Data Protection Solutions and Prevention

How to prevent breach?

• Firewall (filtering, deep inspection, intrusion detection and prevention)
• Antivirus protection
• Data encryption
• Email protection and filtering
• A program of ongoing patching and updating of
• systems (vulnerability management plan, maintenance plan, change and release management plan, configuration control board)
• Continuing education of users and employees

Vendors:

• Varonis. Varonis Data Security Platform. Data protection. Analyzes users, their role(s) and establishes behavioral patterns. Detects unusual activity and automatically respond by disabling account and revoking access to resources. Provides quick report of what data a user has access to, so in the event of a breach that access can be removed (e.g. folders, mailboxes, SharePoint sites). Supported products and services:  Active Directory, Windows, SharePoint, Exchange, UNIX/Linux, Office 365, Dell EMC, NetApp, Nasuni, HPE, Box.
• StealthBITS. Data protection.
• Quest Software. Data protection.
• Druva. On-premise and in-cloud backup.
• Cohesity. On-premise and in-cloud backup.
• Rubrik. On-premise backup to cloud.
• N2WS (a Veeam company). Cloud Protection Manager (CPM).  Cloud backup.

Consider creating a "No Access" group and adding that as a "deny" permission or right everywhere. In the event the account is compromised, assign membership to this group.

As with any product to be deployed in the federal government, be aware of Trade Agreements Act (TAA) compliance (FAR 52.225-5). For a list of TAA Designated Countries, see:  https://gsa.federalschedules.com/resources/taa-designated-countries/.

A data protection solution needs to cover not only the data but systems which provide access to the data. Documentation:  Business Impact Analysis (BIA), Business Continuity Plan (BCP), Disaster Recovery Plan (DRP), Data Catalog.

What if you suffer a breach? Disaster Recovery Plan (DRP). 

Reactive:

- Logging. AWS CloudWatch, Splunk, Loggly

- Monitoring. Datadog

- Alerting

- Incident Management. PagerDuty.

Proactive

Site Reliability Engineering (SRE) (3 books, O'Reilly - Site Reliability Engineering, The Site Reliability Workbook, Seeking SRE)

Pyramid:

Base->Top

Monitoring and Observability

Incident Response

Post-incident Analysis

Testing & Release Procedures

Capacity Planning

Development

Product

sre.google.com/books

• Gremlin. Inject incidents for testing. Chaos engineering?

Considerations:

• General.
• Full versus incremental backups. Incremental is fast but could take a while in a restore (multiple incremental).
• 3-2-1 backup strategy. 3 copies of data, 2 different media types, 1 offsite. How does "offsite" change in the cloud? Another AZ, Region, VPC? Need replication to COOP site (or another cloud AZ, Region, VPC or cloud provider). Consider dumping this readonly into another account.
• How quickly can you recover (RTO)? How much data can you stand to lose (RPO)?
• What to recovery first? What is critical, what is dependent on what? BIA and BCP will help with this.
• Policy(ies). Do you need different policies for different reasons? For example:
• Production versus development, testing, QA? Maybe only production gets backed up. Implement this via tag on VM/instance (e.g. "Environment" = "Production"). 
• Roles. Who needs access to backup/recovery console? Keep roles separated (separation of duties).
• Make DR separate from backups/snapshots. Only need 1 copy of data for DR? Delete/purge old? Perform DR every "n" backups. Although your backups may be onsite or in the same Region as your production data (to avoid cross Region data transfer charges), keep your DR offsite or in another Region and account.
• Image backups. Backing up a snapshot of an instance (e.g. virtual machine) so that it can be "snapped back" to a prior state. Define:
• What's my recovery point objective (RPO)? This determines how often snapshots need to be made.
• How long does it take to make a snapshot? Does this operation impact VM/instance performance?
• How often are snapshots taken? How often does the state of the machine change? Should there be a combination of manual and automatic backups (e.g. nightly automatic, manual when there's a configuration change? Or trigger backup).
• How many snapshots should be retained?
• How to purge old snapshots?
• Data backups. Backup up user data (e.g. single file or volume). Do I need to restore an entire volume in order to recover a single file (e.g. spreadsheet). Does my backup allow me to do this? Can users do this themselves?
• Database backups.

Other

Data Access Vendors:

• Sonrai Security.

Scenarios (what could go wrong, how does it happen?). Need to assign a likelihood and impact to each of these so as to assign risk and prioritize preparation (protection, response, testing).

• Misconfiguration, hack. Human error allows attacker access or to exploit a vulnerability. Result is most likely administrator access, and then denial of service, exfiltration of data, malware insertion/ransomware.
• Hack. No human error, possibly hacker exploits a zero-day vulnerability, but same result as above.
• User accidentally deletes data
• Insider Threat.
• Service provider outage.

Case Studies:

• How Notre Dame maintains uptime on AWS. Involves N2WS Cloud Protection Manager (CPM). See slide at 13m which shows "AWS provides N2WS enhances" graphic.
• Code Spaces:  A Lesson in Cloud Backup.

Digital Electronics Signature Regulations & Laws in the World

courtesy Prakash [prakash2757@yahoo.com] from cisspstudy@cccure.org mailing list

Australia
November 25, 2000: Approved electronic signature bill law with action to take place from July 2001. Gatekeeper model set up and designed to guide development of PKI infrastructure. Australian Customs has developed a system called the Cargo Management Re-Engineering Project (CMR). CMR was designed to leverage PKI for improving Customs paperwork for import and export of goods.

Austria
Digital signature legislation provides full recognition of secure digital signatures with less (but some) support for insecure digital signature methods.

Bermuda
July 1999: Enacted Electronic Transactions Act of 1999, which provides legal recognition of electronic signatures.

Brazil
Superior Court of Justice will now publish its decisions online with a digital signature affixed to the decision to vouch for its authenticity.

Canada
The city of Toronto provides for the land (in other words, deed) registration documents that can be submitted and maintained electronically with digital signatures. More than 50 percent of the city’s land documents have been implemented through this system.

Finland
January 2000: Act on Electronic Service in the Administration. This act defines the scope and structure of the elements of a PKI for digital signatures. Specific exclusions of the act are listed; unlike in other countries, this law excludes the use of digital certificates for the application to administrative judicial procedures

France
March 13, 2000: Electronic signature law implemented.
July 16, 2002: A decree was issued that required cryptographic service providers to provide authorized (government-recognized) agents the ability to decrypt data on demand. Effectively, this required either an escrow ability for private keys in PKI or a cryptographic system that allowed for a “back-door.”

Hong Kong
Hong Kong’s government is offering free digital certificates for the first year of its Smart ID card program. The program was designed to build a system that can provide smart cards for all electronic activities requiring authentication for digital transactions.

Italy
The government has passed a regulation that provides for digital signatures in support of the relevant EU directive (93/99/EC). The regulation identifies two types of signatures: a light signature for person identification and access to general public administration services and a more secure signature for digital signatures of electronic documents.

Korea
The Ministry of Information and Communication requires Internet-based banking organizations to use government-issued banking digital certificates. Organizations already using nongovernment-issued certificates will be required to go to government-issued certificates by May 2003.

Malaysia
One of the earlier legislations on digital signatures, Malaysia passed its Digital Signature Act in 1997.

New Zealand
October 2002: Electronic Transactions Bill passed that provides electronic documents and digital signatures on par with physical contracts and signatures.

Singapore
June 1998: Singapore passed its digital signature act called the Electronic Transactions Act 1998 that provides for the legal recognition of digital signatures.

United States
https://www.csoonline.com/article/3391587/finra-rule-4512-u-s-sec-approves-electronic-signatures.html

Cybersecurity Security Service Provider (CSSP)

A Cybersecurity Security Service Provider (CSSP) is required per [] on DoD networks. A CSSP provides Protect, Detect, Respond, and Sustain services.
​What is a Tier1 versus 2 CSSP?
Who are the approved CSSPs for DoD and subordinate military Departments?
DoD:

• DISA. Tier 2.

Army:

• Army Research Lab (ARL). Tier [].​

Vulnerability Analyzers

Vulnerability assessment products and services"

• Assured Compliance Assessment Solution (ACAS).
• Evident.io.
• Nessus.
• Qmulos.
• Qualys. https://vimeo.com/162448482​. ​

​

Cloud Migration Strategies

The migration process consists of choosing a strategy ("6 R's") and executing a 5 phase plan. The 5 phases are:  Opportunity Evaluation, Portfolio Discovery and Planning, Application Design, Migration & Validation, and Operate.

Phase 1:  Opportunity Evaluation. What is the business case or compelling event that will drive your migration to the cloud? Examples:  data center lease expiration, policy (e.g. FDCCI, DCOI, ADDCP), access to services or features, reduction of expense (increased opex is more beneficial than initial and recurring capex), developer productivity (e.g. reduced wait time for infrastructure provisioning and access to services that don't need to be built), availability, content caching, backups, disaster recovery.

Phase 2:  Portfolio Discovery and Planning. What's in your environment, what are the interdependencies, what will you migrate first, and how will you migrate it? Inspect your configuration management database (CMDB), institutional knowledge, and/or deploy tools (e.g. AWS Discovery Service or RISC Networks). Understand licensing arrangements. For security and costing purposes, it's useful to know:

• What information type(s) are going to be received, processed, stored, transmitted, and/or displayed in the cloud? Refer to NIST SP 800-60 Volume II for guidance.
• What is the footprint for applications that will be re-hosted or re-platformed? This information can be used for cost estimation.
• Are performance metrics available? This information can be used to right-size the environment. Because the cloud has a pay-as-you-go model, there's no need to over provision resources. The architecture can be designed to support the minimal performance requirements and expanded as additional resources are required.
• Consider data gravity. What data belongs with what application? Where the data lives will drive where the application lives and/or how that application access the data. If a large data set is going to be used to perform sporadic analysis work in the cloud (by spinning up 100s of instances), then analyze whether it makes sense to store this data permanently in the cloud, or move it in/out over the wire or via Snowball. If you don't have the bandwidth and the volume is large, the copy/mail (Snowball) approach will be more efficient than a wire transfer.
• What volume of data needs to be transferred into our out of the cloud? This information is needed to design data transfer solutions (e.g. over the wire or out-of-band using Snowball) and also estimate costs for data egress.

Phase 3 and 4:  Designing, Migrating, and Validating Applications. Each application is designed, migrated, and validated using one of the 6 migration strategies. Common infrastructure and security solutions should be design and used, for example identify management (e.g. Active Directory), log collection, configuration management, backups. Low-complexity, low-interdependency applications should migrate first. Have the application owner monitor the migration and validate the results while monitoring costs.

Phase 5:  Modern Operating Model. As applications are migrated, iterate on your process(es) and foundation, decommission old systems, and continue to look for opportunities to achieve efficiencies and/or improvements in cost, labor, and security.

This article has a nice graphic showing 6 migration strategies (although 2 don't count):

• ​​Re-host (lift-and-shift​)
• ​Re-platform (lift-and-reshape)
• ​​​Re​-purchase (replace-drop & shop)​​
• Re-architect (​re-writing/decoupling applications)
• ​Retire/decommission
• ​Revisit/retain

References:

• AWS Cloud Enterprise Strategy Blog:  Considering a Mass Migration to the Cloud? November 1, 2016.
• AWS Cloud Enterprise Strategy Blog:  A Process for Mass Migrations to the Cloud. November 1, 2016.

​

Identity and Access Management (IdAM) (draft)

Identify and Access Management (IdAM or IAM) is the mechanism used to authenticate an entity and authorize them to access a resource.

Several well-known services exist for authentication, including Active Directory, lightweight directory access protocol (LDAP), Remote Authentication Dial-In User Service (RADIUS), Internet Authentication Service (IAS) (Microsoft's implementation of RADIUS), Terminal Access Controller Access-Control System Plus (TACACS+) (Cisco-developed authentication, access, and accounting solution for networking devices), and Network Information Service (NIS). With the proliferation of cloud-based services, cloud service providers are providing identity and access services that are highly-scalable, robust, and secure. Examples include Amazon Web Services (AWS) Identify and Access Management (IAM) and several choices for implementation of Active Directory:  AD Connector, Simple AD, Microsoft AD. Rackspace has a good article which compares the different directory service offerings. Some things to consider in implementing authentication services:

• Managing multiple services is an administrative burden and is not an efficient use of resources. Building a robust service (e.g. Active Directory) and configuring applications to use that service is easier to manage than setting up separate authentication realms. This approach is known as single sign on (SSO) - using one credential to access many services.
• There are several methods to authenticate an entity, such as username/password, smartcard, challenge questions, one-time token, biometric, etc. Use of multifactor authentication (MFA) is highly recommended, which requires something a user knows (e.g. password) and something the user has (e.g. smartcard) or is (e.g. fingerprint).
• Implement a lockout policy and recovery mechanism for lost or forgotten passwords. Examples of solutions for this are:  SysOp Tools Password Reset Pro. For hosted services (e.g. Office 365), use the administrative tools to configure a policy to do this.
• Implement a logging and audit policy to review authentication events. For example, use of privileged accounts, failed access, anomalies in access times and/or geographic location (e.g. a user attempting to login from the US and then 10 seconds later from the UK).

Access management concerns governing permissions and rights to resources once the identity of an entity is verified via the authentication service described above. This is implemented by file system permissions and role definitions and assignment.

Per Department of the Army Pamphlet (PAM) 25-2-7 Information Management:  Army Cybersecurity Army Information System Privileged Access:  DA Form 7789 (Privileged Access Agreement and Acknowledgment of Responsibilities) is required after 4 May 2019. Individuals requiring elevated access to system control, monitoring, administration, criminal investigation, and/or compliance functions must sign a Privileged Access Agreement (PAA). Individuals seeking privileged access must complete and sign a PAA. Categories and specialties within the cybersecurity workforce that require a PAA include:   1) those requiring modification access to the configuration control functions of the IS/network and administration (e.g. user account management), 2) those with access to change control parameters (e.g. routing tables, path priorities, addresses of routers, multiplexers, and other key IS/network equipment or software), 3) those with the ability and authority to control and change program files, and other users' access to data, 4) those with direct access to operating-system-level functions that could permit system controls to be bypassed or changed, 5) those with access and authority to install, configure, monitor, and/or troubleshoot the security monitoring functions of IS/networks, or in the performance of cyber/network defense operations.

PAM, Privileged Access Management (sometimes Privileged Account Management), refers to the oversight of privileged user access to critical data and systems. PAM solutions implement features such as:  access manager (point of entry which facilitates user requests and the administrators' ability to grant and revoke access), password manager (protect, store, and rotate passwords, eliminating the need for users to have direct access to sensitive resources), session manager (trace and monitor privileged activity, automatically or manually terminate and report suspicious activity).

Authentication

• Password policy
• Multi-factor Authentication (MFA)
• Single Sign On (SSO). Minimize the number of credentials needed, authentication realms to manage. Diligently audit in one place. SSO can support MFA for applications that don't.

Authorization

Authorization is the concept controlling what a user is allowed (or not allowed) to do once they

are authenticated. In IAM terms, authentication + authorization = access. 

Governance is the concept of periodically attesting to the appropriateness (or correctness) of user authorizations.

Identity analytics is an emerging discipline of IAM that evaluates the permissions, rights and

entitlements of individuals – and detects anomalies. Identity analytics is an effective way to uncover

errors in provisioning (we’ll call it over-provisioning) and to discover purposeful rights escalation

activities. It can prevent the activities of external bad actors and detect internal risks before they can

become a threat.

• Provisioning. Defining and assign the user to the correct role(s) that provide the necessary rights for them to do their job.
• Deprovisioning. Removing those rights.
• 
  

Identity Solution Providers.

• Auth0. Role-based access control. "Organizations" - allows clients to manage roles. Developer friendly. Note Auth0 was acquired by Okta.

PAM:

• CyberArk.
• Thycotic..
• BeyondTrust. Call 7/26/2021. Nick Shaw, Anthony White (DoD and DHA), Steven Schullo (Solutions Engineer). Endpoint Privilege Management (agent-based. Windows, Mac, Unix. licensed by asset. Number of users doesn't matter. Allows access to privileged functions - process gets elevated vice the user). BeyondInsight (command and control/management auditing), can also control through ePO as well as GPO, can be run on-premise or SaaS in Azure, AWS, GCP, working on FedRAMP ATO, look for BeyondTrust in CSP marketplace). Whitelist, blacklist, and Assistance Required (need code from Service Desk). Only responsible for compute cost., Credentials Required (provide credential as well as reason). Password Safe. Cloud Privilege Broker (coming this summer).
• Wallix

Identity Governance

• SailPoint
• One Identity

​Resources:

• DISA IASE IdAM Program Documentation

Additional References:

• ​​NIST SP 800-53 AC Control Family​​

Relevant Articles:

• End of Passwords:  DISA Tests Walkabout Identify System, Breaking Defense, May 16, 2019

Information Assurance/Cyber Security Resources

DoD

• Cyber Security & Information Systems Information Analysis Center (CSIAC)
• DISA IASE
• Risk Management Framework Knowledge Service (RMFKS)
• Center for Development of Security Excellence (CDSE). Training content in the following topic areas:  Counterintelligence, Cybersecurity, General Security, Industrial Security, Information Security, Insider Threat, Operations Security, Personnel Security, Physical Security, Special Access Programs.
• CDSE Security Awareness Hub​

Army

• AT&CTS
• Information Assurance One Stop Shop (OSS)

Navy

• DIACAP Knowledge Service

​Certification and Training

• (ISC)2​