Several tools are available for use by security professionals and attackers alike. If you’re planning on taking the Security+ exam, you should have a basic understanding of security tools. For example, can you answer this question?
Q. Security administrators have recently implemented several security controls to enhance the network’s security posture. Management wants to ensure that these controls continue to function as intended. Which of the following tools is the BEST choice to meet this goal?
A. Routine audit
B. Change management
C. Design review
D. Black box test
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Performing Routine Audits
Many organizations perform routine audits to help identify risks. An audit provides an independent and objective examination of processes and procedures. It can help an organization determine its security posture and verify that the organization is following its policies. Internal personnel or external auditors can conduct audits.
Routine audits can verify any system processes or organizational policy. For example, a security policy might state employees should notify a security manager as soon as possible after identifying an incident. The audit verifies personnel are following this policy. Another audit might verify that security controls such as a recently installed intrusion detection system (IDS) continues to function as intended.
Similarly, a security policy may state that when an employee leaves the company, an administrator must disable the employee’s account. This prevents the ex-employee or someone else from using the account. This type of account management policy can prevent attacks such as an example where the employee installed a logic bomb after learning he lost his job.
If the audit discovers that accounts are not disabled, the organization then takes steps to identify and correct the problem. Is a written policy in place? Do appropriate personnel know their responsibilities in relation to the policy? Are processes in place that allow personnel to meet their responsibilities?
In some situations, existing processes don’t support written policies, and the audit helps identify the problem. For example, imagine a single administrator is tasked with disabling accounts, but no one informs the administrator of employee terminations until days later. Obviously, there’s no way the administrator will disable the accounts immediately. To prevent this type of situation, many organizations coordinate exit interviews with security personnel who disable the account during the exit interview.
User Reviews
User access reviews and user rights and permissions reviews are both a type of audit. A basic security principle is the principle of least privilege, and these reviews help verify users have the rights and permissions they need, but no more. This includes ensuring users have the ability to access only the resources they need to perform their job.
A user access review includes a review of what users have accessed, and can detect accounts from ex-employees that are still enabled. A user rights and permissions review identifies the privileges (rights and permissions) granted to users, and compares these against what the users need. These reviews can detect two common problems: privilege creep and inactive accounts.
Privilege creep (or permission bloat) occurs when a user is granted more and more privileges due to changing job requirements, but unneeded privileges are never removed. For example, imagine Lisa is working in the Human Resources (HR) department, so she has access to HR data. Later, she transfers to the Sales department and administrators grant her access to sales data. However, no one removes her access to HR data even though she doesn’t need it to perform her job in the Sales department.
Organizations commonly use a role-based access control model with group-based privileges, For example, Lisa’s user account would be in required HR department security groups, granting her appropriate privileges for her job. When she transfers, administrators would add her to the Sales department groups, granting her appropriate privileges for her new job. An organization should also have account management controls in place to ensure that administrators remove her account from the HR department security groups.
Most organizations ensure that user rights and permission reviews are performed at least once a year, and some organizations perform them more often. The goal is to do them often enough to catch potential problems and prevent security incidents. However, unless they can be automated, they become an unnecessary burden if security administrators are required to do them too often, such as daily or even once a week.
Remember this
Routine audits help an organization ensure they are following their policies, such as the principle of least privilege and account management control best practices. A user rights and permissions review ensures that users have only the access they need and no more and can detect privilege creep issues. It also ensures that inactive accounts are either disabled or deleted.
Q. Security administrators have recently implemented several security controls to enhance the network’s security posture. Management wants to ensure that these controls continue to function as intended. Which of the following tools is the BEST choice to meet this goal?
A. Routine audit
B. Change management
C. Design review
D. Black box test
Answer is A. A routine audit can verify controls are continuing to operate as intended.
Change management controls can help ensure that systems don’t suffer from unintended outages after a change, and although change management helps ensure the controls aren’t modified, it doesn’t necessarily ensure the controls continue to operate as intended.
A design review would be done before the controls are deployed.
A black box test is a type of penetration test where the testers don’t have any knowledge of the system, so it wouldn’t be able to identify if the controls are functioning as intended.