Computer Security Introduction

Computer Security Introduction

• Computer security protects a computer system's assets: hardware, software, and data.
• Chapter 1 objectives include defining computer security and basic terms, introducing the C-I-A Triad, access control terminology, basic threats, vulnerabilities, and attacks, and control mapping to threats.
• Assets include hardware (computers, devices, disk drives, memory, printers, network gear), software (operating system, utilities like antivirus, commercial applications, word processing, photo editing, individual applications), and data (documents, photos, music, videos, email, class projects).
• Hardware assets are easily replaceable; data assets are unique and irreplaceable.
• Basic terms include vulnerability (a weakness in the security system), threat (circumstances potentially causing loss or harm), attack (a human exploiting a vulnerability), and controls/countermeasures (actions, devices, procedures, techniques to reduce a vulnerability).
• Threats are blocked by controls on vulnerabilities. Knowledge of threats is key to control design.
• The C-I-A Triad includes confidentiality (ensuring access only by authorized parties), integrity (assets only changed by authorized parties), and availability (assets accessible to authorized parties).
• Access control defines who (subject) has what (object) access and how (mode).
• Types of threats include natural causes (fire, power failure), human causes (benign/malicious intent, human error, random/directed attacks, impersonation).
• Advanced Persistent Threats (APTs) are organized, directed, well-financed, patient, and silent.
• Types of attackers include hackers, individuals, terrorists, criminal-for-hire, loosely connected groups, and organized crime members.
• Types of harm include interception, interruption, modification, and fabrication.
• Interception is unauthorized access to an asset.
• Interruption is an asset becoming unavailable or lost.
• Modification is unauthorized tampering with an asset.
• Fabrication is creating counterfeit objects in a system.
• Method-Opportunity-Motive (MOM) describes attacker characteristics needed to conduct an attack.

Security Goals

• Prevention aims to stop attackers from violating security policies.
• Detection aims to identify attackers violating security policies.
• Recovery aims to stop attacks, evaluate damage, repair it, and ensure continued correct functioning.

Trust and Assumptions

• Trust underlies security policies, mechanisms, and procedures.
• Policies must unambiguously define system states and capture security requirements.
• Mechanisms must be assumed to enforce policies and work correctly.

Different Types of Controls

• Deterrence discourages attacks by increasing costs.
• Deflection redirects threats to less critical components.
• Response involves reacting after a detected attack to minimize damage, restore services, and analyze the attack.
• Prevention aims to stop attacks before they occur (e.g., firewalls, antivirus).

Controls Available

• Encryption renders data unreadable to unauthorized parties while maintaining integrity.
• Weak encryption can be detrimental.
• Software/program controls include security restrictions within programs, access limitations, operating system controls, and independent control programs.
• Hardware controls include encryption devices, locks, security verification devices, firewalls, and intrusion detection systems.
• Physical controls include locks, entry point guards, backups, and disaster preparedness planning.

Effectiveness of Controls

• Awareness of problems is necessary; people must understand why security is required.

Summary

• Vulnerabilities are weaknesses; threats exploit vulnerabilities, and controls help prevent such exploitation.
• Confidentiality, integrity, availability are core security principles.
• Attacker types depend on their capabilities and motivations.
• Controls vary, have different functions, and can exist at different levels/points within the system.