Why Your Data Is At Risk
by Randy Nash - @RISK Online - Monday, 20 December 2004.
How do we defend against so many possible attack vectors? The key is to focus on the data. The first step should be data-sensitivity analysis as part of an overall risk-assessment process. Data-sensitivity analysis begins by identifying an organization's critical data and ways in which that data is used. Once the sensitivity of data has been classified, the organization can reach decisions about the necessary level of protection for that data. Your tendency may be to apply the greatest level of protection available, but that level may be neither necessary nor cost-effective. For example, you wouldn't spend $100,000 on a firewall to protect an expected loss of only $5,000. You can get a better idea of how to apply countermeasures if you include a loss/impact analysis as part of the risk-assessment process.

Simple Approach

A simple approach to data protection looks at the various layers of security that can be applied. Consider the following starting checklist:

Data repository:
  • Do you need to encrypt the data repository?
  • Do you need a hash of the transactions for integrity purposes?
  • Should you digitally sign transactions?
  • Make sure that database logging is enabled and properly configured.
Server considerations:
  • Harden the operating system.
  • Disable unnecessary services and close ports.
  • Change system defaults.
  • Don't use group or shared account passwords.
  • Lock down file shares.
  • Restrict access to only necessary personnel.
  • Consider host-based firewalls and intrusion detection for critical servers.
  • Maintain proper patch procedures.
Network segment:
  • Use switches rather than routers or hubs as much as possible.
  • Lock down unused router/switch ports.
  • Consider MAC filters for critical systems.
  • Establish logical subnets and VLANs.
  • Set up access control lists (ACLs) for access routes.
  • Use ingress/egress filters, anti-spoof rules.
  • Determine appropriate location and functionality for network-based firewalls and intrusion detection.
  • Use encrypted logins or SSL for web-based sessions.
Physical security for data:
  • Establish input/output handling procedures.
  • Use physical access logs for server rooms and network operations centers.
  • Document tape-handling procedures, tape rotation, offsite storage.
  • Consider an alternate data center.
  • Archiving: Where does your data go to rest in peace?
  • Data destruction: Degauss, erase/overwrite, physical destruction?
  • How is data handled when equipment is sent out for repair, replacement, or end of life?

This is just a quick list of points to consider. Fortunately, folks much smarter than I am have developed a much more comprehensive approach.

Structured Approach

Security standards and guidance are available, especially for organizations that are part of or do business with the U.S. government. Through the work of various organizations, the government has put together a program known as Certification & Accreditation (C&A). Standards have been and continue to be developed that provide guidance on the performance of risk assessments, development of security plans, and the application of security controls.


101,000 US taxpayers affected by automated attack on IRS app

The IRS has revealed more details about an attack it suffered last month, mounted by unknown individuals with the aim to file fraudulent tax returns and funnel the returned money to their own bank accounts.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Wed, Feb 10th