexpressivehigh-levelpolicies.
WeusethelogictoexpresspropertiesofPortunesmodelsandmodelevolu-
tions formally. We provide a proof of concept implementation of the logic
inthePortunestool.
3. Weproposetwomethodologiesforphysicalpenetrationtestingusingsocial
engineering to address the correct enforcement of low-level policies. Both
methodologiesaredesignedtoreducetheimpactofthetestontheemploy-
ees and on the personal relations between the employees. The methodolo-
gies result in a more ethical assessment of the implementation of security
mechanismsinthephysicalandsocialdomain.
4. We provide an assessment of the commonly used security mechanisms in
reducing laptop theft. We evaluate the effectiveness of existing physical
and social security mechanisms for protecting laptops based on (1) logs
fromsecurityguardsregardinglaptoptheftsthatoccurredinaperiodoftwo
years in two universities in the Netherlands, and (2) the results from more
than 30 simulated thefts using the methodologies in contribution 3. The
resultsoftheassessmentcanaidinreducinglaptoptheftinorganizations.
5. Weproposeapracticalassignmentofaninformationsecuritymastercourse
wherestudentsgetpracticalinsightintoattacksthatusephysical,digitaland
social means. The assignment is based on the penetration testing method-
ologies from contribution 3. The goal of the assignment is to give a broad
overviewofsecuritytothestudentsandtoincreasetheirinterestinthefield.
Besidesforeducationalpurposes,theassignmentcanbeusedtoincreasethe
securityawarenessoftheemployeesandprovidematerialforfuturesecurity
awarenesstrainings.
Using these contributions, security professionals can better assess and improve
thesecuritylandscapeofanorganization.
ii
Samenvatting
Om informatiebeveiligingsrisico’s het hoofd te bieden, stellen organisaties een
beveiligingsbeleid op hoofdlijnen op, dat bepaalt hoe omgegaan dient te worden
metgevoeligeinformatie. Ditbeleidisgeldigvoordegeheleorganisatieenheeft
betrekking op drie beveiligingsdomeinen: fysiek, digitaal en sociaal. Een voor-
beeldvandergelijkbeleidis”Verkoopgegevensmogennooitbuitendeorganisatie
komen.”HetbeleidwordtdoordeafdelingenvanPersoneelenOrganisatie(P&O),
IT en fysieke beveiliging verder uitgewerkt in gedetailleerde beveiligingsregels,
die worden afgedwongen door fysieke en digitale beveiligingsmechanismen, en
door training van medewerkers. Een voorbeeld van zo’n regel is ”Elk van buiten
toegankelijksysteemmoeteenfirewallhebben.”
Fouten die optreden bij de vertaling van het beleid naar concrete regels of van
regels naar specifieke beveiligingsmechanismen, kunnen het beveiligingsniveau
van de organisatie aantasten. Alhoewel er een regel is die firewalls verplicht
stelt, kan een aanvaller bijvoorbeeld toch de verkoopdata verkrijgen door deze
opeenUSBsticktekopiren. Bovendienkunnenerindehandhavingvandegede-
tailleerde regels implementatiefouten zitten. Zo kan de firewall wellicht onjuist
geconfigureerd zijn. Organisaties moeten daarom de zekerheid hebben dat deze
foutenontdektengerepareerdworden.
Inditproefschriftontwikkelenwemethodenomtetestenof(a)hetbeveiligings-
beleid op correcte wijze is uitgewerkt in beveiligingsregels (fysiek, digitaal en
sociaal)correctis,en(b)dezeregelsopcorrectewijzegehandhaafdwordendoor
beveiligingsmechanismen. Onzebijdragenzijnalsvolgtsamentevatten:
1. Weintroducereneenformeelraamwerk,Portunes,datonderdeel(a)uitwerkt
door aanvalsscenario’s te genereren die het beveiligingsbeleid overtreden,
zonderdaarbijdegedetailleerdebeveiligingsregelstedoorbreken. Portunes
kan de drie beveiligingsdomeinen in n model representeren, en de bijbe-
horendebeveiligingsregelsanalyseren. Webeschrijveneenproof-of-concept
implementatie van Portunes in een tool en algoritmen die in polynomische
tijdaanvalsscenario’sgenereren.
iii
2. We presenteren een modale logica voor het definiren van geavanceerder
beveiligingsbeleid op hoofdlijnen. We gebruiken deze logica om eigen-
schappen van Portunes modellen en hun evoluties formeel uit te drukken.
Wepresenterentevenseenproof-of-conceptimplementatievandezelogica
indePortunestool.
3. We stellen twee methoden voor om on-site penetratietesten uit te voeren
gebruikmakend van social engineering, als uitwerking van onderdeel (b).
Beide methodologien zijn ontwikkeld om de impact van de testen op de
medewerkers en hun onderlinge relaties zo veel mogelijk te beperken, en
daarmeeeenmeerverantwoordebeoordelingvandeimplementatievanbeveilig-
inginhetfysiekeensocialedomeinmogelijktemaken.
4. Wepresentereneenevaluatievandemeestgebruiktebeveiligingsmechanis-
men om laptopdiefstal te reduceren. We evalueren de effectiviteit middels
de analyse van (1) rapporten van beveiligingsmedewekers met betrekking
tot laptopdiefstallen die hebben plaatsgevonden in een periode van twee
jaar bij twee Nederlandse universiteiten, en (2) de resultaten van meer dan
30 gesimuleerde laptopdiefstallen op basis van de methoden van bijdrage
3. De resultaten kunnen helpen om laptopdiefstal in de betreffende organ-
isatiestebeperken.
5. Wepresentereneenopdrachtindecontextvaneenmastervakinformatiebeveilig-
ing,waarinstudentenpraktischeinzichtenverkrijgeninaanvallendiefysieke,
digitale, en sociale technieken gebruiken. De opdracht is gebaseerd op de
technieken voor penetratietesten uit bijdrage 3.Het doel van de opdracht is
het geven van een breed perspectief op informatiebeveiliging en het ver-
groten van de interesse van de studenten in het vakgebied. Naast onderwi-
jsdoeleinden kan de opdracht ook gebruikt worden om het beveiligingsbe-
wustzijn van medewerkers te vergroten. Ook levert de opdracht materiaal
voortoekomstigesecurityawarenesstrainingen.
Met behulp van deze bijdragen kunnen professionals op het gebied van infor-
matiebeveiliginghetbeveiligingslandschapvaneenorganisatiedoeltreffenderbeo-
ordelenenverbeteren.
iv
Acknowledgements
It is morning. I have a coffee and a chocolate muffin next to me. The university
laptopisinfrontofme,readyforitslasttask. Whilesippingfromthewarmcoffee,
I am thinking of the last four years of my life. Four years full of nice memories,
years in which I traveled, I tried things, I laughed, I got (at least I think) smarter
andImetmylove,Paula.
During these years I was surrounded with great colleagues and friends. Without
their support, my PhD would have been a very lonely and boring journey. First
of all I would like to thank to my promoter Pieter Hartel and my daily supervi-
sors,QiangTanginmyearlydays,andWolterPietersinmymore”mature”days.
Pieter, it was a pleasure working with you. You guided me from day one of my
research, when you introduced me to Latex, up to last night, when we were dis-
cussing the abstract of the thesis. I particularly enjoyed the ”knifes on the table”
meetings, which sometimes lasted for hours. You were always strong in defend-
ing your views and noble in admitting when you were wrong. I guess if all your
students were like me, by now you would have had white hair or no hair at all.
Nevertheless,youwerepatientanddetermineduntiltheveryend. Thankyoufor
notgivinguponme.
AndthereisQiang. Westartedourlivesintheuniversitythesameday,Qiangas
a post-doc, I as a PhD. Qiang came full with ideas and I came full with enthusi-
asm. I vividly remember, during my first week in Enschede, I lost my passport.
QiangandIwerewalkingtwicethewholedistancefromMacandratotheUniver-
sity (10km), in the dark, searching through the autumn leaves for a Macedonian
passport. Itisoneofthosethingsyoucanneverforget. Qiang,Iwillalsoremem-
ber you by the trip we took in Chicago and all the parties we went....especially
the ones before Shenglan joined you. Although you were my daily supervisor
onlyforthefirstyearofmyresearch, youwerealwaysafriendhappytoprovide
insightsinthesecurityfieldandthePhDlife.
After the first year, Wolter become my daily supervisor. From the beginning he
wasthepersonIcouldsharemyideaswith,discusshowtoproceedforward,and
v
was the perfect mediator between Pieter and me. Wolter, thank you for the guid-
ance in the last three years and for the fresh ideas you brought in my research. I
amlookingforwardtoworktogetherwithyouontopicsbeyondmyPhDresearch.
Besides my supervisors I had my colleagues next to me. Andre, Shashank and
Ove, we were the three musketeers and d’Artagnan. We started our research life
atthesametimeandwearefinishingitatthesametime(moreorless). Andre´,you
were my best friend and my colleague in research. Thank you for being always
happy to help me with an advice or a drink. Shashank and Ove, this PhD would
havebeenlesscolorfulwithoutyoutwo. WhenIwilllookbackwardatthisperiod
ofmylife,Iwillrememberwithasmiletheweekendswehadatthesummerhouse
ofAndreandthegreattriptoIbiza.
I also want to thank all the current and former colleagues from the DIES group:
Stefan,Christoph, Arjan,Dina,Michael,Frank, Jonathan,Saeed,Luan,Mohsen,
Frank,Begu¨l,DuskoandtheothersthatIamnowforgetting. Iwillmissourcoffee
breaks at 3pm, where we discussed about all the topics in life. I will remember
the spontaneous trip we took to Barcelona as a result of one of those discussions
(Christoph, it is not a nine hours drive to Barcelona). Always present were my
friendsfromSecurityMatters: Damiano,Emmanuele,MicheleandSpase. Wehad
greatdiscussions together (when Michele wouldlet us talk) and were supporting
each other throughout the years. Guys, thank you for being part of my research
life. Iamlookingforwardtoworkwithyouinthefuture. Iamalsogratefultomy
favorite secretaries, Bertine and Nienke. Nienke, I was always happy to start the
day with you and a hot coffee. Thank you for helping me through the mazes of
the Dutch laws and the university procedures. Bertine, thank you for helping me
inpreparingthisthesisandfortheusefuladvicesonholidaydestinations.
The last four years I spent living in Macandra, the ugliest building in Enschede
withthebiggesthartintheNetherlands. Imetalotoflifelongfriendsthere. Atthe
beginning it were students from the Erasmus network, with which I spent lots of
sleepless nights and great adventures. In the later years, I met there Juan Carlos,
Mirjam, Yuri, Edit, Mehmet and Damla. Friends, thank you for the Munchkin
games,theskiingvisitsatBottropandthemanyeventswesharedtogether.
In Macandra I met not only my friends, but also my love. Paula, I love you with
allmyheartandIamgratefulforthesupportandthepatienceyouhadduringmy
PhD.TogetherwespentthebestmomentsofmyPhDlife. Iamlookingforward
formanymore
Finally,thebiggestgratitudegoestomyfamily. Mama,tato,batoiMaja. Vieste
mi familija od sonisˇtata. Vo poslednive cˇetiri godini, tokmu zaradi vas nikogasˇ
ne se pocˇustvuvav sam. Cel zˇivot bezuslovno me podrzˇuvate vo moite nameri i
vi