Introduction to Computer Security

Introduction to Computer Security

• Computer security protects computer assets (items of value).
• Assets include hardware, software, data, processes, storage media, and people.
• The principle of easiest penetration means intruders will use readily available means.
• Computer systems (hardware, software, and data) need security protection.
• There are 3 classifications of protection: prevention, detection, and reaction.

Prevention

• Measures in place to avoid damage to assets.
• Example: Locks on doors and window bars in the physical world.

Detection

• Measures to identify when and how assets were damaged.
• Example: Burglar alarms, CCTV cameras.

Reaction

• Measures to recover assets or from damage to assets.
• Example: Calling the police or replacing a stolen item.

Example from Cyber Security - Credit Card Fraud

• Prevention: Use encryption when ordering and relying on merchant checks; do not use credit card numbers online.
• Detection: Unauthorized transactions on credit card statements.
• Reaction: Requesting a new card number, recovering cost of fraud from the issuer.

Security Goals - CIA Triad

• Confidentiality: Assets are available only to authorized users.
• Integrity: Assets can be only modified by authorized users/parties and in authorized ways.
• Availability: Assets are accessible only to authorized users when needed.

Confidentiality

• Ensures computer-related assets are accessed only by authorized parties.
• Access is limited to those authorized and given access to something.

Integrity

• Assets can be only modified by authorized users/parties.
• Integrity means different contexts. Some forms include accurate, unmodified, precise, consistent, and usable.

Availability

• Assets are accessible to authorized parties at appropriate times.
• Denial of service (DoS) is the opposite of availability.

Other Protection Requirements

• AAA system: Authentication, Authorization, and Accounting.

Vulnerabilities and Threats

• A vulnerability is a weakness in the system (design or implementation) that can cause loss or harm.
• A threat is a set of circumstances that has the potential to cause loss or harm.

Computer Network Vulnerabilities

• Different parts of a computer network are susceptible/have vulnerabilities:
  • Radiation
  • Communication lines
  • Tapping
  • Cross talk
  • Unauthorized access of files
  • Hardware and software failures
  • Maintenance
  • Systems programming features
  • Improper connections/cross coupling
  • Attachments of recorders

Security Threats

• Interruption: An asset is destroyed or becomes unusable impacting availability.
• Interception: An unauthorized party gains access to an asset impacting confidentiality.
• Modification: Unauthorized parties access and tamper with an asset impacting integrity.
• Fabrication: Unauthorized parties insert counterfeit objects/assets into the system impacting integrity.

Examples of Security Techniques

• Interruption: Destruction of hardware (e.g., hard disk), cutting communication lines, and disabling systems.
• Interception: Wiretapping or illicit copying of files.
• Modification: Data alterations or program changes.
• Fabrication: Addition of records or inserting spurious messages.

Security Terminology

• Asset: Value/resource to be protected.
• Threat: Potential cause of loss/harm.
• Threat Agent: Individual/entity carrying out the threat.
• Vulnerability: Weakness/flaw/fault that allows exploitation of an asset by a threat agent/ entity.
• Exploit: An action that takes advantage of a vulnerability causing loss or harm.
• Risk: Probability of a threat (being realized against a vulnerability).

Kinds of Threats

• Non-human threats: Natural disasters (e.g., fires, floods), electrical power problems, failure of components (communication cables, processor chips, disk drives), and radiation issues.
• Human Threats: Benign (e.g., accidental data deletion, mistyping, sending an incorrect email), and Malicious (e.g., malicious code, impersonations, random attacks, and directed attacks)

Computer Vulnerabilities

• Weak authentication
• Lack of access controls
• Program errors
• Insufficient resources
• Inadequate physical protection

Data Vulnerabilities

• Data confidentiality
• Data integrity
• Interception and modification of messages.

Other Exposed Assets

• Storage media require backups.
• Networks easily multiply security problems (exposed medium).
• Access to systems, data, or software can be compromised.
• Key personnel leaving or illness.

Methods of Defense

• Encryption: Confidentiality, Integrity, and a basis of protocols.
• Policies: frequent password changes, training, legal/ethical codes.
• Physical Controls: locks on doors, backups, physical site planning.
• Software/Hardware Controls: internal program controls, operating systems, development controls, hardware/smartcard implementations, encryption.

Types of Attackers

• Amateurs: normal people who exploit flaws, valuable access
• Crackers: typically students or young adults, unauthorized access to computer facilities.
• Career Criminals: understand computer crime targets (groups), spies, and brokers.
• Hackers: knowledgeable about OS systems.

Method-Opportunity-Motive

• Malicious attackers require these 3 factors to ensure success:

  • Method: "how" of the attack
  • Opportunity: "when" of the attack
  • Motive: "why" of the attack

• Denial of these factors can lead to unsuccessful attacks.

• Harm minimization through risk assessments for identifying likelihood and severity of events.

• Residual risk is the uncovered risk that remains after controls have been implemented.

How to Make the System Secure

• System access control: unauthorized user access prevention.
• Data access control: Monitoring who can access which data.
• System and security administration: Implementing procedures/training to administrators.
• System design: Utilizing basic hardware and software security practices.

Controls

• Controls/countermeasures are methods of countering threats.
• Harm occurs if a risk is realized.
• Protection involves neutralizing threats, closing vulnerabilities, or both.
• Several ways to deal with harm include prevention, deterrence, deflection, mitigation, detection, and recovery.

Types of Controls

• Physical controls: Tangible objects (locks, walls, fences, guards).
• Procedural/Administrative controls: Rules, policies, procedures, laws, regulations, agreements.
• Technical controls: Technology-based (passwords, access controls, firewalls, encryption, and network traffic flow regulators).

System Access Control: Username and Password

• First line of security defense.
• User name (Login ID): Identification
• Password: Authentication
• Successful login requires valid username and password.

System Access Control: Common Threats/Solutions

• Password guessing (brute force, intelligent search)
• Password spoofing
• Compromise of password file

Choosing Strong Passwords

• Use diverse characters (beyond a-z).
• Choose longer passwords.
• Avoid common words/names.
• Use various passwords for different accounts.
• Regularly change passwords.
• Do not write down passwords.
• Do not share passwords.

System Access Control - Defending Password Security

• Compulsion to generate a password.
• Changing default passwords.
• Establishing password length requirements.
• Defining password formats (e.g., mix of numbers and letters).
• Avoiding obvious passwords.
• Implementation of password checkers.
• Adopting password generation tools.
• Employing password aging (expiration dates).
• Limiting login attempts.
• Informing users about best practices.

Data Access Control

• Subjects may observe/alter objects.
• Access modes are observe and change.
• Access rights can be determined in models like the Bell-LaPadula Model.

Effectiveness Considerations

• Awareness of security to cooperate with security requirements to understand the value.
• Use of necessary controls that are easy to use and appropriate, and use combinations of overlapping controls.
• Periodic reviews for effectiveness.