Wireless Network Security

Wireless Network Security

Jerry Grugin

 

In this blog, we will be looking at wireless security.  Specifically, we will be looking at five different things:

• Weak Encryption = WEP
• SSID Broadcast
• MAC Filtering
• Rogue Access Points
• War Driving, Bluejacking, and BlueSnorting

WEP - Wired Equivalent Privacy

Wireless was designed to be very promiscuous.  The early standard of authentication had two forms of authenticating devices:  There was Open System.  This is basically where if you come in range you are connected.  Wireless communications was to extend to the masses this thing we call connectivity.  It was designed to be an open system.  The other type of authentication is shared key.  Shared key is just where one person puts in a password and then the administrator on the access point puts in a password.  These passwords or "keys" are called static WEP keys.  The name WEP gave people a false sense of security.  There is nothing secure about wired equivalent privacy.  The goal was to have equivalent privacy to wired networks, but the problem is that there are some major inherent weaknesses with WEP.

For encryption, we have four types of encryption for wireless communications.  We have WPA, WPA2, WEP 64 bit, and WEP 128 bit.  We do not want to use WEP 64 bit.  At home, it is OK to use WEP 128 bit.  However, if we have the choice, it is better to use WPA.  Even better is WPA2.  This is the wifi standard.  It is called 802.11i or RSNA (Robust Security Network Associations).

Wireless Setup

SSID is the workgroup name.  It is the workgroup of devices that will communicate with the access point.  You want to change the SSID name to something that is not the vendor supplied SSID.  We are given the choice to hide or not hide the name of the SSID from being broadcasted.  We want to hide the SSID from being broadcasted.  However, choosing not to broadcast the SSID gives us a false sense of security.  We need to be aware that the SSID will still be communicated in other transmissions to other devices and the SSID can still be pulled out of the air with Aeropeak.

Under profile, it is basically asking what type of .11 someone is using.  The one that is used most often is 11g because it is backwards compatible and it gives you up to 52 megabit per second of theoretical bandwith.  The passphrase should be a strong password.  Strong passwords were covered in another blog.

MAC Filtering

We want to go through our business or system and only allow certain MAC addresses.  You are going to name them or give them some type of label and then manually configure the MAC addresses of all the systems.  The result is that only those MAC addresses will be able to authenticate to the switch port.  Again, this provides a false sense of security because there are programs out there that can spoof MAC addresses or that can change MAC addresses.

Rogue Access Points

You want to be aware of any rogue device or any unauthorized device on your network.  With rogue access points you can have it connected to your laptop and do wireless sniffing and scanning in a corporate environment.  This is what an attacker would do.  A rogue access point is small and can be obtained for 60 dollars or less.  A rogue device is anything that is unauthorized.

Wardriving

Driving through different areas and finding open access points.  You are looking for people who are using null authentication.  You are also looking for people who are using WEP and are using default SSIDs.  Wardrivers go one step further and do war chalking.  They will go to the building and put down symbols that tell people that it is a null authentication point and other things.  The main goal of wardriving is to gain free internet access, but it can lead to other malicious activity.

Bluejacking

This involves bluetooth.  bluetooth is not compatible with 802.11.  There is all different types of bluetooth technologies.  They operate over the 2.4 gigahertz range.  Bluejacking is sending unwanted messages over bluetooth.  It is typically a harmless activity.  However, there are trojan horse programs being sent to bluetooth devices.

Bluesnarfing

Illegal hacking of mobile phones using bluetooth.

Bluesnorting

A free network intrusion detection software.  There are wireless versions of snort.  Introducing IDS and IPS protocol analysis in a bluetooth environment.

Conclusion

In this blog, we looked at

• Weak Encryption = WEP
• SSID Broadcast
• MAC Filtering
• Rogue Access Points
• War Driving, Bluejacking, and BlueSnorting

Network Infrastructure Attacks

Network Infrastructure Attacks

Jerry Grugin

 In this blog, we will look at network infrastructure attacks and how to protect the network infrastructure from a wide array of a variety of attacks.  This blog on infrastructure attacks will cover the following:  Legacy Protocols, TCP/IP Hijacking, Null Sessions, Spoofing, Man-In-The-Middle Attacks, Replay, DOS, DDOS, Domain Name Kiting, DNS Poisoning, ARP Poisoning, Weak Passwords, Back Doors, and Default Accounts.  There are a lot of things to be covered, but it has to be covered as it relates to the exam.

Legacy Protocols and Services

When we are talking about network infrastructure attacks involving legacy protocols and services, what we are really talking about is a lot of older UNIX programs, programs that have been around for quite a while.  These programs have been around for so long that there are many people out there who are experts at exploiting the vulnerabilities in these services.  So, what we are talking about is using newer versions of these protocols or services or replacing them altogether in order to mitigate attacks.  For example, instead of using TELNET, we might want to focus on using SSH which encrypts data traffic which goes between the client and the server.  SSH is really creating a virtual private network tunnel.  In another example, instead of using http, we might want to use SSL/TLS.  In yet another example, instead of using NTP, we might want to consider using NTP v3 which has some authentication integrity built into it.  Instead of using SNMP, we might want to consider using SNMP v3 which allows us to use things like 3DES and AES encryption.

TCP/IP Hijacking and Man-In-The-Middle Attack

TCP/IP Hijacking and Man-In-The-Middle Attack go hand-in-hand.  We need a definition of Man-in-the-middle attack first.  A Man-In-The-Middle Attack, the attacker is going to place himself somewhere between two communicating network devices.  The attacker could place himself between a client and a server.  Once the attacker has access, he is going to attempt to trick, fool, or spoof both sides of the communications.  So, if we have Alice and Bob on both sides trying to communicate with each other, the attacker is going to try to make Bob believe that the attacker is Alice, and is going to try to make Alice believe that the attacker is Bob.  How does this relate to TCP/IP Hijacking?  If the attacker is able to become a man-in-the-middle, he can escalate his attack by hijacking a session.  So, basically the attacker is hijacking a TCP port a TCP part of the communication.  The attacker takes over the established connection, typically between the client and the server.  TCP Hijacking is also referred to as session hijacking.  TCP Hijacking is one of the more popular forms of session hijacking.

Null Sessions

 Null sessions are arguably one of the most vulnerable Windows vulnerabilities of all time.  Null sessions are a kind of Windows server message block SMB communication for file and print sharing.  Null sessions give attackers the ability to connect to unsecured IPC$ share.  Once communications is established in the null session, many tools can be used against the Windows systems.  Windows XP, VISTA, 2003, and 2008 are safe.  Unpatched Windows NT/2000 machines are vulnerable.  There are a whole lot of Windows 2000 machines still out there.  Persons using Windows 2000 machines need the most recent updates or they need to upgrade.

Spoofing

Spoofing can occur at many layers of the OSI model.  ARP Spoofing occurs at layer 2.  IP Address Spoofing occurs at layer 3.  Spoofing is essentially using a false source address.  Attackers use the face address to hide their identity and the attack is blamed on something or somebody else.  Spoofing is just pretending to be an IP or MAC address with the goal of injecting false information.

Replay attacks

A replay attack is when a malicious user gets data from a network with a packet sniffer.  For example, ethereal on a wired network or Aeropeak on a wireless network.  For example, an attacker might capture authentication data or credentials of a user logging onto a network and then, later on, reusing that data to be able to log on themselves.  Once they impersonate the user, they may try to escalate privileges.  CHAPv2 will mitigate against replay attacks.  IPSEC implementation can also mitigate against replay attacks.

DOS and DDOS

Denial of Service and Distributed Denial of Service attacks are attacks against availability.  It causes failures of systems and services.  It includes BOTNETS, DOS, DDOS, TCP SYN, and ICMP floods.

Domain Kiting

This term was coined by the president of GoDaddy.com, Bob Parsons.  Domain Name Kiting is a scam involving a few domain name registrars who purchase many well-indexed expired domains.  Temporary web sites host these domains loaded up with advertisements and paid links.  Domains are then dropped before the 5 day grace period.  Domains are perpetually trapped in scheme and unavailable to the public.  ICANN presently allows the practice.

DNS Poisoning

DNS Poisoning is Domain Name System Poisoning.  This has been a problem since the early days of DNS.  Another name for it is DNS Cache poisoning.  Basically, this is taking buffers in memory or caches in memory and filling them with bad information by redirection, inputting bad information, or other methodologies.

Passwords

Strong passwords have these characteristics:

• 10 or more characters
• Uses all 4 character types - upper case, lower case, numbers, and symbols
• Using group policy, if someone attempts to log in three times unsuccessfully, we will lock them out
• Also going to enforce password history.  Going to make sure that someone does not use the same password again.

Back Doors

Back doors redirect people who are during searches.  For example, when people search for something on google and they click on the link, they will be redirected to some other site.

Default Account Vulnerability

Many times, default accounts have vulnerabilities.

Conclusion

In this blog, we looked at network infrastructure attacks and how to protect the network infrastructure from a wide array of a variety of attacks.  This blog on infrastructure attacks covered the following:  Legacy Protocols, TCP/IP Hijacking, Null Sessions, Spoofing, Man-In-The-Middle Attacks, Replay, DOS, DDOS, Domain Name Kiting, DNS Poisoning, ARP Poisoning, Weak Passwords, Back Doors, and Default Accounts. 

Implementing Security Applications

Implementing Security Applications

Jerry Grugin

In this blog, we will look at several applications which are implemented on the client side and which may be important for the security + exam.  We will look at the following:  HIDS/HIPS, Personal Firewall, Anti-virus, Anti-spam, Anti-spyware & Pop-up blockers.

IDS

An intrusion detection system captures packets on the network or packets that are going into a workstation (in real time).  It is going to process them and respond to threats.  It analyzes copies of the data to detect malicious activity or suspicious activity based on existing signatures.  It relies on how recent your signature database is as to how effective it is.  In IDS will not affect throughput because it is non an inline solution.  What it does it sends copies of data to a device called a sensor.  A sensor can be software installed or it can be an actual physical device.  Thus, an IDS will allow some malicious things to pass before it can even respond to the network.  So, an IDS is more reactive than an IPS.  An IPS is more proactive.

IPS

An intrusion prevention system is an inline solution which monitors layers 2 through 7 of the OSI model.  IPS can do deep packet inspection deep into the data.  Intrusion prevention systems must be able to handle whatever network traffic occurs.  An IPS, when tuned properly, will stop malicious traffic from entering your networks or systems.

OSI Model

Layer 7 - Application layer - DNS and SMTP and other applications

Layer 6 - Presentation layer

Layer 5 - Session Layer - This is what allows us to have several browsers open at the same time

Layer 4 - Transport Layer - This is where the TCP and UDP protocols operate

Layer 3 - Network Layer

Layer 2 - Data Link Layer

Layer 1 - Physical - This is where everything is encoded in zeros and ones

HIPS Characteristics

• Software installed on hosts.  It is not hardware.
• Audits log files, file systems, resources
• Provides individual host-detection/prevention
• Can be centrally managed
• Stops attacks in real-time using signatures and anomolies
• Some HIPS can combine best features of A/V, personal firewall, and application FW all in one solution.

Personal Firewalls

Firewalls are just protection software such as Norton.  Firewalls can help protect against viruses, spyware, and spam.

Conclusion

It is important to remember that when talking about security applications, we want to have security in-depth.  This means we may want to have a combinations of IPS, HIPS, personal firewalls, and other things.  Having just one thing is not enough.  We want to have layered security, the type which protects us at more than just at one point.

In this blog, we looked at several applications which are implemented on the client side and which may be important for the security + exam.  We will look at the following:  HIDS/HIPS, Personal Firewall, Anti-virus, Anti-spam, Anti-spyware & Pop-up blockers.  I can't stress enough that it is important to have a combination of HIDS/HIPS, Personal Firewall, Anti-virus, anti spam, anti spyware, and pop-up blockers.  We want this because we want to have layered security or security in-depth.

Application Security

APPLICATION SECURITY

Jerry Grugin

 

The weak link to security in an organization is the end user.  Most all of us are end users.  In this blog, we will look at several key areas of application security.  We will look at the most majorly vulnerable areas.  We will look at mitigation strategies against some of these vulnerabilities.  Some of the things we will look at include:  Active X, Java, Scripting, Cookies, XSS, Buffer Overflows, SMTP Open Relays, P2P File Sharing, Instant Messaging, and Phishing.  This is not an all encompassing list, but it is an important list to know, especially if taking the security + examination.

Active X

Active X security is a Microsoft technology that has been implemented in its browsers for several years now.  Active X presents what is called controls, scriplets, or applets which allows you to customize the web experience.  Active X extends and enhances the web experience beyond just basic HTML.  It allows you to customize controls, icons, and features.  Active X runs on the client side and it has historically been a huge vulnerability in internet explorer.  However, IE v.7 has what is called Active X opt in.  Anyone who is designing Active X controls should follow Microsoft guidelines for secure design principles.  The technology or method that Microsoft uses for security is called Authenticode.  Authenticode leverages certificate technology that allow active X components to be validated by certificate servers.  You should not automatically accept Active X controls.  If you automatically accept all Active X controls, you run the risk of accepting Active X that has embedded malicious code which can exploit vulnerabilities on a system.  Thus, in summary, Active X has four key components:

• Enhances web experience
• Huge vulnerability in I. E.
• Should follow secure design principles
• I.E. 7 has Active X opt in

JAVA

JAVA is a full-blown programming language.  It is a full program of applications.  It includes things like the JAVA virtual machine, the JAVA run-time environment.  For our purposes, we are concerned with JAVA Applets, which are small chunks of code which can be run on embedded devices, mobile phones, and web browsers to provide improved functionality when browsing the world wide web.  Remember the following things about JAVA:

• A platform or related products from SUN written in JAVA programming language
• Clients have to download the JAVA runtime environment (JRE)
• JAVA applets are downloaded to clients and run in a "safe" sandbox
• Attackers create or exploit unsafe JAVA applets

Scripting

Active X controls can be written through script.  There is also JAVA script in addition to other kinds of script.  Scripts are small chunks of code or applets that deliver functionality.  A script is not a full blown application or a full blown program.  It provides extended functionality to a program or application.  Remember the following:  CGI scripts can be problematic.  They present security holes.  They might intentionally or unintentionally leak information about a client system

XSS (Cross-Site Scripting)

Cross site scripting is one of the most popular categories of exploitation found on the internet.

• XSS is accountable for over 80% of documented security vulnerabilities.
• It allows code injections into web pages
• Also does phishing attacks / browser exploitation
• Attack is often transparent to users
• XSS written in several languages
• There have been many XSS attacks since the 1990s
• DOM-based, persistent, non-persistent

Buffer Overflows

• Second most popular client attack
• APP receives more data than expected
• Program terminates or writes beyond
• May leave system vulnerable
• Program errors or malicious code
• Code Red & SQL Slammer Worms

SMTP Open Relays

• An SMTP email server that permits third-party relay of e-mail messages
• A.K.A. third party relay or insecure relay
• Malicious senders can send large volumes of spam
• Sever owner, web misconfigurations, is often unaware
• Can lead to system crashes, equipment damage, and loss of business
• M.A.P.S is now owned by TrendMicro

P2P File Sharing

• A good rule --- just don't use P2P. 

Instant Messaging Threats

• Instant messaging is a threat to productivity
• Instant messaging sends information in clear-text.  Therefore, it is a threat to security.

Phishing

Beware of look-alike websites that mimic the real websites.  People send other people emails using links to fake websites that look like real companies such as ebay, DirecTV, or other popular websites.  They bait people into giving information such as credit card numbers, addresses, phone numbers, bank account numbers, telephone numbers, etc, etc.

Conclusion

In this blog, we have looked at several areas of application security to include the following:  ActiveX, JAVA, Scripting, Cookies, XSS, Buffer Overflows, SMTP Open Relays, P2P File Sharing, Instant Messaging, and Phishing.  Hope the information provided in this blog has been helpful.

Crytographic Algorithms and Protocols

Cryptographic Algorithms and Protocols (More)

Jerry Grugin

In this blog, we will look at hashing concepts and protocols, revisit encryption algorithms, and look at additional protocols such as SSL/TLS, SMIME, HTTPS, SHTTP, L2TP, IPSEC, and SSH.

Hashing

Hashing is often used to secure passwords on network devices, used in authentication protocols like CHAP.  It can also be used to provide data integrity by creating a hash, appending it to data, and sending that over the wire.  Thus, hashing is a mechanism that is used primarily for data integrity assurance.  It is based on one-way mathematical functions that are relatively easy to compute, but they are very difficult to reverse.  For example, imagine that you had a jar full of marbles and you took that jar and tossed it onto the floor.  Think how difficult it would be to compile all those marbles back into the jar in the same exact position they were on before you tossed the jar onto the floor.  Think about the following:  It is easy to grind coffee beans, but consider trying to put those coffee grains back together again into a bean after the bean has been through the grinder.  The grains would have to be reassembled to the original bean and placed back in the bag in the original order.  This would be impossible to do.

The data is sent through a mathematical hash function.  It could be an email message for example.  The data email is sent through a mathematical hash function.  The result of the hash function is going to be a fixed length hash known as a DIGEST or a FINGERPRINT.  Hashing can be used to scramble passwords, can be used with the CHAP protocol for authenticating two devices, and it can also be used to apply data integrity to a communications message by simply appending the hash to the original message and then.  Once the communications gets to the receiver, the same mathematical function is applied against that hash, and if just one zero or one is changed, the receive knows not to accept the message because the integrity of the data has been compromised.  In other words, the message was modified in transit.  Hashing is vulnerable to cracking techniques like Rainbow Crack and Cain & Abel.

There are several types of hashing algorithms:

• SHA                SECURE HASH ALGORITHM - SHA 1, SHA224, SHA256, SHA384, SHA512
• MD5                MESSAGE DIGEST ALGORITHM 5 - Uses a 128 bit hash algorithm                  
• LANMAN      THIS IS OBSOLETE - LANMAN IS PRE NT TECHNOLOGY  
• NTLM             NT LAN MANAGER - Microsoft Authentication Protocol

Encryption Algorithms Revisited

• DES/3DES
• RSA
• PGP
• ELLIPTIC CURVE
• AES/AES256
• ONE TIME PAD

Additional Protocols

• SSL/TLS
• S/MIME
• PPTP
• HTTPS & SHTTP
• L2TP
• IPSEC
• SSH

SSL/TLS

Transport layer security is the successor to secure sockets layer.

S/MIME

This is an open standard for public key encryption.  It is also used to sign digital email that has been encapsulated in the MIME protocol.  MIME stands for Multi-purpose internet mail extensions.  S/MIME is the secure version of that.  S/MIME provides all CIAN.  S/MIME is built into all modern email software, as well as all modern browsers.  There is built in interoperability.

Conclusion

This has not been an exhaustive review, but major elements have been discussed.  We have looked at hashing concepts and protocols, we have revisited encryption algorithms, and have looked at a few additional protocols.

Organizational Security (Part III)

More on Organizational Security (Part 3)

Jerry Grugin

This is the last blog on organizational security.  In this blog, I discuss environmental controls, social engineering, survey of security + acronyms.  I hope that this blog is informative and helps you with the examination.

Environmental Controls

Environmental controls are important to organizational security.  One element of environmental controls is HVAC.  Many computer systems require that the humidity and temperature be controlled for reliable service.  Any time you go into a data room or server room, typically you have environmental controls there.  The more equipment you have, the more heat that is generated.  Therefore, there is a great need for environmental controls.  Typically, we have what is called zone-based air conditioning environments which allow the system to be turned off when the building is not occupied.  The environmental controls need to be monitored to ensure that humidity levels do not get too low.  If humidity gets too low, there is the risk of electrostatic damage due to electrostatic discharge.

Along with environmental controls are issues of water or flood damage.  We need environmental systems to detect and control these issues.  We also need to protect against fire.  Therefore, there is a need for a fire suppression system.  All computer rooms, server rooms, and data centers should have fire suppression systems and moisture detectors.  Just the smoke particles from a small fire can cause computer damage by smoke particles getting into the rewrite heads of hard disks.  This has the potential to cause massive data loss.  The three components of a fire are heat, fuel, and oxygen.  So, if any component is removed, a fire is not possible.  Most fire suppression systems work on the concept which revolves around removing one of the components of fire, without which the fire is not possible.  Another concept to be aware of is shielding.  Shielding is the process of preventing electronic emissions from your computer system from being used to gather intelligence or reconnaissance.  Designed to prevent outside electronic emissions from disrupting your activities.  Many times, in a fixed facility, the room will be surrounded with a Faraday cage.  A Faraday cage provides electronic shielding.  Devices generating EMI should be as physically separated from cables as possible.  A motor that is generating EMI's can actually disrupt data signals.

Social Engineering

Social engineering is a form of a possible attack on a computer system.  We need to be aware of this in order to mitigate social engineering tactics.  Training, awareness, and new-hire orientation should make a new employee aware of the dangers and prevalence of social engineering.  Social engineering involves concepts such as phishing, Hoaxes, shoulder surfing. 

Helpful Acronyms

3DES              Triple Digital Encryption Standard

ACL               Access Control List

AES                Advanced Encryption Standard

AES256          Advanced Encryption Standard 256 bit

AH                  Authentication Header

ALE                Annualized Loss Expectancy

ARO               Annualized Rate of Occurrence

ARP                Address Resolution Protocol

AUP                Acceptable Use Policy

BIOS               Basic Input / Output System

BOTS             Network Robots

CA                  Certificate Authority

CAN               Controller Area Network

CCTV            Closed Circuit Television

CHAP             Challenge Handshake Authentication Protocol

CRL               Certification Revocation List

DAC               Discretionary Access Control

DDOS             Distributed Denial of Service

DES                Digital Encryption Standard

DHCP             Dynamic Host Configuration Protocol

DLL                Dynamic Link Library

DMZ               Demilitarized Zone

DNS                Domain Name Server

DOS                Denial of Service

These are just a few acronyms.  There are more which will be listed in a separate blog.

Organizational Security (Part II)

More on Organizational Security (Part II)

Jerry Grugin

In this blog, I will discuss the following topics:  Secure Disposal, Acceptable Use Policies (AUP), Mandatory Vacations, Personally Identifiable Information (PII), Due Care, Due Diligence, Due Process, SLA, and Security-Aware HR.

Secure Disposal

One of CompTia's domain objectives is SECURE DISPOSAL.  Secure disposal involves things such as the information storage and retention policy, disposition workflow, information destruction policy, and re-sale of systems.  We have to know what information is going to be stored and how long to store it.  These, sometimes, are dictated by such entities as the Department of Defense, or other smaller entities.  The information destruction policy should include shredding, zeroing out hard drives, and degaussing.  Degaussing means applying a strong magnetic field to initialize the media.  Degaussing is also known is disk wiping.  A low level format can also be done.

Acceptable Use Policy

Acceptable use policies deal with computers and information systems provided by the company or the organization.  The policy needs to lay out in very explicit terms what activities are allowed and what activities are forbidden on the equipment and the systems.  It could be something as simple as the computers provided by the company are for company business only.  AUPs can be broken down into web access policies, email usage policies, and private usage policies.  There are also policies on telephone system usage, how you use information, and how to deal with questions for any gray areas.

Security-Aware Human Resources Team

A security-aware human resources team should have solid security-based hiring policies, a training and awareness process for newly hired people, termination policies, background check procedures, and should be aware of privacy (HIPPA).  A security-aware human resources team should provide training on ethics policies.  Importantly, if a human resources team knows that an involuntary termination is coming, they will actually alert the IT department first before the employee is notified of the termination.  This is so IT can have the ability to back up certain information on file servers and be ready to have badges returned.  Also, physical access badges and tokens have to be given back by the terminated employee.

Personally Identifiable Information (PII)

There are many federal laws that have addressed the issue of making sure personal information does not get into the wrong hands.  There is the Online Privacy Protection Act of 2003 (OPPA), the Privacy Act, the Identity Theft Prevention Act, Consumer Privacy Protection Act, Anti Phishing Act, and HIPPA.  Personal information is any information that could directly identify a person either directly or indirectly.  Examples of PII are full name, national ID number, social security number, telephone number, address information, email information, vehicle registration number, driver's license number, credit card numbers, digital identities, and personal traits.  There are more, but these are just a few.

Mandatory Vacations

Mandatory vacations fall into the category of "rotation of duties."  This concept means you do not want to have any one individual responsible for a certain area or a certain system of your organization indefinitely.  You eventually want to rotate your employees.  This helps prevent fraud.  It also keeps you from having a single point of failure rest with one human being.  Thus, an employer should make their employees take two to three week vacations.  This forces a company to bring in another person.  In the weeks leading up to vacation, the person taking a vacation has to open up their journal and cross train some other person(s) to cover for them while they are gone.  In the process of cross training and exposing the work process, it cuts down on fraud.

Due Care / Due Diligence / Due Process

Due Care and Due Diligence are technically the same thing.  Due diligence is also referred to as standard of care.  Due Diligence came into use as a result of the 1933 Securities Act.  IT persons need to perform security due diligence.  Due process comes directly from the U.S. Constitution, the 5th and 14th Amendment.  A person has the right to be heard in an orderly proceeding in order to protect their own rights against allegations and prosecution.

Service Level Agreement (SLA)

A service level agreement is an agreement between service provider / vendor and you or your company.  It may be security or availability related.  It outlines contractual obligations and deliverables.  SLAs are also known as maintenance contracts.  SLAs also cover MTBF vs. MTTR.  MTBF is known as "Mean Time Between Failure."  MTTR is the "Mean Time to Repair."

Conclusion

In this blog covering additional information on organizational security, we have covered the following topics:  Secure Disposal, Acceptable Use Policies (AUP), Mandatory Vacations, Personally Identifiable Information (PII), Due Care, Due Diligence, Due Process, SLA, and Security-Aware HR.