Basic Computer Security Concepts

### Basic Security Concepts
- Computer security protects assets of a computer or system, including hardware, software, data, processes, storage, media, and people.
- Intruders use any available means of penetration, including the 'weakest point', computer security specialists must consider all possible means of penetration.
- Computer systems that include hardware, software and data have value and deserve security protection.
- The three classifications of computer security are: prevention, detection, and reaction.
- Prevention involves taking measures to prevent assets from being damaged.
- Detection involves taking measures to detect when, how, and by whom an asset has been damaged.
- Reaction involves taking measures to recover assets or to recover from damage to assets.
- In terms of physical security, prevention is locks on doors or window bars, as well as walls around the property.
- In terms of physical security, detection is a burglar alarm going off after a break-in, in addition to CCTV cameras identifying intruders.
- In terms of physical security, reaction is calling police or replacing a stolen item.
- In the cyber world, prevention is using encryption or merchants performing checks before accepting credit card orders.
- In the cyber world, detection is unauthorized transactions appearing on credit card statements.
- In the cyber world, reaction is asking for a new credit card number, or possibly recovering fraudulent costs.

### CIA Triad
- Security goals are achieved through Confidentiality, Integrity, Availability (CIA).
- Confidentiality means assets of computing systems are available only to authorized parties and are sometimes known as secrecy or privacy.
- Integrity means assets can be modified only by authorized parties or in authorized ways.
- Availability means assets are accessible to authorized parties when needed without any delay.
- CIA is from the assets point of view; not the user's.
- Confidentiality also means giving access only to those who should have it.
- Access includes reading, viewing, printing, and knowing that the asset exists.
- Subject, object, access mode, and policy all help grant confidentiality.
- Integrity is about having assets be modified in authorized ways by authorized parties.
- Ensuring integrity includes precise information, accurate information, unmodified information, modified only in acceptable ways or by acceptable people or processes, and consistant information.
- Welke & Mayfield state that integrity includes: authorized actions, separation and protection of resources, and error detection and correction.
- Availability applies to both data and services, also called info and info processing.
- Definition of availability depends on whether the asset is in usable form, has the capacity to meet needs, has bounded waiting time if in wait mode, and is completed in an acceptable time period.
- Denial Of Service (DoS) can cause a lack of Availability.

### AAA
- AAA refers to Authentication, Authorization, and Accounting
- Authentication: Identifying who the user is.
- Authorization: Determining what the user can do with the system.
- Accounting: Tracking user activity.
- AAA is from the user's point of view.

### Vulnerabilities and Threats
- Vulnerability is a weakness in the system that might be exploited to cause harm. For instance, a system that does not verify user identities can be vulnerable to data manipulation.
- A threat to a computing system is a set of circumstances that has the potential to cause loss or harm.
- A threat blocked by control of a vulnerability.

### CIA from Different Perspective
- Interception harms confidentiality.
- Interruption harms availability.
- Modification harms integrity.
- Fabrication harms integrity.

### Examples of Security Threats & Attacks
- Interruption: destruction of piece of hardware, cutting of communication line, or disabiling of the file management system
- Interception: wiretapping or illicit copy of files
- Modification: changing values in data file, alters a program so it performs differently.
- Fabrication: addition of records to a file or the insertion of spurious messages in a network

### Security Terminology
- Asset: A car sterio
- Threat Agent: A theif
- Vulnerability: A hole in a fence
- Threat: Losss of the sterio
- Exploit: Going through the fence hole
- Risk: A stolen car radio

### Kinds of Threats
- Could be from nonhuman events, like natural disasters, loss of power, failure of hardware components
- Could be from humans, benign or malicious, such as unintentionally deleting text or maliciously trying to harm people.
- Malicious harm can be either random or directed attacks.
- In a random attack the attacker wants to harm any computer or user by malicious code posted on a website.
- In a directed attack, the attacker intends to harm specific computers by attacking specific organizations.

### Computer, Hardware & Software Vulnerabilities
- Computer: Includes weak authentication, lack of access control, errors in programs, finite or insufficient resources, and inadequate physical protection
- Hardware: Includes involuntary acts not intended to do damage, and voluntary machine-slaughter is intended to do harm
- Software: Includes deletion, modification via trojan horses, viruses, or logic bombs as well as theft and piracy

### Methods of Defense
- This includes encryption, hardware and software controls, policies, and physical controls.
- Encryption provides confidentiality and integrity via secure protocols.
- Software controls includes internal program controls, operating system controls, independent control programs, and development controls.
- Hardware controls includes smart cards, locks, user verification and firewalls.
- Physical controls include locks, S/W backups and reducer of natural disaster.

### Types of Attackers
- Amateurs: Not career criminals but observe flaws in a security system.
- Crackers: Students that attempt to access computing facilities for which they have not been authorized.
- Career criminals: Understands the targets of computer crime, international groups, electronic spies, information brokers.
- Hackers: Have deep knowledge but unlike the others, they don't attempt to intentionally break any system.

### Method, Opportunity, Motive
- For an attach to be successful, there nust be a method, opportunity, and motive.
- Method: How the attack happens.
- Opportunity: When the attack happens.
- Motive: Why the attack happens.
- For minimize and avoid real harm, perofrm risk management to assess likelhood of event occurence and magnitude of impact.
- There is a risk that always remains uncovered by controls which is called residual risk.

### How to Make the System Secure
- With System Access Control that doesn't let unauthorized people to gain access to a system.
- Data Access Controls monitors who can access what data and for what purposes.
- Enact System and Security Administration via regular procedures and training.
- Incoorperate System Design via taking advantage of basic hardware ands software security characteristics.

### Effective Controls
- Should consist of physical controls, procedural or admin controls, and technical controls.
- There should always be awareness of problems.
- Controls must always be easy to use and appropriate to Likelihood of use.
- There should utilize Overlapping controls in combinations.
- These controls and procedures can be maintained via Periodic review.

### System Access Control
- A system must provide Computer Security by controlling access
- Must dictate who is allow to log in and ensure the user is legitimate.
- The two parts of providing the above is Identification and Authentication.
- Identities are public and well known, or easily found, Authentication, though, should be private.
- User identity can be confirmed by having the user show something they know, something that belongs to them, or something that they literally are.

### Username and Password
- A system typically has a first line of defense
- This includes username and then a password.
- In addition, it must require a valid username and corresponding password.
- A user can easily compromise authentication by sharing their own password.
- Common password threats inlcude: Password guessing, brute forcing, password spoofing, and compromising the password file.

### Choosing Strong Passwords
- For strong authentication, utilize strong passwords that
- Use a character set of a-z plus punctuation, etc
- Use log passwords
- Avoid proper nouns or real words
- Create a string of characters that is easy to remember
- Use variants of known passwords
- Change passwords reguarly
- Keep them secrete and don't write them down.

### System Help To Password Security
- Must have compulsory to set a password
- Must utilize different default password
- Can specify different lengths and the types of characters
- Can also have automatic password checkers, and password generation

### Data Access Control
- On an elementary level, a subject may observe or alter the object.
- Common access modes include executing, appending, writing and reading.
- Model examples include the Bell-LaPadula model.

### Effectiveness of Controls
- Awareness of problems, likelihood of use, overlapping and periodic review contribute to effective controls