Information Security Fundamentals

Why Study Information Security

• IT experts need IT security knowledge, similar to how building architects need to know about fire safety
• Developing IT systems without considering security leads to vulnerable systems
• IT experts without security skills can inadvertently contribute to security problems
• Learning about IT security is essential to being part of the solution

Course Objectives

• Comprehend security challenges in dynamic environments
• Recognize a range of vulnerabilities and threats
• Learn proactive security measures for security
• Improve security incident response and recovery skills

Course Outline

• Security Fundamentals
• Security and Risk Management
• Cryptography
• Key Management and PKI
• Authentication and identity management
• Access control

Assessment Mode

• Quizzes account for 15% of the grade
• Labs account for 15% of the grade
• The midterm exam accounts for 30% of the grade
• The final exam accounts for 40% of the grade
• More than 3 absences results in not being allowed to enter the exam
• Absence in a quiz means that the quiz cannot be retaken

Security Fundamentals Objectives

• Understanding Information Security
• Identifying Security Properties
• Recognizing Threats, Attacks, and Assets
• Implementing Security Mechanisms

What is Information Security

• Focuses on protecting from damage or harm
• Assets needing protection include data files, software, IT equipment, and infrastructure
• Covers both intentional and accidental events
• Threat agents include people or acts of nature

Information States

• Information Security protects information assets from harm
• Information at rest during storage in information storage containers like electronic, physical, human
• Information in transit in physical or electronic form
• Information in processing in physical or electronic form

The Need for Information Security

• Security problems can't be solved once and for all
• Rapid innovation introduces new technology and vulnerabilities
• More activities are moving online
• Crime follows financial opportunities online
• Information security is often an afterthought
• The conclusion is that information security is a continuing process

Types of Cyber Attacks

• According to Ponemon Institute study of 254 companies:
• Malware is the most prevalent, affecting 98% of companies
• Phishing and social engineering affected 70%
• Web-based attacks affected 63%
• Ransomware affected 13%

Security Trends and Analytics

• According to Arbor Networks:
• DDoS attacks are a major concern for service providers
• Infrastructure outages also a major concern for service providers, with a 14% jump
• Bandwidth saturation is also prominent

DDoS Attacks

• Volumetric Attacks:
  • Account for 75.7% of attacks
  • Aims to consume bandwidth, leading to congestion
• TCP State-Exhaustion Attacks
  • Account for 11.8% of attacks
  • Aims to consume the connection state tables of infrastructure components
• Application-Layer Attacks: Account for 12.4% of attacks
  • Typically target Layer 7
    • Are very effect at low rates

Motivations Behind DDoS Attacks

• The most common motivations:
  • Online gaming-related (50.5%)
  • Demonstrating DDoS attack abilities to potential customers (49.1%)
    • Criminal extortion attempts (44.4%)

Attack Target Mix

• The primary target is:
  • Customers at 75%
  • Service infrastructure at 15%
  • Network infrastructure 10%

Attack Frequency Per Month

• 33% of respondents experience 1-10 attacks per month
• 14% experience 11-20 attacks per month
• 13% experience 21-50 attacks per month
• Only 8% experience less than 1 attack per month

Attack Duration

• 23% of attacks last less than 1 hour
• 38% of attacks last 1-6 hours
• 13% of attacks last 1-3 days
• Only 4% of attacks lasts longer than 1 month

Application Layer Attack Vectors

• DNS (82%) and HTTP (80%) are the most common
• HTTPS accounts for 61%
• SMTP accounts for 21%

Security Services

• Computer security definition from NIST 1995: the protection afforded to an automated information system to preserve the integrity, availability, and confidentiality of information system resources

The CIA Triad

• Confidentiality:
  • Is concerned with secrecy, privacy, and anonymity
  • Main threat is information theft and unintentional disclosure
• Integrity:
  • Concerns data and system accuracy and completeness
  • Includes authentication and accountability
  • Main threat is data and system corruption, and loss of accountability
• Availability:
  • Is being accessible and usable upon demand by authorized entities
  • Main threat is Denial of Service (DoS)

Data Privacy

• Addresses the personal information of natural persons
• Involves preventing unauthorized collection and use of personal info
• Ensuring data accuracy and transparency
• GDPR becomes EU law on May 25, 2018

Authenticity (Security Service)

• User Authentication:
  • Verifying the claimed identity of a legitimate user accessing a system application
• Organization Authentication:
  • Verifying the claimed identity of a legal organization in an online interaction
• System Authentication:
  • Corroborating that a peer entity (system) is the claimed identity
• Data Origin Authentication:
  • Corroborating that the source of received data is as claimed

Non-Repudiation

• The goal is to make sending/receiving messages undeniable through unforgivable evidence
  • Origin non-repudiation to prevent that data was sent
  • Delivery non-repudiation to that data was received
• Digital signatures provide cryptographic evidence
• Data origin authentication/non-repudiation both supply proof to recipient/third parties

Accountability

• Goal is to trace actions to a specific user to hold accountable
  • Audit information must be kept and protected to trace actions
• Common threats:
  • The inability to identify the source of an incident
• The inability to identify the attacker responsible
• Useful controls:
  • Identifying and authenticating users
  • Logging all system events
    • Electronic/Digital signatures

Authorization

• Specifies access and usage permissions for entities, roles, or processes
• Policies are normally defined by humans, and issued by authority within the domain
• Management translates to Sys.Admin in IT systems

Identity and Access Management (IAM)

• IAM phases:
  • Configuration (Registration, Provisioning, Authorization)
  • Operation (Identification, Authentication, Access Control)
  • Termination (Revoke authorization, Deactivate credentials, De-registration)

Security Definitions

• Attack:
  • An abstract concept represented by varying pieces of information
    • Security attacks resulte from who exploits a vulnerability
• Threat:
  • Any circumstance or event with the potential to cause harm
  • Include necessary skills, an opportunity, and a motivation
• Vulnerability:
  • A feature or combination of features that allows an adversary to compromise security
  • A feature or bug enables attacker to bypass security measures
• Intrusion:
  • Is an activity that violates the system's security policy
• Alert:
  • Is a description of an attack conveyed through monitoring

Classifying Vulnerabilities

• Application-level:
  • Operating systems
  • Web applications
  • Database applications
• Protocol
• Human-related:
  • Equipment misconfiguration
  • Weak password protection

Security Services and Controls

• Security Services (Goals/Properties): Implementation is independent and supported by specific controls Example: Confidentiality, Integrity, Availability
• Security Controls (Mechanisms): Practical mechanisms and actions used to provide security services Example: Encryption, Firewalls and Awareness

Security Control Categories

• Physical Controls:
  • Facility Protection
  • Security Guards, Locks, Monitoring etc
• Technical Controls: Logical Access/Cryptographic/Security Devices, User Authentication, Intrusion Detection, Forensics etc
• Administrative Controls: Policy/Standard/Procedure/Practice, Personnel Screening,Dev/Incident.

Security Controls Functional Type

• Preventive: Prevent Exploiting Vulnerabilities Through Encyption
• Detective:
  • Warn of Attempts to Exploit Vulnerabilites Though Intrustion Systems
• Corrective: Correct Errors and Irregularities like Restoring Corrupted Systems Combination of Controls Ensures People and Technology Operate

Security Countermeasures

• Proactive: Security Awarness, Training, Firewall, Anti-VirusGuard etc
• Detective: System Monitoring, Anti Virus IPS etc.
• Reactive: Data RestoralUpgrades, Vulnerability Mitigation.
• Compensatory: BackUp Generator and Server Isolation