april 2010 module 1. module 01: 1 introduction to computer security and information assurance...
TRANSCRIPT
April 2010
Module 1
Module 01: 2
Introduction to Computer Securityand Information Assurance
Initial Topics• An introduction to
information assurance
• The threat environment
• Risk management• Personnel and
physical security
Module 01: 3
Introduction to Computer Securityand Information Assurance
Objectives• Recognize the impact of cyber security in
daily activities
• Recognize the evolution of information assurance over time
• Recognize the fundamental concepts of information assurance
Module 01: 4
Introduction to Computer Securityand Information Assurance
What If…• A major city lost its network for:
– E-mail– Law enforcement records– Payroll– Personnel records– Etc.
for a week or more?
• The sewage system for a major city was compromised?– Spills of raw sewage into a river, parks, and
near businesses and homes– Environmental impact to wildlife– Stench for residents– Large cleanup bill
• Railroad service was stopped – Freight and passenger– For a day or more– In 23 states
• An electric power plant was compromised?
• A nuclear power plant was compromised?• Access to the municipal network and its services were lost
• The sewer system was compromised
• Rail traffic was halted
• The power was shut down
• There were problems with a nuclear power plant
Module 01: 5
Introduction to Computer Securityand Information Assurance
Who / What Is At Risk?• Organizations:
– Transportation – Telecommunications– Medical – Utilities– Government – And more
• Devices:– Computers – Phones – Game systems– Cable TV – MP3 players – And more
Anyone connected to anyone else.
Module 01: 6
Introduction to Computer Securityand Information Assurance
A Brief History Of Information Assurance
• Not a new idea– Greeks circa 480 B.C.E.– Romans (Caesar 100-44 B.C.E.)
• Protect information / keep secret– Locks– Fences– Guards– Safes– Couriers
Photo by Adam Polselli
Module 01: 7
Introduction to Computer Securityand Information Assurance
Computers• Early
– Physical security concerns– Separate computer and
communication security– Information transfer by
physical means
• Multiuser systems– Accounts– Access controls– Remote access (modems)
SAGE computer
IBM 360Photos by tomspixels’ http://flickr.com/photos/tomspixels/
Module 01: 8
Introduction to Computer Securityand Information Assurance
Fundamental Concepts Of Information Assurance
• Confidentiality
• Integrity
• Availability
Module 01: 9
Introduction to Computer Securityand Information Assurance
Growth Of Networks• ARPANET• Development of
– TCP/IP– Other communication protocols
• Evaluating and developing secure systems– Rainbow Series– Common Criteria
Image courtesy DARPA
Module 01: 10
Introduction to Computer Securityand Information Assurance
Before The Internet• Bulletin Board Systems (BBSs)
– America Online, CompuServe, etc.– Usenet
• Need to share information– Tim Berners-Lee developed language to
permit sharing of data, including non-text data (HyperText Markup Language (HTML), based on Generalized Markup Language (GML))
– Browser development followed for graphical display of information
Module 01: 11
Introduction to Computer Securityand Information Assurance
The Internet• World Wide Web – name given to the
program by Tim Berners-Lee– Growth in number of servers– Platform independent (Windows, X Windows,
Mac)– Scripting to allow interaction from pages– Databases providing services through Web
interface
• As services grow, so do vulnerabilities• More systems connected for convenience
Module 01: 12
Introduction to Computer Securityand Information Assurance
0
100
200
300
400
500
600
700
800
900
1000
1100
1200
1300
1400
1500
1600
Dec-9
5
Jun-
96
Dec-9
6
Jun-
97
Dec-9
7
Jun-
98
Dec-9
8
Jun-
99
Dec-9
9
Jun-
00
Dec-0
0
Jun-
01
Dec-0
1
Jun-
02
Dec-0
2
Jun-
03
Dec-0
3
Jun-
04
Dec-0
4
Jun-
05
Dec-0
5
Jun-
06
Dec-0
6
Jun-
07
Dec-0
7
Jun-
08
Dec-0
8
Mill
ion
s o
f u
se
rs
Data from Internet World Stats, March 2, 2009http://www.internetworldstats.com/emarketing.htm
Internet GrowthWhere Are We Today?• Over 1.5 billion users on the Internet (12/2008)• 5,000 – 8,000 PB (PetaByte = 1015 bytes) of
Internet traffic per month worldwide (12/2008)• Traffic growth rate 50-60% per year (12/2008)• Who?
– Transportation – Telecommunications– Medical – Utilities– Government – Who else?
Module 01: 13
Introduction to Computer Securityand Information Assurance
• Information access not controlled by physical means alone– Trespassing– Eavesdropping– Alteration– Theft
The CIA triad in a cyber world.
New Information Assurance Concerns
Module 01: 14
Introduction to Computer Securityand Information Assurance
Where This Stuff Came From…• Real world issues caused by computers and
networks– Computers are everywhere, supporting daily life– Computers are connected together
• Information assurance from Greeks to today• Concepts of
– Confidentiality– Integrity– Availability