Note1 (Intr1) Security Problems in Computing

1. Note1 (Intr1)Security Problems in Computing

2. Outline • Characteristics of computer intrusions • Terminology, Types • Security Goals • Confidentiality, Integrity, Availability, … • Vulnerabilities • Hardware, Software, Data, … • Methods of Defense • Encryption, h/w control, s/w control, … Overview of Computer Security

3. Status of security in computing • In terms of security, computing is very close to the wild west days. • Some computing professionals & managers do not even recognize the value of the resources they use or control. • In the event of a computing crime, some companies do not investigate or prosecute. Overview of Computer Security

4. Characteristics of Computer Intrusion • A computing system: a collection of hardware, software, data, and people that an organization uses to do computing tasks • Any piece of the computing system can become the target of a computing crime. • The weakest point is the most serious vulnerability. • The principle of easiest penetration Overview of Computer Security

5. Security Breaches- Terminology • Exposure • a form of possible loss or harm • Vulnerability • a weakness in the system • Attack • Threats • Human attacks, natural disasters, errors • Control – a protective measure • Assets – h/w, s/w, data Overview of Computer Security

6. Types of Security Breaches • Interruption • Example: DOS (Denial of Service) • Interception • Peeping eyes • Modification • Change of existing data • Fabrication • Addition of false or spurious data Overview of Computer Security

7. Security Goals • Confidentiality • The assets are accessible only by authorized parties. • Integrity • The assets are modified only by authorized parties, and only in authorized ways. • Availability • Assets are accessible to authorized parties. Overview of Computer Security

8. Computing System Vulnerabilities • Hardware vulnerabilities • Software vulnerabilities • Data vulnerabilities • Human vulnerabilities ? Overview of Computer Security

9. Software Vulnerabilities • Destroyed (deleted) software • Stolen (pirated) software • Altered (but still run) software • Logic bomb • Trojan horse • Virus • Trapdoor • Information leaks Overview of Computer Security

10. Data Security • The principle of adequate protection • Features • Confidentiality: preventing unauthorized access • Integrity: preventing unauthorized modification (e.g., salami attack) • Availability: preventing denial of authorized access Overview of Computer Security

11. Other Exposed Assets • Storage media • Networks • Access • Key people Overview of Computer Security

12. People Involved in Computer Crimes • Amateurs • Crackers • Career Criminals Overview of Computer Security

13. Methods of Defense • Encryption • Software controls • Hardware controls • Policies • Physical controls Overview of Computer Security

14. Encryption • At the heart of all security methods • Confidentiality of data • Some protocols rely on encryption to ensure availability of resources. • Encryption does not solve all computer security problems. Overview of Computer Security

15. Software controls • Internal program controls • OS controls • Development controls • Software controls are usually the 1st aspects of computer security that come to mind. Overview of Computer Security

16. Policies • Policy controls can be simple but effective • Example: frequent changes of passwords • Legal and ethical controls • Gradually evolving and maturing Overview of Computer Security

17. Principle of Effectiveness • Controls must be used to be effective. • Efficient • Time, memory space, human activity, … • Easy to use • appropriate Overview of Computer Security

18. Overlapping Controls • Several different controls may apply to one potential exposure. • H/w control • S/w control • Data control Overview of Computer Security

19. Summary • A very high-level overview • The principle of easiest penetration • Effective control • Overlapping control Overview of Computer Security