WORLD METEOROLOGICAL ORGANIZATION	ICT-ISS 2004/Doc. 3(1) Appendix B

COMMISSION FOR BASIC SYSTEMS

OPAG on Information Systems and Services
Expert Team on Enhanced Utilization of Data Communication Systems  

GUIDE ON INFORMATION TECHNOLOGY SECURITY

DRAFT

Revision 2004-09-14

Table of Contents

1	Executive Summary
1.1	Why are we concerned with security:
1.2	Security and the importance of meteorological data
1.3	Importance of the involvement of all centres in this matter
1.4	Basic security means overview
2	Definition of Information Technology Security (ITS)
2.1	Protecting your systems against potential failures that would affect your capability to deliver your services and/or potentially compromise your partners system
2.2	Malicious versus non-malicious
2.3	Security criteria to consider
3	Security threats
3.1	Reasons for threats
3.2	Common threats
3.3	Main attack methods
4	Impacts of threats and security events
4.1	System and service impacts
4.2	Administrative, legal and reputation impacts
5	Information Technology Security Process
5.1	Identify assets
5.2	Threat and risk assessment
5.3	Business continuity planning
5.4	Prevent
5.5	Detect
5.6	Respond and recover
5.7	Investigate and correct
6	Information Technology Security Best Practices
6.1	Architecture
6.2	Security policies
6.2.1	The requirement for a security policy
6.2.2	Developing a policy
It would be nearly impossible to develop a WMO wide security policy as different governments and agencies will have various and potentially incompatible policies around the world.  However, every member state should develop their own policy taking into account the factors described in this document.
6.3	Threat and Risk Assessments (TRA)
6.4	Policy control
6.5	Procedures
6.6	Public server configuration
7	Information Technology Security Useful Resources
8	Bibliography

1	Executive Summary

[to be completed – Matteo]

1.1	Why are we concerned with security:

•	high risks (high volume of viruses and worms, directed attacks, pirating, etc.).  It only takes minutes for an off-the-shelf system to be compromised when it is made available on the Internet today.
•	interconnection of centres means all centres are only as secure as the least secure centre
•	connection to and use of the Internet means open to many and often anonymous threats

1.2	Security and the importance of meteorological data

Explanation of importance of business and mission, mention impacts of chapter 4, data for health and safety of humans, data with commercial implications

1.3	Importance of the involvement of all centres in this matter

1.4	Basic security means overview

•	Network architecture (zoning and firewalling)
•	password protection to assets
•	encryption
•	monitoring of systems
•	communication of detected events
•	maintenance of systems (vulnerability prevention, systems updates, etc.)

Should we have an introduction chapter that says something like:
The purpose of this document is to provide the reader with a broad overview of the main ITS components and procedures.  It is not meant to be an extensive security course, as such information is widely available in the IT industry.  The document is aimed at high level managers, system managers and technicians that wish to have an introduction to ITS.  It should help to understand the basic concepts and principles of ITS, and help the reader to direct is further study in this ever widening field of computer science.
2	Definition of Information Technology Security (ITS)

The purpose of Information Technology Security is to help an organization to fulfil its mission by protecting its IT resources, and through that, its assets. Those assets must be properly identified so that adequate security requirements can be defined.

2.1	Protecting your systems against potential failures

that would affect your capability to deliver your services and/or potentially compromise your partners system

All Information Technology (IT) resources play a part, more or less important, which must be correctly understood, in permitting an organization to deliver services according to its mission. Any failure in those IT resources can then affect your capability to deliver those services.

Moreover, most organizations have dedicated links with partners.  By default, these partner links should be considered as unsecure as other public links such as the connection to the Internet.  They could be used to propagate security incidents between organizations.  These could, in the better case, damage your reputation, and, in the worst case, generate legal proceedings.

Thus ITS is concerned with establishing policies, architecture and procedures so that the operation of these IT resources mitigates the potential failures and their impacts, thus keeping a high level of service and minimal impact to other partners and clients.

2.2	Malicious versus non-malicious

IT Security must be concerned with both malicious and non-malicious activities.  Both can be the cause of trouble.  For example, malicious activities can be: fraud and theft, internal or external hackers, malicious codes like virus or spyware, espionage, etc.. Non-malicious activities could be: errors, omissions, loss of physical and infrastructure support.

2.3	Establishing a security criteria

A security criteria allows an organization to evaluate the risks which may affect a given asset. Three security criteria are considered in most cases:

•	Availability : when or how often an asset must be present or ready for use

•	Integrity : the authenticity, accuracy, and completeness of an asset

•	Confidentiality : the need to keep proprietary, sensitive, or personal information private and inaccessible to anyone who is not authorized to see it

Other security criteria can also be taken into account, such as accountability, auditability, anonymity, and reliability.

A word on how to do it?

2.4	Security techniques and procedures to consider

Once an organization has properly identified its IT Security requirements (is that the criteria?, the document doesn’t mention requirements before), prevention measures are set up to prevent or restrict an error, omission or unauthorized intrusion.

Monitoring and reporting should give the organization a proper visibility on its information system. They must be defined so that a security incident can be quickly detected and its origin properly identified.

Incident handling and disaster recovery procedures are essential to minimize the impact of an IT security linked incident within an organization, by reacting quickly and in a proper manner to the incident, and by being able to recover the essential elements impacted by the incident.

Once the incident is over, it must be analysed so that prevention measures can be reviewed, if necessary.

3	Security threats

3.1	Reasons for threats

The motivations can be deliberate or accidental.

i.	Obtain information or resources

An attack can be motivated by the will to obtain information, for strategic, ideological, financial or intelligence reasons, or resources like storage, supercomputing or a link to an organization’s partner.

ii.	Desire to cause harm

Another motivation can be to prevent an organization to fulfil its mission properly, by blocking or modifying services or information, for revenge, terrorism, blackmail or malicious reasons.

iii.	Playful or exploration

Another kind of motivation is curiosity, boredom, game or challenge. Many famous governmental institutions have been hit by such motivated attacks, degrading their reputation.

iv.	Accident

The last category is human or physical accident.  It can take many forms and touch any part of the information system (network, hardware and software), and can be prevented by an adequate disaster recovery procedure. (maybe that is more a fix that a prevention?)

3.2	Common threats 

3.2.1	Malicious codes: viruses, worms, Trojan horses

A virus is a destructive computer program that spreads from computer to computer using a range of methods, including infecting floppy disks and other programs. Viruses typically attach themselves to a program and modify it so that the virus code runs when the program is first started. The infected program typically runs normally, but the virus code then infects other programs whenever it can.

A worm is a special type of virus that does not attach itself to programs, but rather spreads via other methods such as e-mail.

A Trojan horse (or backdoor) is a program that performs the desired task, but also includes unexpected functions, like allowing remote connection to the infected computer or sending information.

All these codes have the potential to disrupt services, destroy information, use resources for its own good, or any other function that the originator of the code may wish to implement.  

3.2.2	Denial of service

A "denial-of-service" attack is characterized by an attempt to prevent legitimate users of a service from using that service. Those attacks can be deliberate or accidental, such as abusive use of storage, network and supercomputing resources.

3.2.3	Malicious hacking

Malicious hacking refers to breaking into IT resources without authorization.

3.2.4	Spying

Spying is the act of gathering proprietary data from the organization for the purpose of aiding another company or government.

It can concern personal information, confidential data and proprietary software.

3.2.5	Compromising and abuse of system resources

Compromising and abuse of system resources can be deliberate (hacker) or accidental (side-effect of a legitimate user action). It includes the ability to modify codes and data, and to use supercomputing, storage and network resources.  It can also lead to a denial of service, even if it is not the primary goal.

3.3	Main attack methods

An attack method is a way for a threat agent to launch an attack.

3.3.1	Hacking systems by finding security holes in systems

The computers that comprise IT systems contain complex operating systems and various software modules.  By their very nature, these systems offer many configuration options, features and potential deficiencies.  All these components, if not kept up-to-date regarding security holes, or if not properly configured, can be easily used by a threat agent (human, like malicious hackers, or non-human, like viruses) to compromise the system.

Specific tools exist, used by security staff as well as malicious hackers, to identify both security holes and configuration weaknesses on a system.

3.3.2	Denial of Service Attacks

These attacks can either be caused by exploiting security holes in systems, or simply by directing masses of traffic toward a particular system.  In both cases, the system is rendered almost unusable because of the overload, thus blocking access to servers, sites and even the internet.

Improper configuration or weak operating systems are also vulnerable to such kind of attacks.

3.3.3	Malicious Spam

Spam is usually unsolicited "junk" e-mail sent to large numbers of people to promote products or services.  Malicious spam can use software security holes as well as human actions to fulfil its role.

A good example is called “phishing”: the act of sending an e-mail to a user falsely claiming to be an established legitimate enterprise in an attempt to scam the user into surrendering private or sensitive information that will be used for identity theft.  Phishing is a form of social engineering.

3.3.4	Spying

Spying techniques can be used on a network (eavesdropping) or on a system (spyware).  It usually consists of installing software on a system to gather information on the system or networks.

The growth of wireless networks (802.11, Bluetooth) has made network spying much easier since a physical access to the network is not necessary any more.

Although spying can take many forms and have many purposes, a more common approach today is the use of “spyware”.  Spyware is usually installed on a computer as part of a legitimate internet access, and is then used, unbeknownst to the user, to gather information on internet browsing habits.  Although many spyware are harmless, there is no reason why this class of software can’t be used to collect passwords and credit card numbers.  The results are usually sent back via the internet to the interested parties.

One of the most dangerous forms of spying is a class of software called “keyloggers”.  Once installed on a computer, these systems can collect every keystroke, mouse movement and screen updates on a computer, thus allowing a hacker to obtain all privileged information before it is encrypted of after it is decoded.

4	Impacts of threats and security events

It is clear that multiple threats exist which have the capability to compromise or degrade both the assets of an organization’s Information Technology systems as well as it’s capability to deliver information to the public and partners organizations.

Although it can be difficult to predict exactly what the impacts can be, the following are key potential impacts, which can be used to prepare security plans and contingency plans.  Understanding the potential impacts is also important in justifying the funding for security measures, as the cost of repair, loss of business, loss of reputation and even loss of life often far exceeds the cost of defence.

It should also be noted that although some events may seem to be low impact at first, they can be of major importance to an organization at a later date, since many events are just part of a setup process for later events.  As well, because all organizations will be interconnected, these types of events can be setups for attacks in other organizations.  In this respect, it is important to note our responsibility to the community of interconnected machines.

4.1	System and service impacts

This section lists the impacts that disrupt or incapacitate actual systems or services.  These impacts affect the capability to deliver services at various degrees.

1.	System slow down: the events cause the systems to slow down for no apparent reason.  These performance problems can range from being a simple annoyance to being major trouble.  Usually the systems do not crash completely.  The behaviour can be intermittent, which makes troubleshooting and problem resolution even more difficult.  If not addressed, these events can last a long time, and eventually consume unnecessary system resources.  Public, clients and partners will experience degraded service which may lead to frustrations, loss of confidence and even loss of business.  These types of problems can be the most complex to fix as they are often not even noticed.  Intrusion detection systems and regular system verifications are a great help in this regard.
2.	System rendered unavailable:  the events cause the systems to stop functioning altogether.  Several types of events may cause this.  Usually, when the problem is removed, the systems will resume normal operation without other impacts.  The problems cause obvious loss of service (affecting the users) and waste of valuable time from the systems analysts and operations personnel that need to restart and clean infected components.
3.	System or component of system destroyed:  the events cause not only the systems and services not to be available for a period of time, but cause the destruction of resources.  Typically, this can be the destruction of data on hard disk drives.  Some viruses have been demonstrated to harm hardware by putting it in states that it was not designed to be used for.  These problems waste much time, but also require system components to be either replaced or reinitialized.  There is often an important cost associated with these repairs. 
4.	System apparently normal, but information stolen or compromised:  the events that lead to these impacts usually reside on the systems in a way not to be detected.  However, they may steal information which is copied back to remote systems or compromise information on the organization’s systems in various ways.  The most obvious example of compromising information is called web site defacement.  However, more subtle changes are possible, which are difficult to detect.  The impacts can be severe, as stolen information can be of sensitive or commercial nature.  Compromised information may have public safety implications or political, religious, sexual or racial contents.  The organization’s reputation and future may be at stakes as well as safety of life.
5.	System used to compromise others:  the events would compromise an organization’s systems in a way not to be detected, and may be left unused for a long time.  However, these components can be used to compromise other systems.  Although the impact on a given organization may seem negligible, harm to other organizations is possible.  Furthermore, hackers often use such techniques to hide themselves behind several layers of apparently unnecessary hops.  These layers render troubleshooting very difficult and provide much hiding space for the illicit components.  An organization could be falsely accused of being the source of trouble because of this technique.

4.2	Administrative, legal and reputation impacts

Besides the obvious system and service impacts, all security events can also cause administrative, legal and reputation impacts.  By being connected to the internet, all organizations have a certain behaviour responsibility and liability towards the others.  They must mitigate the problems of security and ensure they are not cause of problems to the others.  Failure to do so may even lead to legal action.  It is as well obvious that bad information and poor service will certainly have administrative impacts as well as loss of reputation impacts.  It is particularly important in the weather business, where state agencies have an important responsibility for the health and safety of its citizens.

5	Information Technology Security Process

5.1	Identify assets

The first step in an IT security process is to identify your organization’s assets. Formal methods recommend to start from the organization’s missions to specify which assets are necessary to fulfil those missions.

Security criteria which are important for the organization must then be defined, so that each assets security need can be expressed regarding those criteria.  The most common ones are availability, integrity and confidentiality.

5.2	Threat and risk assessment

Threats can then be analysed, regarding vulnerabilities and methods attacks.

Risk assessment is done by evaluating threats with their impact on critical assets.

5.3	Business continuity planning

Business continuity planning, often referred to as disaster recovery, is the process of developing advance arrangements and procedures that enable an organization to respond to an event in such a manner that critical business functions continue with planned levels of interruption or essential change.

5.4	Prevent

Once an organization has properly identified its IT Security requirements, prevention measures are set up to prevent or restrict an error, omission or unauthorized intrusion.

5.5	Detect

Monitoring and reporting should give the organization a proper visibility on its information system. They must be defined so that a security incident can be quickly detected and its origin properly identified.

5.6	Respond and recover

Incident handling and disaster recovery procedures are essential to minimize the impact of an IT security linked incident within an organization, by reacting quickly and in a proper manner to the incident, and by being able to recover the essential elements impacted by the incident.

5.7	Investigate and correct

Once the incident is over, it must be analysed so that prevention measures and incident handling and disaster recovery procedures can be reviewed, if necessary.

6	Information Technology Security Best Practices

6.1	Architecture

[to be completed – Ilona]
a.	Networking:
i.	zones concept, firewalls, gateways, defense in depth
ii.	redundancy and diversification
iii.	Address Remote access as a concern to network security.  Normally, remote access would be related to a different network security zone than the GTS.  So if the GTS is isolated from the remote access, there should not be an issue.  Recommend this separation. Address the fact however that some may need to use remote access in the same zone as GTS for maintenance and monitoring.  Then state the special rules that should apply.
iv.	address wireless LAN since it presents special problems
b.	Systems:
i.	Redundancy, diversification
ii.	Describe the difference between open access systems versus pre-authorized user access and the risks if both are allowed.  Only give as minimum privileges to clients as required to do the job.  In fact "anonymous" accounts should be discouraged on systems used for exchange of data between countries (via GTS or Internet) and reserved only for distribution to public domain.  And then, these public domain servers should be separate from others.
iii.	Establish read only rules between systems and read-write only where necessary.  Writes should be limited to safe areas and the receiving system should apply security checks to received information before introducing it (or forwarding it?) into mission critical domains.  E.g. virus checking
iv.	Establish limits on directory and file visibilities

Note: - add an asset identification section?
-	put TRA section before Sec. Pol. section?
-	Mention security process ISO17799 (http://www.iso17799-made-easy.com in Chapter 5?)

6.2	Security policies
 
6.2.1	The requirement for a security policy

In order to properly design and implement any security mechanism, it is essential to define a security policy.  The policy documents what is expected of users, what can be expected of the systems, and how all of this will be carried out between the many groups which all have a responsibility in security.  It is a guideline that explains what the organization admits as acceptable and unacceptable configurations.  In doing so, it sets a level, which is a key statement for the implementation of security.  The level is set by identifying the risks and determining what is required to mitigate them at an acceptable level for your organization.

Depending on the complexity of the organization, there may actually be several types of security policy documents.

At the highest level, one would find a program policy, describing the overall organization’s security approach.  It usually describes who is responsible for the different aspects of security (physical, electronic, people, etc.).  It may also provide direction for compliance with industry standards such as the International Standards Organization (ISO).

At other levels, there could be issue specific policies, such as password policies, electronic networks usage policies, web server policies, remote access policies, etc..

6.2.2	Developing a policy

It would be nearly impossible to develop a WMO wide security policy as different governments and agencies will have various and potentially incompatible policies around the world.  However, every member state should develop their own policy taking into account the factors described in this document.

In order to develop the security policies, a team should be formed with representatives of the Information Technology department, but also include human resources, physical facilities management, and senior management.

The general high level security policy of an organization can be designed using some of the industry standard examples that are readily available on the web.  Two of these are well recognized and available free of charge.  They can be found at 
•	SANS security policy project (http://www.sans.org/resources/policies/)
•	Cisco Network Security Policy White Paper  (http://www.cisco.com/warp/public/126/secpol.html)

For issue specific policies, an organization can construct policies based on existing implementation and maintenance procedures.  The policy should provide answers to the following questions:
•	Who does the procedure?
•	What is the procedure for?
•	Why is the procedure done?
•	When is the procedure done?
•	Where is the procedure done?

One will often find that these questions do not have clear answers in an existing organization, just because there is no stated policy.  This exercise can be quite enlightening.

The policies should be easy to read, precise and should remain realistic.  Good policies will also be consistent with each other and forward-looking, considering that there are always new risks and new technology.

Finally, policies should be approved and signed by a high authority in the organization.  Again, since security is the matter of several (if not all) components of an organization, only a high authority will ensure consistency in approach and in implementation.

6.3	Threat and Risk Assessments (TRA)

The Threat and Risk Assessment (TRA) is a process in which an evaluation is done of the potential security problems that might affect an organization.  It usually consists of an identification of threats and vulnerabilities to derive an evaluation of the relative risk.  The risk can also be described in terms of likelihood, impact and consequence.  This is particularly useful in estimating a cost figure for particular risks.  These cost figures help in the design of the proper level of security measures.  For example, a low risk / high consequence threat may justify an expensive security measure.

TRAs can be done with a very general scope to kick-start the process of determining a security policy and security procedures.  They can also be done on a regular basis with a much more refined scope, to ensure that the security measures in place are still adequate.  In both cases, the goal of the TRA is to identify the exposure or the potential for loss or harm and to serve as a basis for improvement of the security measures.

Depending on the organization, TRAs can be quite complex to accomplish.  As well, it is often a good idea to obtain an unbiased opinion from an outside party, as it should be noted that threats can be internal or external, and as well can be intentional or accidental. It is therefore usually recommended that TRAs be conducted by outside specialists.  Most large reputable IT consulting firms are well equipped to do this kind of work.

6.4	Policy control

Once the security policy and procedures have been implemented, it is necessary to perform some regular controls to ensure that the rules are adhered to and that new threats can be identified.  These controls usually consist of a combination of procedures, metrics and audits.  

The procedures and metrics are usually automatic mechanisms that suggest or force certain security behaviours. For example, automatic reminders to change passwords, counts of rejected user identification attempts, automatic monitoring of web browsing, volume of traffic, and so on.  These mechanisms can run continuously and provide information to security managers on a day to day basis about the status of the systems.

The audits are more in depth analysis of the security situation and are meant to improve areas that are not readily visible or measured by the other mechanisms.  The audits should be based on the security policies and proceed to verify that they are adhered to.

6.5	Procedures

[to be completed – Matteo]
v.	Prevention procedures
1.	Installation procedures for new systems and machines
2.	Change management procedures
3.	Vulnerability management procedures, security patches
4.	Account and Password management procedures (keep lists, have usage policies with user responsibilisation (signatures)
5.	Backup / restore procedures and regular testing
vi.	Detection procedures (24/7, intrusion dectection, abnormal system activity detection, loss of system of loss of data procedures, logging information)
vii.	Response/recovery procedures (24/7, damage control (isolation), communication, recovery, maintaining essential services for mission critical components)

6.6	Public server configuration

Public internet accessible servers (web, mail, ftp) are more and more used by organizations to publish and exchange information. They play an important part in its public image for a growing number of people. Its exposure to Internet raises the risk to a high level.

It is then very important to minimize those risks by securing such servers. Here are a few good practices:

•	Architecture: install the server in a De-Militarised Zone (DMZ), e.g., a semi-private network that is visible through the network's firewalls, but that is not part of the private networks of an organization.
•	Filtering:
o	protect the server from network access by a firewall filtering all network fluxes but the port used by the service used to access the server
o	if possible, the firewall should be able to analyse the protocol used (i.e. : http relay) and to filter specific instructions, so that cracking attempts can be filtered before reaching the server
o	the firewall should prevent IP Spoofing
o	the firewall should also be able to filter some network denial of service attempts (land attack, syn flooding, etc.)
•	Bandwidth : a bandwidth management tool should be used so to avoid excessive use of bandwidth by a single user (or group of users)
•	System/application : 
o	The server should process as few types of data as possible (e.g., do not combine multiple server applications on the same system)
o	The server should be stripped of all unnecessary services and applications
o	Host-based firewall should be used
o	Security-related operating system and application patches and updates should be tested and applied as soon as possible
•	Users & Administrators
o	The server should have as few users as needed
o	Remote administration should be restricted
o	The strongest authentication method should be used
o	System administrators should be highly skilled in the appropriate technologies
•	Controls
o	Intrusion detection and other logs should be monitored on a frequent basis
o	Vulnerability assessment tools should be run against the server on a frequent basis

7	Information Technology Security Useful Resources

To be completed with all references collected in previous chapters concerning the main essential links 
List of important security information sources such as:
c.	Sysadmin, Audit, Network, Security (SANS) Institute (http://www.sans.org)
d.	Computer Emergency Response Team (CERT) (http://www.cert.org/)
e.	Governments
f.	Center for Internet Security (http://www.cisecurity.org/)
g.	Internet Engineering Task Force (IETF) Security Working Groups (http://www.ietf.org/html.charters/wg-dir.html#Security%20Area	
h.	RFC 2196 Site Security Handbook (http://www.ietf.org/rfc.html)
i.	The Information Security Policies & Standards Group   (http://www.information-security-policies-and-standards.com/)
j.	NIST ITS references such as:
i.	Nist security handbook (probably same directory as (ii) below
ii.	http://www.csrc.nist.gov/publication/nistpubs/800-46/sp800-46.pdf
k.	National Security Agency (NSA) docs on securing systems (e.g. cisco, windows,etc.) at http://nsa2.www.conxion.com/
l.	Internet Security alliance guidance at http://www.isalliance.org
m.	ISO guidance on ITS such as ISO 17799 (probably need to buy)

8	Bibliography

To be completed by all writers with more detailed references