Domain 5 (Part 3)

# Biometrics
Biometric controls are more reliable than other form of access control

Lifecycle - Enrolment -> transmission and storage -> verification -> identification and termination

Three main accuracy measures used for a biometric solution are:
- False-Acceptance Rate (FAR) (i.e access given to unauthorised person)
- False-Rejection Rate (FRR), (i.e. access rejected to authorised person)
- Cross-Error Rate (CER) or Equal-Error Rate (EER) (i.e. rate at which FAR is equal to FRR)

# Both FAR & FRR are inversely proportionate. As a general rule when FAR decreases, FRR increases and vice versa. Similarly if FRR decreases, FAR increases and vice versa.
# Most important performance indicator for biometric system is false-acceptance rate (FAR).
# Most important overall quantitative performance indicator for biometric system is CER or EER.

# ‘Retina Scan’, ‘Iris Scan’ has the highest reliability and lowest false-acceptance rate (FAR) among the current biometric methods.

# Biometric-Attacks
Replay - Residual Biometrics Characteristics
Brute-Force - Sending numerous request
Cryptographic - Attack on cryptography or encryption
Mimic - Faking the characteristics

# IDS & IPS
Three IDS -
(i) signature/ rule based  - Intrusion is identified on the basis of known type of attacks. Such known patterns are stored in form of signature. New attacks can't be identified.
(ii) statistical - Any activity which falls outside the scope of normal behaviour is flagged as intrusion.
(iii) neural network - Like statistical with added self-learning functionality.

# Neural network creates its own database. More effective in detecting fraud.
# Statistical based IDS generates most false positives (false alarms).

Four components of IDS - (i) sensor (ii) analyzer (iii) admin console and (iv) user interface

# Sensor collects the data and send to analyzer for data analysis.
# Most important concern of IDS implementation is that attacks not identified/detected by IDS.

# Challenges of IDS
- IDS will not able to detect application level vulnerabilities, Back doors into application, encrypted traffic.

# Challenges of IPS
- Threshold limitsthat are too high or too low will reduces the effectiveness of IPS
- IPS may itself become a threat when attacker sends commands to large number of host protected by IPS to make them dysfunctional.


# OSI Architecture
- Data link layer works on MAC address whereas Network layer works on IP address.
- Network layer inserts IP address and routing whereas transport layer ensure proper delivery.

# Transport layer - Reliable delivery or connection oriented or congestion control or order of sequence.
# Session layer - establishing connection.
# Presentation layer - acceptable format.
# Application layer - end user.


1st Layer [Physical Layer]         
-Physical layer is concerned with electrical and physical specifications for devices.
-Provides hardware for data (bit) transmission.

2nd Layer  [Data Link Layer]         
-bit stream (received from physical layer) is converted into data packets for network layer.
-data packets (received from network layer) is converted into bit stream for physical layer.
-uses MAC address.

3rd Layer  [Network Layer]           
-inserts address and provides routing service.
-uses IP address.
-Provides confidentiality, authentication, and data integrity services.

4th Layer  [Transport Layer]         
-ensures packet reaches its destination
-congestion control
-concerned with reliability of data transfer between two systems.
-ensure that data reaches its destination.
-make sure that packets on the receiving system are delivered in proper sequence
-uses connection-oriented protocols.
-implements a flow control mechanism that can detect congestion, reduce data transmission rates during congestion and increase transmission rates when the network appears to no longer be congested.
# Reliable delivery, Connection oriented, delivery in Proper order, Congestion control

5th Layer  [Session Layer]
- establishes, manages and terminates the connection between the application layers.
- Control connection
- Establish security for the user application

6th Layer  [Presentation Layer]     
-converts data into presentable form.
-provides services such as encryption, text compression and re-formatting
-formatting of data

7th Layer  [Application Layer]
-provides interface for the user.

# Wet (water based)[WBS] and Dry Sprinkling System (DPSS):
In WBS, water always remains in the system piping.
WBS is more effective and reliable.
Disadvantage of exposing the facility to water damage if pipe leaks or breaks. 

DPSS do not have water in the pipes until an electronic fire alarm activates the water pump to send water into the system.
Comparatively less effective and reliable.
Advantage of not exposing the facility to water damage even if pipe leaks or breaks

# Halon Gas System
- Halon gas removes oxygen from air thus starving the fire.
- They are not safe for human life.
- There should be audible alarm and brief delay before discharge to permit time for evacuation.
- Halon gas is banned as its adversely effects the ozone layer.
- Popular replacements are FM-200 & Argonite.

# FM-200 Gas
- FM-200 is colorless & odorless gas.
- FM-200 is safe to be used when people are present.
- FM-200 is environment friendly.
- It is commonly used as a gaseous fire suppression agent.

# What is Argonite Gas?
- Argonite is a mixture of 50% Argon & 50% Nitrogen.
- It is used as a gaseous fire suppression agent.
- Though environment friendly & non-toxic, people have suffocated by breathing argon by mistake.

# CO2
- CO2 Systems release pressurised CO2  gas in the area protected to replace the oxygen required for combustion.
- Unlike Halon, FM-200 & Agronite, CO2 is unable to sustain Human life.
- In most countries, it is illegal for such systems to be set to automatic release if any human may be in the area.
- CO2 installations are permitted where no humans are regularly present such as unmanned data centres.

# As per CRM, FM-200 & Argonite gases are safe for human life. However, it must be noted that Argonite, though environment friendly & non-toxic, people have suffocated by breathing argon by mistake.

# CO2 & Halon gases are not safe for human life.

# Single Signon (SSO)
Example - Kerberos - Authentication service used to validate services and users in distributed computing environment (DCE).
-In DCE, both usrs and servers authenticate themselves.
-In SSO, unauthorized access will have major impact.
-Unauthorised access can be best control by Kerberos.

Domain 5 (Part 2)

# Logical Access Control

Four main categories of access control are:

Mandatory access control (MACs) - Cannot be controlled or modified by normal users or data owners
Discretionary access control (DACs) - Activated or modified by the data owners at their discretion
Role-based access control
Rule-based access control

- MACs are better choice in terms of data security as compared to DACs.

Steps for implementing logical access controls:
- Inventory of IS resources.
- Classification of IS resources.
- Grouping/labelling of IS resources.
- Creation of an access control list.

# First step in data classification is to identify the owner of the data/application.
# Automated password management tool works as best preventive control and ensures compliance with password management policy.
# Preference to be given to preventive controls as compared to detective or deterrent controls.
# Preference to be given to automated controls as compared to manual controls.
# Prime objective of review of logical access control is to ensure access have been assigned as per organisation’s authorization.


# Logical steps for data classification:
- Inventory of Information Assets.
- Establish ownership.
- Classification of IS resources.
- Labelling of IS resources.
- Creation of access control list.

# Data owner/system owner is ultimately responsible for defining the access rules.
# Accountability for the maintenance of proper security controls over information assets resides with the data owner/system owner.
# Greatest benefit of well defined data classification policy is decreased cost of control.

# Objective of data protection/ classification of information assets:
- Ensure integrity/confidentiality of data
- Establish appropriate access control guidelines.
- Reduction in cost of protecting assets.

# Data classification must take into account following requirements:
-Legal/Regulatory/Contractual
-Confidentiality
-Integrity
-Availability

# Asymmetric Encryption
- For confidentiality, message has to be encrypted using receiver’s public key.
- For authentication, HASH of the message has to be created and HASH to be encrypted using sender’s private key. Hash is also known as message digest.
- For integrity, HASH of the message has to be created and HASH to be encrypted using sender’s private key.

# To ensure ‘confidentiality & authentication’:
-Hash of the message to be encrypted using sender’s private key (to ensure authentication/non-repudiation)
-Message to be encrypted using receiver’s public key (to ensure confidentiality)

# To ensure ‘confidentiality & authentication & integrity’:
-Message to be encrypted using receiver’s public key (to ensure confidentiality)
-Hash of the message to be encrypted using sender’s private key (to ensure authentication/non-repudiation and integrity)

# Sender's private key will not ensure confidentiality

A public key infrastructure (PKI) - A set of hardware,software,people,policies, and procedures needed to create, manage, distribute, use, store, and revoke digital certificates.

Use of PKI (Public Key Infrastructure) :
         Step 1: Encrypt the message by symmetric key
         Step 2: Encrypt the above symmetric key using public key of receiver.
         Step 3: Send 'encrypted message' and 'encrypted symmetric key' to receiver.
         Step 4: Receiver will decrypt 'symmetric key' using private key of receiver.
         Step 5: With the help of above 'symmetric Key' receiver can decrypt the message.

# Encryption of symmetric session key is considered as an efficient use of PKI

# Symmetric key Cryptographic system - Most common is Data Encryption Standard (DES)
DES - A key of 56 bits is used for encrypt/decrypt and 8 bit is used for parity checking
AES - DES being replaced with AES, a public algorithm that supports keys from 128 bits to 256 bits in size.

# Elements of PKI
Certifying authority (CA) is solely responsible for issuance of digital certificate and managing the certificate throughout its life cycle.
Registration authority (RA) is responsible for identifying and authenticating subscribers, but does not sign or issue certificates.
Digital certificate - Composed of public key and information about the owner of public key.

# Time gap between update of CRL (certificate revocation list) is critical and is also posses risk in certification verification.

# Process involved in PKI: 
- Applicant will apply for digital certificate from Certifying Authority (CA).
- Certifying Authority (CA) delegates the process for verification of information (as supplied by applicant) to Registration Authority (RA).
- Registration Authority (RA) validates the information and if information is correct, tells Certifying Authority (CA) to issue the certificate.
- Certifying Authority issues the certificate and manages the same through its life cycle.
- Certifying Authority (CA) maintains a list of certificates which have been revoked/terminated before its expiry date. This list is known as certificate revocation list (CRL).
- Certifying Authority (CA) will also have Certification Practice Statement (CPS) in which standard operating procedure (SOP) for issuance of certificate and other relevant details are documented.

Domain 5 (Part -1)

Digital Signature ensures:
- Integrity (i.e message has not been tampered)
- Authentication (i.e message has been actually sent by sender)
- Non-repudiation (i.e sender cannot later deny  about sending the message)

- Digital signature does not provide confidentiality of the message.
- Digital signature encrypts the hash of the message (and not the message). Hence digital signature does not provide confidentiality or privacy.
- For encryption of the hash of the message, private key of the sender is to be used.
- Non-repudiation provides the strongest evidence that a specific transaction/action has occurred.  No one can deny about the transaction/action.

# Best practises for Wireless (Wi-Fi) security:
- Enable MAC address filtering.
- Enable Encryption to protect data in transit.

- Disable SSID (service set identifier) broadcasting.
- Disable DHCP (Dynamic Host Configuration Protocol).

# ‘War Driving’
- Used by hacker for unauthorised access to wireless infrastructure. Wireless equipped computer is used to locate and gain access to wireless networks. Also used by auditors to test wireless.

# WPA-2 (Wi-Fi Protected Access) is the strongest encryption standard for the wireless connection.

# Confidentiality of the data transmitted in a wireless LAN is BEST protected, if the session is encrypted using dynamic keys (as compared to static keys)

Encryption Technique: The techniques will protect data in transit and not on device.
WEP - Wired Equivalent Privacy [Weak]
WPA - Wireless Protected Access [Medium]
WPA-2 - Wireless Protected Access [Strong]

SSID - Makes network visible to all. Technical term for a network name. When setting up a wireless home network, we give it a name to distinguish it from other networks in neighbourhood.

WAR walking
WAR chalking


# Types of Firewall

Application Level [7 -Application Layer] - Provides greatest security environment. works on concept of bastion hosting and proxy server. Separate proxy for each service. Control application like FTP, HTTP etc.
Circuit Level [5 - Session Layer] - works on concept of bastion hosting and proxy server. Same proxy for all services.
Stateful Inspection [3 - Network Layer] - Allows traffic from outside only if it is in response to traffic from internal hosts.
Packet Filtering [3 - Network Layer] - Allow or deny action is done as per IP address and PORT number of source and destination of packets.

# Types of Firewall Implementation

Screened Host:
- One Packet Filtering Router
- One Bastion Host

Dual Homed:
- One Packet Filtering Router.
- One Bastion host with two NIC (Network Interface Card).
- More restrictive form of screened host.

Screened Subnet [DMZ]:
- Two Packet Filtering Router
- One Bastion Host

# Screened Subnet Firewall (DMZ) provides greatest security environment.

# Bastion host
Both Application-Level Firewall as well as Circuit-Level Firewall works on concept of bastion hosting. On the Internet, a bastion host is the only host computer that a company allows to be addressed directly from the public network and that is designed to protect the rest of its network from exposure. Bastion host are heavily forfeited against attack.

Common characteristics of a bastion host are as follows:
-Its Operating system is hardened, in the sense that only essential services are installed on it.
-System should have all the unnecessary services disabled, unneeded ports closed, unused applications removed, unnecessary administrative tools removed i.e  vulnerabilities to be removed to the extent possible.
-It is configured to require additional authentication before a user is granted access to proxy services.
-It is configured to access only specific hosts.

# Proxy
A proxy is a middleman. Proxy stands between internal and external network. Proxy will not allow direct communication between two networks. Proxy technology can work at different layer of OSI model. A proxy based firewall that works at lower layer (session layer) is referred to as circuit-level proxy. A proxy based firewall that works at higher layer (application layer) is called as an application-level proxy.

- Most robust configuration in firewall rule is ‘deny all traffic and allow specific traffic’ (as against ‘allow all traffic and deny specific traffic’).

Domain 2 (Part 1)

Outsourcing contract:
First and most important priority should be given to written agreement.

Following clauses are must in any outsourcing contracts from IS auditor point of view:

-Ownership of intellectual property rights
-Data confidentiality and privacy.
-BCP & DRP.
-Right to audit.

Advantage of outsourcing:

-Expert service
-Cost Saving.

- No organisation can outsourced or transfer its accountability.  Even if any process has been outsourced, final accountability lies with the organization.

For Service Provider Ouside the Country:
- Legal Jurisdiction
- Privacy Laws

Role of IS department:
- Monitoring the outsourcing provider's performance
- Managing compliance with the contract for the outsourced services


IT BSC (Balanced Score Card):

Objective:
- To measure and evaluate the performance of IT
- To optimize the performance

What to measure:
- Customer Satisfaction
- Internal processes
- Ability to innovate

Key performance indicators need to be defined before implementing IT balanced scorecard.

Domain 1 (Part 2)

- Objective of control self assessment is to concentrate on areas of high risk and to enhance control monitoring by functional staff.
- Role of an IS auditor in a control self-assessment (CSA) should be that of facilitator.
- Most important success factor for CSA is involvement of line management.
- Purpose of CSA is to enhance the audit responsibilities (and not audit replacement).

Preventive Control - Segregation of duty, Access Control Policy
Detective Control - Audit, Hash Total, Echo Controls in Telecommunication, Activity Log review, Error messages over tape labels
Corrective - Contingency Planning, Back Up Procedure, Rerun procedures

- Audit Charter should not be dynamic in nature, should not include detailed yearly audit calendar, audit planning, yearly resource allocation, professional fees payable, travel expenses budget for auditors etc.

- Audit Charter should include audit funtions reporting structure.

COBIT - 5 
- 5 Principles
- 7 Enablers

7 Enablers of COBIT-5
- Principles, Policies, and Frameworks
- Processes
- Organizational structures
- Culture, ethics, and behaviour
- Information
- Services, Infrastructure and Applications
- People, Skills, and Competencies

Focus area of COBIT-5
- Benefit Realization
- Risk Optimization
- Resource Otimization

Attribute Sampling - We sample some number of items and classify each item as either having some attribute, like being complied, or not complied. Applied in Compliance testing. Expressed in percentage. Example: 55% transactions are complied.

Variable Sampling - Allows us to understand "how much" or "how bad" or "how good". Applied in substantive testing. Expressed in monetray values, weight or some other measures. Example - Deviation of $2 from standard mean.

When Threats and Vulnerability comes at same place, it constitute a RISK. Example: Open door (Vulnerability) and Thieves (Threat) together constitute risk of robbery.