Computer Security Chapter 1

Chapter 1: Basic Security Concepts

• Computer security protects computer system assets.
• Assets include hardware, software, data, processes, storage media, and people.
• The "Principle of Easiest Penetration" suggests intruders will use readily available methods.
• Security protection has three classifications:
  • Prevention: measures to stop damage.
  • Detection: identifying when and how assets are harmed.
  • Reaction: measures to recover from damage.

Example from the Physical World

• Prevention: Locks, walls prevent access to property.
• Detection: Noticing something missing triggers an alarm (CCTV, burglar alarm).
• Reaction: Calling the police or replacing stolen items.

Example from the Cyber World: Credit Card Fraud

• Prevention: Encryption and merchant checks before processing credit card orders or not using credit card numbers online.
• Detection: Unauthorized transactions appearing on statements.
• Reaction: Requesting new cards, recovering costs from the fraudster.

Security Goals - CIA Triad

• Confidentiality: Assets accessible only to authorized parties.
• Integrity: Assets modified only by authorized parties.
• Availability: Authorized parties access needed assets without delay.
• Security is achieved through combining the CIA principles from an asset perspective, not a user perspective.

Confidentiality

• Computer assets are accessible only to authorized parties.
• Access includes viewing, printing, and knowing the existence of the asset.
• A subject is a person/process/program.
• An object is a data item.
• An access mode is the type of access (read, write, execute).
• A policy describes how access is controlled.

Integrity

• Assets can only be modified by authorized parties.
• Modification includes writing, changing status, deleting, creating.
• Integrity can mean various things in different contexts:
  • Accurate
  • Precise
  • Unmodified
  • Modified only in acceptable ways
  • Modified only by authorized people
  • Modified only by authorized processes
  • Consistent
  • Internally consistent
  • Meaningful and usable
• Specific aspects of integrity: authorized actions, separation, protection of resources, and error detection/correction.

Availability

• Assets are accessible to authorized parties at appropriate times.
• Denial of service (DoS), preventing access from authorized users, is an availability threat.
• Availability concerns both data and services.
• Factors affecting availability include capacity and service needs.

Other Protection Requirements (AAA)

• A three-process framework manages user access, enforces policies, and monitors network resource consumption.
• Authentication: Verifying user identity.
• Authorization: Determining user access permissions.
• Accounting: Tracking user activities and resource consumption.

Vulnerabilities and Threats

• A vulnerability is a weakness in a system's design or implementation.
• A threat is a circumstance that has the potential to cause harm or loss.

Computer Network Vulnerabilities

• Various hardware, software, and network vulnerabilities contribute to potential security threats. Examples include radiation, taps, cross-talk, communication lines, improper connections, and unauthorized access.

Security Threats (Interception, Interruption, Modification, Fabrication)

• Interruption: System unavailable or unusable.
• Interception: Unauthorized access to an asset.
• Modification: Tampering with an asset.
• Fabrication: Introducing counterfeit objects into a system.

Examples of Security Threats (Interruption, Interception, Modification, Fabrication)

• Interruption: Destroying hardware components such as a hard drive, cutting communication lines, and disabling file management systems.
• Interception: Wiretapping, illegally copying files.
• Modification: Altering data files, changing program behavior, modifying files.
• Fabrication: Adding records to files, inserting spurious messages into networks.