Basic Computer Security Concepts

Okay, here are the updated study notes that include the new information from the provided text:

Basic Security Concepts

• Computer security protects computer system assets, including hardware, software, data, processes, storage media, and people.
• Intruders will try to use any available means of penetration, likely choosing the 'weakest point.'
• Computer security specialists should seek out and consider all possible means of penetration

Protecting Systems

• There are 3 classifications of protection: prevention, detection, and reaction
• Prevention involves measures that stop assets from being damaged.
• Detection means to notice when, how, and by whom assets were damaged.
• Reaction refers to measures that recover your assets or recover from damage.
• Locks, window bars, and walls are physical methods of prevention
• Burglary alarms and security cameras are physical methods of detection
• The police and item replacements are examples of physical reaction
• Encryption when ordering is a protection precaustion
• Transaction reports are a cyber world example of detection
• New credit card numbers are a cyber world example of reaction

CIA Triad

• Security is achieved through a combination of Confidentiality, Integrity, and Availability.
• These are from the view of the assets, not the user

Confidentiality

• Computer-related assets are accessed only by authorized parties
• Access includes reading, viewing, printing, and simply knowing that the asset exists
• Consider the statement: "A person, process, or program is (or is not) authorized to access a data item in a particular way."
• The person, process, or program is known as a 'subject'
• The data item is known as the 'object'
• The way the data is accessed is known as the 'access mode'
• The authorization itself is known as the 'policy'

Integrity

• Assets can be modified only by authorized parties, only in authorized ways
• Modification includes writing, changing status, deleting, and creating
• Integrity refers to an item being precise, accurate, and unmodified
• It means the item is consistent, modified only in acceptable ways, and meaningful and usable
• Welke & Mayfield recognize three particular aspects of integrity: authorized actions, separation and protection of resources, and error detection and correction.

Availability

• Assets are accessible to authorized parties at appropriate times
• Availability is sometimes known as its opposite – denial of service (DoS).
• Definition of availability depends on whether it is present in a usable form, has capacity enough to meet service needs, is making clear progress (with bounded waiting time), and completes service in an acceptable period of time.

AAA System

• The AAA system is from the user's pov
• It manages user access and measures consumption of network resources
• Authentication is verifying 'Who the user is? (genuine user)'
• Authorization is checking 'What can the user do (permission to access resources)?'
• Accounting is 'Tracking user activities and events'

Vulnerabilities and Threats

• Vulnerability is a weakness in the system that might be exploited to cause loss or harm
• A threat is a set of circumstances that has the potential to cause loss or harm
• Consider a wall holding back water as an illustration: a small crack in the wall is a vulnerability, and the water is the threat.

Security Threats

• The CIA triad can be viewed from the nature of the harm caused to assets.
• Harm is characterized by four acts called Security Threats: interception, interruption, modification, and fabrication.
• Interruption is when an asset is destroyed or becomes unavailable/unusable
• Interception is when an unauthorized party gains access to an asset
• Modification is where assets are tempered with
• Fabrication is when unauthorized parties insert counterfeit objects

Examples of security threats/attacks

• Interruption can include the destruction of hardware, and loss of commuication
• Interception examples include wiretapping
• Modification examples include data alteration
• Fabrication includes adding or inserting

Security Terminology

• Key terms include asset, threat, threat agent, vulnerability, exploit, and risk

Kinds of Threats

• Sources of threats include nonhuman events and humans.
• Nonhuman threats include natural disasters, electrical power loss, and component failure.
• Human threats include benign (non-malicious) and malicious actions.
• Malicious harm (an attack) can be random or directed
• Examples can be malicious code on a general website, impersonation etc

Vulnerabilities

• Computer vulnerabilities include weak authentication, lack of access control, errors in programs, finite/insufficient resources, and inadequate physical protection
• Hardware vulnerabilities include involuntary (accidental) and voluntary (intentional) machine-slaughter.
• Software vulnerabilities include deletion, modification (trojan horse, virus, trapdoor, logic bomb), and piracy

Data Vulnerabilities

• Networks can easily multiply the problems of computer security by being very exposed
• Storage media requires safe backups
• Access issues can lead to stolen computer time or loss of service
• Key People leaving the system can cause issues

Methods of Defense

• Methods of defense can include encryption, software and hardware controls
• Physical controls can include locks
• Policies help ensure everything is being used correctly

Types of Attackers

• Amateurs are not usually career criminals, although have access to valuable systems
• Crackers frequently attempt to access unauthorized facilities
• Career criminals seek to profit from computer crime
• Hackers usually have deep knowledge about operating systems, although may be non-malicious

Method-Opportunity-Motive

• A successful malicious attacker requires method, opportunity, and motive.
• The negative consequence of an actualized threat is harm.
• Risk management is performed to minimize potential harm
• The remaining risk is called residual risk

How to Make Systems Secure

• Four methods to enhance computer security: System Access Control, Data Access Control, System and Security Administration, and System Design.

Controls

• Controls, or countermeasures, help counter threats
• The possibility for harm to occur is risk.
• Harm can be avoided by blocking the attack or closing the vulnerability
• Physical, procedural, and technical are the three categories of controls

Control Types

• Physical controls use tangible things to stop or block attacks
• Procedural controls use commands or agreements to guide actions
• Technical controls use technology to counter threats,
• Technical controls include using passwords, firewalls, and encryption

System Access Control

• Provides computer security by controlling access to the system by confirming identification, and authentication
• There are 3 ways to prove the user (i.e., to confirm user's identity):
• Something the user knows (passwords, PINs, passphrases, mother maiden name)
• Something the user is (biometrics, such as face, fingerprints, voice pattern, retina pattern, handprint etc.)
• Something the user has. (tokens, keys, smart cards, etc.)
• Two or more forms can be combined; e.g., a bank card and a PIN.

Username and Password

• Typical first line of defense for a system
• User names provide identification
• Passwords provide authentication
• Logging in will succeed if a valid username and corresponding password have been successfully input

System Access Control

• Users play an important role in password protection – authentication is compromised when you give away your own password by telling others.
• Common threats on password:
• Password guessing: exhaustive search (brute force) and intelligent search
• Password spoofing
• Compromise of the password file

Choosing Strong Passwords

• Strong password equals strong authentication
• Use characters other than just a-z
• Choose long passwords
• Avoid actual names or words
• Use a string you can remember
• Use variants for multiple passwords
• Change the password regularly
• Don't write it down
• Don't share it with others

System Access Control

• Compulsory to set a password
• Change default password
• Password length
• Password format
• Avoid obvious passwords
• Password checkers
• Password generation
• Password ageing
• Limit login attempts
• Inform users

Data Access Control

• Subjects may observe or alter an object at its most elementary level
• Common access models are defined as follows: Observe is to look, change is to modify or alter
• See the Bell-LaPadula model for further implementation
• Access rights are given through an access control matrix

Effectiveness of Controls

• Security requirements are only accepted when people understand their presence
• Controls must be used to be effective and easy to use
• Overlapping control occur with combinations of control on one single exposure
• Conduct Periodic reviews by judging the effectiveness of any, and all controls