Three principles of network security management fo

  • Detail

Three principles of enterprise network security management

in enterprise network security management, the following three principles are applied to provide employees with access to information needed to complete their own work, avoid unauthorized people from changing the company's key documents, and balance access speed and security control

principle 1: the principle of minimum authority

the principle of minimum authority requires us to provide employees with only the information access authority required to complete their own work in the enterprise network security management, without providing other additional permissions

if the enterprise now has a file server system, for security reasons, the files of our financial department will be subject to some special permission control. The financial department will set up two folders, one of which is used to place some public documents, such as blank reimbursement vouchers, so that other employees can fill in the expense reimbursement vouchers. In addition, the carton compression machine, which is often used in the packaging industry, places some confidential documents in a file. The spring testing machine is made according to the skill requirements regulated by the skill conditions of the spring tension and compression testing machine, which can only be viewed by the senior management of the enterprise, such as the cash flow statement of the enterprise. At this time, when setting permissions, we should set the permissions for ordinary employees and senior managers according to the principle of minimum permissions. For ordinary employees, their functions will query the folders they can access. For folders they do not have access permissions, the server will deny their access

in addition to this access permission, the minimum permission principle is most commonly reflected in the control over reading and writing. For example, the above financial department has two folders A and B. as ordinary employees, folder a belongs to the confidential level, and of course it cannot be accessed. However, folder B, where the reimbursement voucher format is most placed, is accessible to ordinary employees. However, what is the access permission? In other words, what access rights do ordinary employees have to the files in this folder? Delete, modify, or read only? If the reimbursement voucher is only a format, a common reimbursement format within the company, other employees, except those in the financial design form format, have no permission to delete or modify my files in this folder, but only read-only permission. It can be seen that according to the principle of minimum permission, we should not only define whether a user has access to specific information, but also define the level of access permission, whether it is read-only, modified, or fully controlled

however, in actual management, many people will ignore this principle for the convenience of management

for example, in the file server management, there is no security level management for files, only the read-write permission is controlled. In other words, employees can access all the contents on the file server when the enterprise is feeding, including the enterprise's financial information, customer information, orders and other sensitive information. D. batch experiments: for samples with the same parameters, they can't modify the folders that do not belong to their own departments. Obviously, with this design, enterprise employees can easily obtain confidential documents such as customer information and price information. If employees disclose this information to the competitors of the enterprise, the enterprise will lose its competitive advantage

for another example, for employees in the same department, there is no subdivision of authority. Ordinary employees have the same authority as department managers. For example, in the financial management system, ordinary employees do not have the permission to approve or cancel document approval. However, some system administrators often give ordinary employees the same operation rights as the financial manager for the convenience of management. Ordinary employees can cancel approved documents by themselves. This obviously brings many hidden dangers to the security of the financial management system

therefore, in order to ensure the security of enterprise network applications, we must adhere to the principle of "minimum permission", and not adopt the principle of "maximum permission" because of the convenience of management, thus laying a time bomb for enterprise network security

principle 2: integrity principle

integrity principle means that in the enterprise network security management, we should ensure that unauthorized individuals cannot change or delete information, especially to avoid unauthorized people changing the company's key documents, such as the enterprise's financial information, customer contact methods, etc

the integrity principle is mainly reflected in two aspects in the application of enterprise network security

first, unauthorized persons do not need to change information records. For example, in the ERP system of an enterprise, although the financial department has the right to access customer information, it has no right to modify it. It needs to change some information, such as the billing address of the customer. Generally, it must notify the specific salesperson to make changes. This is mainly to ensure the modification of relevant information, which must be known by the founder of this information. Otherwise, if an employee modifies the information without the knowledge of the founder of the record, information asymmetry will occur. Therefore, generally in information management systems, such as ERP management systems, there is a permission control "do not allow others to modify or delete records" by default. This permission means that only the recorded person can modify relevant information, and other employees only have the right to access, but not the right to modify

second, if someone modifies, the modification history must be saved for subsequent query. In some cases, it is also rigid if other people are not allowed to modify the founder's information. For example, the purchase manager has the right to modify or void the purchase order placed by the purchaser. How to deal with this situation? In ERP system, it can be processed through purchase change order. That is to say, other people cannot directly modify the content of the original document. If they want to modify the price and quantity of the purchase order, either other people or the owner of the purchase order must use the purchase change order. This is mainly the process of keeping original records and changes for the modification of records. When problems are found later, they can be audited. If the original records are not saved during modification, there will be no records to check when problems occur. Therefore, the second requirement of the integrity principle is to keep the necessary change log during the change to facilitate our follow-up tracking

for a file server, the integrity requires that the file server can be restored on time. When a file is modified in the file server, it may be difficult for us to record the modified contents. The file server log records at most a certain time and what kind of operation a certain user has performed on a certain file under a certain folder. However, no specific operation will be recorded. Such as deleting a file or modifying the contents of a file. At this point, we need the file server to restore on time. When the user finds that a file has been illegally modified, it should be able to recover to the latest time. Of course, this recovery needs to be specific to specific folders or even specific files. If all the files in the file server are recovered, other users will die

in a word, the integrity principle requires us to ensure that unauthorized persons make illegal modifications to the information and that the historical records of information content modifications should be kept in the work of security management

principle 3: the principle of balance between speed and control

when we make various restrictions on information, it will inevitably affect the access speed of information. For example, when the purchase order needs to be changed, the employee cannot directly modify the original document, but needs to modify it through the purchase change order. This will have a certain impact on work efficiency. This requires us to find a balance between access speed and security control, or compromise between the two

in order to achieve this balance, we can do so

first, the file information is classified according to security. For some less important information, we can lower the level of security control to improve the work efficiency of users. For example, for some reports in the information management system, we can set relatively low permissions. For example, employees in the Department can view various report information. After all, this is only a query and will not modify the data

second, try to manage at the group level rather than at the user level. Let's imagine how much work would be done if 50 employee accounts were set up on the company's file server and file server access permissions were set for them one by one. Therefore, at this time, we should use the group level for permission control. People with the same permissions can be classified into a group. For example, ordinary employees of a department can belong to a group. In this way, users can belong to this group. We only need to maintain them at the group level, so as to achieve the purpose of rapid management and control. For example, when we manage the permissions of ERP and other information management systems, we can use group permission control and some exception control rules to achieve comprehensive security management of information, and its management efficiency will be relatively high

the third is to use temporary authority with caution. Sometimes, an employee may need some permission. If he needs permission to export basic customer information, what should we do? Generally, in order to prevent the disclosure of customer information, we do not allow users to export customer information in batches. However, sometimes, due to some needs such as customer information filing, how should we deal with the user's application for permission in this regard? Some people like to set temporary permissions for them. Personally, I don't agree with this. Because temporary permissions are difficult to manage, and once this interface is opened, they will frequently apply for these temporary permissions the next time they encounter similar problems. When I encounter this kind of situation, I usually ask them to find someone with such authority. If an ordinary salesperson does not have the permission to export customer information in batches, but the sales manager does, let the salesperson inform their sales manager and ask their sales manager to help them export. Moreover, if it is handled in this way, the sales manager also knows that there is such a thing. If we blindly give employees the back door and open the green channel, it will increase the risk of data leakage

Copyright © 2011 JIN SHI