computer security primer - eric vanderburg - jurinnov
DESCRIPTION
Computer Security Primer - Eric Vanderburg - JURINNOVTRANSCRIPT
![Page 1: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/1.jpg)
Computer Security PrimerEric VanderburgDirector, Information Systems and SecurityComputer Forensic and Investigation ServicesJURINNOV LTD
![Page 2: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/2.jpg)
2
Objectives
• Identify who is responsible for information security
•Describe security principles
•Use effective authentication methods
• Control access to computer systems
• Audit information security schemes
![Page 3: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/3.jpg)
3
Identifying Who Is Responsible for Information Security
•When an organization secures its information, it completes a few basic tasks: • It must analyze its assets and the threats these
assets face from threat agents • It identifies its vulnerabilities and how they
might be exploited• It regularly assesses and reviews the security
policy to ensure it is adequately protecting its information
![Page 4: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/4.jpg)
4
Identifying Who Is Responsible for Information Security (continued)
• Bottom-up approach: major tasks of securing information are accomplished from the lower levels of the organization upwards
• This approach has one key advantage: the bottom-level employees have the technical expertise to understand how to secure information
![Page 5: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/5.jpg)
5
Identifying Who Is Responsible for Information Security (continued)
• Top-down approach starts at the highest levels of the organization and works its way down
• A security plan initiated by top-level managers has the backing to make the plan work
![Page 6: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/6.jpg)
6
Identifying Who Is Responsible for Information Security (continued)
•Chief information security officer (CISO): helps develop the security plan and ensures it is carried out
•Human firewall: describes the security-enforcing role of each employee
![Page 7: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/7.jpg)
7
Understanding Security Principles
•Ways information can be attacked: • Crackers can launch distributed denial-of-
service (DDoS) attacks through the Internet• Spies can use social engineering• Employees can guess other user’s passwords• Hackers can create back doors
• Protecting against the wide range of attacks calls for a wide range of defense mechanisms
![Page 8: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/8.jpg)
8
Layering
• Layered security approach has the advantage of creating a barrier of multiple defenses that can be coordinated to thwart a variety of attacks
• Information security likewise must be created in layers
• All the security layers must be properly coordinated to be effective
![Page 9: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/9.jpg)
9
Limiting• Limiting access to information reduces the
threat against it
• Only those who must use data should have access to it
• Access must be limited for a subject (a person or a computer program running on a system) to interact with an object (a computer or a database stored on a server)
• The amount of access granted to someone should be limited to what that person needs to know or do
![Page 10: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/10.jpg)
10
Diversity
• Diversity is closely related to layering
• You should protect data with diverse layers of security, so if attackers penetrate one layer, they cannot use the same techniques to break through all other layers
• Using diverse layers of defense means that breaching one security layer does not compromise the whole system
![Page 11: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/11.jpg)
11
Diversity (continued)
• You can set a firewall to filter a specific type of traffic, such as all inbound traffic, and a second firewall on the same system to filter another traffic type, such as outbound traffic
•Using firewalls produced by different vendors creates even greater diversity
![Page 12: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/12.jpg)
12
Obscurity
•Obscuring what goes on inside a system or organization and avoiding clear patterns of behavior make attacks from the outside difficult
![Page 13: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/13.jpg)
13
Simplicity
•Complex security systems can be difficult to understand, troubleshoot, and feel secure about
•The challenge is to make the system simple from the inside but complex from the outside
![Page 14: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/14.jpg)
14
Using Effective Authentication Methods
• Information security rests on three key pillars: • Authentication• Access control• Auditing
![Page 15: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/15.jpg)
15
Using Effective Authentication Methods (continued)
• Authentication: • Process of providing identity• Can be classified into three main categories:
what you know, what you have, what you are• Most common method: providing a user with a
unique username and a secret password
![Page 16: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/16.jpg)
16
Username and Password (continued)
• ID management: • User’s single authenticated ID is shared across
multiple networks or online businesses• Attempts to address the problem of users
having individual usernames and passwords for each account (thus, resorting to simple passwords that are easy to remember)• Can be for users and for computers that share
data
![Page 17: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/17.jpg)
17
Tokens
• Token: security device that authenticates the user by having the appropriate permission embedded into the token itself
• Passwords are based on what you know, tokens are based on what you have
• Proximity card: plastic card with an embedded, thin metal strip that emits a low-frequency, short-wave radio signal
![Page 18: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/18.jpg)
18
Biometrics
• Uses a person’s unique characteristics to authenticate them
• Is an example of authentication based on what you are
• Human characteristics that can be used for identification include:• Fingerprint – Face
• Hand – Iris
• Retina – Voice
![Page 19: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/19.jpg)
19
Certificates
• The key system does not prove that the senders are actually who they claim to be
• Certificates let the receiver verify who sent the message
• Certificates link or bind a specific person to a key
• Digital certificates are issued by a certification authority (CA), an independent third-party organization
![Page 20: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/20.jpg)
20
Mutual Authentication
• Two-way authentication (mutual authentication) can be used to combat identity attacks, such as man-in-the-middle and replay attacks
• The server authenticates the user through a password, tokens, or other means
![Page 21: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/21.jpg)
21
Multifactor Authentication
• Multifactor authentication: implementing two or more types of authentication
• Being strongly proposed to verify authentication of cell phone users who use their phones to purchase goods and services
![Page 22: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/22.jpg)
22
Controlling Access to Computer Systems
• Restrictions to user access are stored in an access control list (ACL)
• An ACL is a table in the operating system that contains the access rights each subject (a user or device) has to a particular system object (a folder or file)
![Page 23: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/23.jpg)
23
Auditing Information Security Schemes
• Two ways to audit a security system• Logging records which user performed a
specific activity and when• System scanning to check permissions
assigned to a user or role; these results are compared to what is expected to detect any differences
![Page 24: Computer Security Primer - Eric Vanderburg - JURINNOV](https://reader033.vdocuments.us/reader033/viewer/2022061120/546c4563b4af9f6b2c8b4f8a/html5/thumbnails/24.jpg)
For assistance or additional information
• Phone: 216-664-1100
• Web: www.jurinnov.com
• Email: [email protected]
JurInnov Ltd.
The Idea Center
1375 Euclid Avenue, Suite 400
Cleveland, Ohio 44115
24