6 - Security Part i - Auditing Operating Systems and Networks

(1)

AUDITING OPERATING

SYSTEMS AND NETWORKS

SECURITY

PART I

(2)

Focus of the Chapter



Sarbanes-Oxley compliance regarding the

security and control of operating systems,

communication networks, electronic data

exchange, and PC-based accounting

(3)

Lesson Objectives

After studying this chapter, you should:



Be able to identify the principal threats to the

operating system and the control techniques used to

minimize the possibility of actual exposures.



Be familiar with the principal risks associated with

commerce conducted over intranets and the Internet

and understand the control techniques used to reduce

these risks.



Be familiar with the risks associated with personal

computing systems.



Recognize the unique exposures that arise in

connection with electronic data interchange (EDI) and

understand how these exposures can be reduced.

(4)

(5)

What Is An Operating System (O/S)?

The operating system is the computer’s

control program. It allows users and their

applications to share and access common

computer resources, such as processors,

main memory, databases, and printers.

Examples of O/S: Google Chromium O/S,

(6)

An operating system (OS) is

software that manages computer

hardware and software resources

and provides common services

for computer programs.

The operating system is an

essential component of the

system software in a computer

system. Application programs

usually require an operating

system to function.

https://en.wikipedia.org/wiki/ Operating_system

(7)

Three Main Tasks Of Operating Systems



translates high-level languages into the

machine-level language



allocates computer resources to user

applications



manages the tasks of job scheduling and

multiprogramming

(8)

(9)

Req’ts For Effective O/S Performance

Five fundamental control objectives of the O/S

The operating system must:



Protect itself from users. Protect against tampering

by users



Protect users from each other. Prevent users from

tampering with the programs of other users



Protect users from themselves. Safeguard users’

applications from accidental corruption



Be protected against itself. Safeguard its own

programs from accidental corruption



Be protected from its environment. Protect itself

(10)

Operating Systems Security



Log-On Procedure

~

first line of defense – user IDs and passwords



Access Token

~

contains key information about the user



Access Control List

~

defines access privileges of users



Discretionary Access Control

(11)

Threats to O/S Integrity



Accidental threats

~

Hardware failure; errors in user application

program



Intentional threats

~

Attempt to access user data

~

Destructive progams

(12)

Operating Systems Controls



Access privileges



Password control



Malicious or destructive programs



System audit trail

(13)

Access Privileges

Audit objective: Verify that access privileges are

consistent with separation of incompatible functions and

organization policies

Audit procedures: Review or verify…



policies for separating incompatible functions



a sample of user privileges, especially access to data

and programs



security clearance checks of privileged employees



formal acknowledgements to maintain confidentiality

of data

(14)

(15)

Password Control

Audit objective: Ensure adequacy and effectiveness

of password policies for controlling access to the

operating system

Audit procedures: Review or verify…



passwords required for all users



password instructions for new users



passwords changed regularly



password file for weak passwords



encryption of password file



password standards

(16)

(17)

(18)

Malicious or Destructive Programs

Audit objective: Verify effectiveness of procedures

to protect against programs such as viruses, worms,

back doors, logic bombs, and Trojan horses

Audit procedures: Review or verify…



training of operations personnel concerning

destructive programs



testing of new software prior to being implemented



currency of antiviral software and frequency of

(19)

A COMPUTER VIRUS is a malware program that, when executed,

replicates by inserting copies of itself (possibly modified) into

other computer programs, data files, or the boot sector of the

hard drive; when this replication succeeds, the affected areas are

then said to be "infected”.

https://en.wikipedia.org/wiki/Computer_virus

ClamWin antivirus software

(20)

A COMPUTER WORM is a standalone malware computer program that replicates itself in order to spread to other computers. Often, it uses a

computer network to spread itself, relying on security failures on the target computer to access it.

Unlike a computer virus, it does not need to attach itself to an existing

program. Worms almost always cause at least some harm to the network, even if only by consuming bandwidth, whereas viruses almost always corrupt or

modify files on a targeted computer

Hex dump of the Blaster worm, showing a message left for

Microsoft CEO Bill Gates by the worm's programmer.

(21)

A TROJAN HORSE, or Trojan, in computing is generally a non-self-replicating type of malware program containing malicious code that, when executed, carries out actions determined by the nature of the Trojan, typically causing loss or theft of data, and possible system harm. The term is derived from the Ancient Greek story of the large wooden horse used to trick defenders of Troy into taking warriors concealed in the horse into their city in ancient Anatolia.

A Trojan often acts as a backdoor, contacting a controller which can then have unauthorized access to the affected computer

(22)

System Audit Trail Controls

Audit objective: Ensure that the established system

audit trail is adequate for preventing and detecting

abuses, reconstructing key events that precede systems

failures, and planning resource allocation.

Audit procedures: Review or verify…



how long audit trails have been in place



archived log files for key indicators

(23)

Audit trails can be used to support security

objectives in three ways:

(1)

detecting unauthorized access to the

system,

(2)

facilitating the reconstruction of events,

(3)

promoting personal accountability

Two types of audit logs:



Keystroke monitoring



Event monitoring

(24)

(25)

(26)

Terminologies



An INTRANET is a private network that is

contained within an enterprise. It may consist of

many interlinked local area networks and also

use leased lines in the wide area network.



The INTERNET is a global system of

interconnected computer networks that use the

standard Internet protocol suite (TCP/IP) to link

several billion devices worldwide.

(27)

Intranet Risks



Intercepting network messages

~

sniffing: interception of user IDs, passwords,

confidential e-mails, and financial data files



Accessing corporate databases

~

connections to central databases increase the risk

that data will be accessible by employees



Privileged employees

~

override privileges may allow unauthorized access

to mission-critical data



Reluctance to prosecute

~

fear of negative publicity leads to such reluctance

but encourages criminal behavior

(28)

Internet Risks



IP spoofing: masquerading to gain access to a Web

server and/or to perpetrate an unlawful act without

revealing one’s identity



Denial of service (DOS) attacks: assaulting a Web

server to prevent it from servicing users particularly

devastating to business entities that cannot receive

and process business transactions



Other malicious programs: viruses, worms, logic

bombs, and Trojan horses pose a threat to both

Internet and Intranet users

(29)

Three Common Types of DOS Attacks



SYN Flood – when the three-way handshake needed

to establish an Internet connection occurs, the final

acknowledgement is not sent by the DOS attacker,

thereby tying-up the receiving server while it waits.



Smurf – the DOS attacker uses numerous

intermediary computer to flood the target computer

with test messages, “pings”.



Distributed DOS (DDOS) – can take the form of

Smurf or SYN attacks, but distinguished by the vast

number of “zombie” computers hi-jacked to launch

the attacks.

(30)

Sender Receiver

Step 1: SYN messages

Step 2: SYN/ACK

Step 3: ACK packet code

In a Denial of Service (DOS) Attack – SYN Flood, the sender sends

hundreds of messages, receives the SYN/ACK packet, but does not

response with an ACK packet. This leaves the receiver with clogged

transmission ports, and legitimate messages cannot be received.

(31)

(32)

(33)

(34)

Controlling Risks



Firewalls



Deep packet inspection



Encryption



Digital signature / digital certificate



Message control techniques

(35)

Firewalls

Firewalls provide security by channeling all

network connections through a control gateway.



Network level firewalls

~

Low cost and low security access control

~

Do not explicitly authenticate outside users

~

Filter junk or improperly routed messages

~

Experienced hackers can easily penetrate the system



Application level firewalls

~

Customizable network security, but expensive

~

Sophisticated functions such as logging or user

(36)

(37)

(38)

Encryption

Computer program transforms a clear message

into a coded (cipher) text form using an algorithm.

Simplified encryption

(39)

Encryption (cont.)



The conversion of data into a secret code for storage and

transmission



The sender uses an encryption algorithm to convert the original

cleartext message into a coded ciphertext.



The receiver decodes / decrypts the ciphertext back into cleartext.



Encryption algorithms use keys

~

Typically 56 to 128 bits in length

~

The more bits in the key the stronger the encryption method.



Two general approaches to encryption are private key and public

(40)

Controlling DOS Atttacks

Controlling for three common forms of DOS attacks:

 Smurf attacks—organizations can program firewalls to ignore an

attacking site, once identified

 SYN flood attacks—two tactics to defeat this DOS attack

~ Get Internet hosts to use firewalls that block invalid IP addresses ~ Use security software that scan for half-open connections

 DDos attacks–many organizations use Intrusion Prevention

Systems (IPS) that employ deep packet inspection (DPI)

~ IPS works with a firewall filter that removes malicious packets

from the flow before they can affect servers and networks

~ DPI searches for protocol non-compliance and employs

predefined criteria to decide if a packet can proceed to its destination

(41)

Digital Signature / Certificate



Digital signature – electronic authentication

technique to ensure that…

~

transmitted message originated with the

authorized sender

~

message was not tampered with after the

signature was applied



Digital certificate – like an electronic

identification card used with a public key

encryption system

(42)

(43)

(44)

Message Control Techniques



Message sequence numbering – sequence number

used to detect missing messages



Message transaction log – listing of all incoming and

outgoing messages to detect the efforts of hackers



Request-response technique – random control

messages are sent from the sender to ensure messages

are received



Call-back devices – receiver calls the sender back at a

pre-authorized phone number before transmission is

completed

(45)

Audit Procedures – SUBVERSIVE

THREATS



Review firewall effectiveness in terms of

flexibility, proxy services, filtering, segregation

of systems, audit tools, and probing for

weaknesses.



Review data encryption security procedures



Verify encryption by testing



Review message transaction logs



Test procedures for preventing unauthorized

(46)

Equipment Failure

Line errors are data errors from communications

noise.

Two techniques to detect and correct such data

errors are:



echo check - the receiver returns the

message to the sender



parity checks - an extra bit is added onto

each byte of data similar to check digits

(47)

(48)

Audit Procedures – Eqpt Failure

Using a sample of messages from the

transaction log:



examine them for garbled contents caused

by line noise



verify that all corrupted messages were

successfully retransmitted

(49)

AUDITING ELECTRONIC DATA

INTERCHANGE (EDI)

(50)

WHAT IS EDI?



EDI (electronic data interchange) uses

computer-to-computer communications

technologies to automate B2B purchases.

(B2B -> business-to-business or e-biz)

~

EDI is an inter-organization endeavor.

~

The information systems of the trading partners

automatically process the transaction.

~

Transaction information is transmitted in a

(51)

What is EDI? (cont.)



EDI (Electronic Data Interchange) is the

transfer of data from one computer system to

another by standardized message formatting,

without the need for human intervention. EDI

permits multiple companies -- possibly in different

countries --

to

exchange documents electronically

.

(52)

EDI System

(53)

(54)

Benefits of EDI



Reduction or elimination of data entry



Reduction of errors



Reduction of paper



Reduction of paper processing and postage



Reduction of inventories (via JIT systems)

(55)

EDI Risks & Control

RISKS

CONTROL

Authorization automated and

absence of human

intervention

use of passwords and value

added networks (VAN) to

ensure valid partner

Access

need to access EDI

partner’s files

software to specify what

can be accessed and at

what level

Audit Trail

paperless and

transparent

(automatic)

transactions

control log records the

transaction’s flow through

each phase of the

(56)

EDI System using Transaction Control Log for Audit Trail

(57)

Audit Objectives - EDI



Transactions are authorized, validated, and

in compliance with the trading partner

agreement.



No unauthorized organizations can gain

access to database



Authorized trading partners have access

only to approved data.



Adequate controls are in place to ensure a

complete audit trail.

(58)

Audit Procedures - EDI



Tests of Authorization and Validation Controls

~

Review procedures for verifying trading partner

identification codes

~

Review agreements with VAN

~

Review trading partner files



Tests of Access Controls

~

Verify limited access to vendor and customer files

~

Verify limited access of vendors to database

~

Test EDI controls by simulation



Tests of Audit Trail Controls

~

Verify existence of transaction logs

~

Review a sample of transactions

(59)

AUDITING PC-BASED

ACCOUNTING SYSTEMS

(60)

PERSONAL COMPUTER SYSTEMS



PC operating systems



PC systems risks & controls

~

In general:

o Relatively simple to operate and program o Controlled and operated by end users o Interactive data processing vs. batch o Commercial applications vs. custom

o Often used to access data on mainframe or network o Allows users to develop their own applications

~

Operating Systems:

o Are located on the PC (decentralized)

(61)

(62)

(63)

PERSONAL COMPUTER SYSTEMS

(CONT.)

 Controls

~ Risk assessment

~ Inherent weaknesses ~ Weak access control

~ Inadequate segregation of duties

~ Multilevel password control – multifaceted access control

 Risk of physical loss

~ Laptops, etc. can “walk off”

 Risk of data loss

~ Easy for multiple users to access data ~ End user can steal, destroy, manipulate ~ Inadequate backup procedures

~ Local backups on appropriate medium ~ Dual hard drives on PC

(64)

(65)

IC PERSONAL COMPUTER SYSTEMS



Risk associated with virus infection

~

Policy of obtaining software

~

Policy for use of anti-virus software

~

Verify no unauthorized software on PCs



Risk of improper SDLC procedures

~

Use of commercial software

(66)

Audit objectives – PC systems

 Verify controls are in place to protect data, programs, and computers

from unauthorized access, manipulation, destruction, and theft

 Verify that adequate supervision and operating procedures exist to

compensate for lack of segregation between the duties of users, programmers, and operators