Computer Security: Concepts and Objectives

Computer Security Concepts

• Before the widespread use of data processing equipment, security of information was primarily ensured through physical and administrative methods.
• With computers, automated tools became necessary to protect files and stored information.
• The introduction of distributed systems and networks impacted security, requiring data transfer protection between terminal users and computers/computers.
• Computer security refers to tools protecting data and thwarting hackers.
• Internet security includes measures to deter, prevent, detect, and correct security violations involving information transmission.
• The NIST Computer Security Handbook defines computer security as protecting information systems to maintain integrity, availability, and confidentiality of resources.

Computer Security Objectives

• Confidentiality ensures that private information is not available or disclosed to unauthorized entities.
• Privacy allows individuals to control what information is collected, stored, and disclosed about them.
• Data integrity ensures that information and programs are changed only in a specified and authorized way.
• System integrity ensures a system performs unimpaired and is free from unauthorized manipulation.
• Availability ensures system works promptly and is not denied to authorized users.

Additional Security Concepts

• Authenticity confirms users are who they claim to be, and that each system input comes from a trusted source.
• Accountability ensures actions of an entity can be traced to it.

Breach of Security Levels of Impact

• High-level breaches have severe or catastrophic adverse effects on organizational operations, assets, or individuals.
• Moderate-level breaches have a serious adverse effect on organizational operations, assets, or individuals.
• Low-level breaches have a limited adverse effect on organizational operations, assets, or individuals.

Examples of Security Requirements

• Confidentiality example: Student grade information must be highly confidential.
• Integrity example: Patient information in a database must be accurate.
• Availability example: Critical services require higher availability levels.
• Online polls are an example of low-integrity requirements.
• Public websites are an example of moderate availability requirements.
• Online telephone apps are an example of low availability requirements.

Computer Security Challenges

• Security is not simple and requires considering potential attacks.
• Procedures for providing security are often counter-intuitive.
• Deciding where to use various security mechanisms is necessary.
• Requires constant monitoring.
• Often treated as an afterthought.
• Security mechanisms involve more than algorithms or protocols.
• Security is a battle of wits between perpetrators and designers.
• Security investment benefits are not always perceived until failure.
• Strong security is often seen as hindering efficiency and user-friendliness.

OSI Security Architecture

• Security attack: Any action compromising an organization’s information security.
• Security mechanism: Process/device to detect, prevent, or recover from a security attack.
• Security service: Enhances data processing/information transfer security, counters attacks, and uses security mechanisms.

Threats and Attacks (RFC 4949)

• Threat: A potential security violation due to circumstances, capability, actions, or events.
• Attack: An intelligent assault on system security, attempting to evade security services and violate policy.

Security Attacks

• Security attacks are classified as passive and active.
• Passive attack: Attempts to learn information from the system without affecting resources.
• Active attack: Attempts to alter system resources or operations.

Passive Attacks

• Passive attacks involve eavesdropping or monitoring transmissions.
• The goal is to obtain transmitted information.
• Two types: release of message contents and traffic analysis.

Active Attacks and Types

• Active attacks involve modifying data streams or creating false ones.
• Active attacks are hard to prevent due to vulnerabilities.
• Detection is the goal.
• Masquerade: When an entity pretends to be a different one.
• Replay: Passively captures and retransmits a data unit to produce an unauthorized effect.
• Modification of Messages: Alters, delays, or reorders messages to produce unauthorized effects.
• Denial of Service: Prevents or inhibits normal communications facilities.

Security Services

• Defined by X.800: A protocol layer service ensuring adequate security for systems or data transfers.
• Defined by RFC 4949: A processing/communication service providing specific protection to system resources.

X.800 Security Services

• Authentication
• Access control
• Data confidentiality
• Data integrity
• Nonrepudiation

X.800 Service Categories

• Authentication assures communication authenticity.
  • Single message case: guarantees the message's origin.
  • Ongoing interaction: assures entity authenticity and protects against interference.
• Access control limits host system/application access via communication links.
• Data confidentiality protects transmitted data from passive attacks.
  • This is achieved by limiting access to users as well as protection traffic flow through messages.
• Data integrity applies to message streams, individual messages, or selected fields.
  • Ensures no duplications or modifications to the message.
• Nonrepudiation: Prevents senders or receivers from denying transmitted messages.
  • Ensures messages are authentic.
• Availability Service ensures system and resources availability upon request.

Specific Security Mechanisms

• Implemented in protocol layers to provide OSI security services.

Pervasive Security Mechanisms

• Mechanisms are not exclusive to any OSI security or protocol layer.

NIST Standards

• NIST, US federal agency, deals with measurement science, standards, and tech related to US government and private sectors..
• NIST Federal Information Processing Standards (FIPS) impacts worldwide.

ISOC Standards

• Internet Society, pro membership society.
• Provides leadership on Internet issues.
• Oversees groups responsible for Internet infrastructure standards.
• Internet standards published as Requests for Comments (RFCs).