Understanding Computer Security

Objectives of Computer Security

• Aims to examine risks, understand security goals, study threats, and identify controls.

Defining Computer Security

• Involves protecting valuable assets like houses, cars, offices, money in the bank, and confidential data such as emails.
• Definition: Protecting a company's assets by ensuring safe, uninterrupted system operation and safeguarding computers, programs, and data files
• Protects information and physical assets, ensuring confidentiality, integrity, and availability
• Achieved through policies, procedures, hardware, and software tools which secure processed, stored, and transmitted information

Cybersecurity vs Information Security

• Cybersecurity protects systems, networks, and digital data from cyber threats like hacking and malware

• Information security (InfoSec) focuses on protecting both digital and physical data from unauthorized access and ensuring confidentiality, integrity, and availability

• Cybersecurity focuses on digital threats, while information security encompasses all forms of data protection, including physical security

The Importance of Security

• The Internet is exposed to numerous threats, including viruses, worms, Trojan Horses, hacking, denial of service attacks, masquerading, spoofing, fraud, data theft and malicious damage.
• Security is needed in banking, education, government, healthcare, retail, and telecommunications.

Types of Security

• Physical: Environmental protection.
• Logical/System/Technical: Authentication and secure communications.
• Procedural/Personnel: Security Policy.

Principles and Concepts

• Involves security requirements, threats/attacks, and security controls.
• Key aspects includes confidentiality, integrity, availability, authentication, access control, and non-repudiation.

Confidentiality

• Protecting data from unauthorized disclosure to third parties
• Offers protection from passive attacks.
• Acts as secrecy or privacy
• Secures all user data, individual messages, or traffic flow by hiding source, destination, and traffic characteristics

Integrity

• Assures that data is not altered or destroyed without authorization
• Applies to message streams, single messages, or selected message fields
• Focuses on detecting rather than preventing active attacks.

Availability

• Continuous operation of computing systems so legitimate users can access data
• Applies to both data and services.
• Ensures assets are accessible at suitable times
• Aims to prevent denial of service.

Authentication

• Positively identifies individuals or systems requesting access to secured information or services
• Assures that communications are authentic.

Access Control

• Limits entry to host systems and applications through communication links
• Requires identification/authentication of entities so that access rights are specific to the individual.

Non-Repudiation

• Guarantees claimed source authenticity.
• Prevents senders or receivers from denying transmitted messages
• Allows message recipients to prove the message was sent by the alleged sender
• Allows senders to prove the message was received by the alleged receiver.

Security Attacks

• Threats can cause harm to computing systems.
• Vulnerabilities are system weaknesses that can be exploited to cause harm.
• Controls provide protective measures.
• A threat can be blocked by controlling a vulnerability.

MOM (Method, Opportunity, Motive)

• Method: Skills, knowledge, and tools needed for an attack.
• Opportunity: Time and access required for an attack.
• Motive: Reason for wanting to attack a system.

Security Threats

• Security threats are categorized into:
  • Interruption: An asset becomes unusable.
  • Interception: Unauthorized access to an asset.
  • Modification: Unauthorized tampering with an asset.
  • Fabrication: Inserting counterfeit objects into the system.

Vulnerabilities

• Hardware vulnerabilities include interruption (DoS), modification and interception (theft).
• Software vulnerabilities includes interruptions (deletion), interception, and modification (logic bomb)
• Data vulnerabilities include interceptions, modification, and fabrication.

Hardware Vulnerabilities

• Include adding, changing, or removing devices and intercepting traffic
• Actions, such as flooding devices, or physical damage are considered hardware vulnerabilities.

Software Vulnerabilities

• Malicious actions (replace, change, destroy)
• Accidental actions (modify, delete, misplace)
• Introduce logic bombs, trojans, viruses, or information leaks.
• Unauthorized copying of software (pirated).

Data Vulnerabilities

• Wiretapping, planting bugs, filtering through trash, electromagnetic radiation monitoring
• Involves stealing, buying, finding or hearing data
• Modifying data.

Security Control

• Achieved through legal/ethical restrictions, preserving confidentiality, integrity, and availability
• Achieved through physical controls, encryption, software/hardware controls, and policies/procedures.

Computer Criminals (People Involved)

• Amateurs exploits weaknesses for financial gain.
• Crackers/hackers attempts to access unauthorized computer facilities.
• Career criminals understands the targets of computer crime.

Methods of Defense

• Prevent by blocking attacks
• Deter by making attacks harder
• Deflect by making other targets more attractive
• Detect as it is happening
• Recover from its effects.

Controls

• Physical, Encryption, Software, Hardware, and Policies/Procedures

Effectiveness of Controls

• Enhanced by awareness, likelihood of use, using overlapping controls, and periodic review.