security in computing introduction to security in computing
TRANSCRIPT
Security in ComputingSecurity in Computing
Introduction to Security in Computing
Introduction – Security in Introduction – Security in ComputingComputingSecurity in computing is about
protecting computer-related assets, i.e. valuable information
The focus is security for computing systems
How banks protect physical currency cf. people protecting information (Pfleeger, p.2)
Can we learn from our analysis of banks, i.e. how they have protected e.g. money, gold etc.
I.I. Terms and definitionsTerms and definitions
A. Secure, protected1. Immune to attack2. Covered by certain controls
B. Threat1. A potential to do harm or cause
loss
C. Vulnerability1. Weaknesses in defences that could
allow harm to occur
Figure 1-1 Threats, Controls, and Vulnerabilities.
The water is a THREAT to the man
The crack is a VULNERABILTIY that threatens the man’s security
The man placing his finger in the whole is controlling the threat.
1.1. Terms and definitionsTerms and definitions
D. Attack1. Threat + Vulnerability
E. Control, countermeasure
F. Risk, residual [remaining] risk
G. Penetration[making way through], weakest point
II.II. Attacks and attackersAttacks and attackersA. Attacks
1. Malicious; non-malicious; natural causes2. Accidental, intentional
B. Attackers1. MOM – Method + Opportunity + Motive
a) Method: tools, knowledge, capabilityb) Opportunity: time, physical access,
availabilityc) Motivation: reason for attack
2. Work factor: difficult in pulling off attack; measured in time, skill, resources
Figure 1-3 Relationship Between Confidentiality, Integrity, and Availability
(Pfleeger, p.11)
III.III. The Security Triad: C-I-The Security Triad: C-I-AA
Figure 1-5 Security of Data (Pfleeger, p.18)
III.III. The Security Triad: C-I-The Security Triad: C-I-AA
III.III. The Security Triad: C-I-The Security Triad: C-I-AA
A. Confidentiality: protection from unauthorised disclosure
1. Privacy; personal private information
2. Sensitive information, e.g. student grades, company inventions, juvenile arrest records
3. Protection of classified information
III.III. The Security Triad: C-I-The Security Triad: C-I-AA
B. Integrity: protection from inappropriate modification
1. Precision, accuracy
2. Possible ways to limit modification
a) Not modified ( for example, read-only)
b) Only in acceptable ways, e.g. ?
c) Only by acceptable people, e.g. ?
d) Only using appropriate processes, e.g.?
III.III. The Security Triad: C-I-The Security Triad: C-I-AA
3. Internally consistenta) The disk contents match what was
originally recorded
b) Update to once instance causes change to be propagated to all instances
4. Meaningful and usablea) Readable
b) Not protected against legitimate access (see also availability)
III.III. The Security Triad: C-I-The Security Triad: C-I-AA
C. Availability1. Usable (readable, accessible)2. Sufficient capacity (bandwidth,
sharable, or copied as needed)3. Is making progress (not hung in a loop
or never attended to)4. Completes in an acceptable amount of
time
D. These goals can conflict1. High confidentiality may limit availability2. Strong integrity controls may impose a
slowdown that affect availability
IV.IV. VulnerabilitiesVulnerabilities
A. Kinds of vulnerabilities1. Interruption (breaking a pathway of
use, deleting, destroying)2. Interception (taking or obtaining
without permission; either taking an object itself or making an unauthorised copy)
3. Modifications (changing without permission)
4. Fabrication (creating a new – illicit – version)
IV.IV. VulnerabilitiesVulnerabilitiesB. Targets of vulnerabilities
1. Hardware (including firmware)2. Software3. Data and Information4. Access, time, bandwidth, network
resources(cable, switches and routers, addressing and routing information, wireless services)
5. People6. Supplies
V.V. Computer attackersComputer attackers
A. Most computers attacks are committed by insiders as unintentional, non- malicious errors
1. Security awareness is the most effective and least expensive control
B. Amateurs1. Often insiders with privileges
(necessary to do their jobs)2. Outside probers or tinkerers
V.V. Computer attackersComputer attackers
C. Crackers1. Advanced form of probing or tinkering
– fine line between probing and hacking
2. Intention to undermine or circumvent security controls
3. Various motivations: challenge, ego, curiosity, adventure, experimentation
4. Non-malicious attacks or attacks with non-malicious intent are still attacks
V.V. Computer attackersComputer attackers
D. Criminals1. Motivation: payoff, revenge,
competition2. Rapidly growing attack segment3. Financial reward potential is attractive4. Some evidence that organised crime is
becoming involved in computer crime – it’s where the money is
5. Definition of “computer crime” not precise
VI.VI. Defence ObjectivesDefence Objectives
A. Prevent harm1. Block attack, close [plug]
vulnerability2. Although obviously most effective,
sometimes prevention is not possible
a) Insiders need elevated privileges to do work
b) Vulnerabilities may be unknown
c) Even a fortes can be breached with the right attack
VI.VI. Defence ObjectivesDefence ObjectivesB. Deter harm
1. Make the attacker work harder or longer2. Hope the attacker will choose another
easier target3. Example: protect bank tellers with
bulletproof glass: not impenetrable, but requires a long time and a lot of force
C. Deflect harm1. Push the attacker to another target2. Example: a “honeypot” [trap] - website to
attract and occupy the attacker
VI.VI. Defence ObjectivesDefence Objectives
D. Detect harm1. Determine that attack is under way
(realtime) or has occurred sometime in the past (non-realtime)
2. Goals:a) to be able to increase defences (to block
an attack in realtime)b) To determine the kind and extend of
attack (after the fact) and strengthen defences for the future (close vulnerability) or know what has been lost
VI.VI. Defence ObjectivesDefence ObjectivesE. Recover from harm
1. Resume normal operation2. Increase or strengthen so future
attacks do not succeed3. Deal with loss or exposure of date
F. Note: More cost effective to allow unlikely harm to occur and spend money or recovery than to spend much more money trying in vain to prevent the harm
VII.VII.ControlsControls
A. Physical1. Gates, guns, guards2. Access control devices, e.g., badge
readers, motion detectors3. Fire suppression, extinguishers
B. Administrative1. Security awareness training2. Security policies, procedures,
guidelines, practices
VII.VII.ControlsControls3. Rules of acceptable use, code of
ethics4. Hiring and termination practices5. Software development practices6. Human oversight, management,
review
C. Technical1. Firewall2. Intrusion detection system3. Virus scanner
VII.VII.ControlsControls4. Encryption
5. Identification and authentication technologies (e.g. smart cards, biometrics, password)
6. Logical access controls (program-based controls limiting access based on identity, proposed use, date, time etc); implemented by network infrastructure, operating systems, database management, application program, utility
VII.VII.ControlsControls7. Honeypot 8. Protocol9. Networking infrastructure,
“middleware” (object request broker, runtime environment), operating systems, database management systems, applications
Figure 1-2 System Security Threats.
Figure 1-4 Vulnerabilities of Computing Systems.
Figure 1-6 Multiple Controls.