MI4007 Week 09 Lecture 1 PDF

MI4007 Wk.09 Lec.01 Computer Security: Techniques for ensuring that data stored in a computer can’t be read or compromised by any individual without authorisation. Measures like data encryption and passwords are used to ensure this. Confidentiality: Ensuring that computer related assets are...

MI4007 Wk.09 Lec.01 Computer Security: Techniques for ensuring that data stored in a computer can’t be read or compromised by any individual without authorisation. Measures like data encryption and passwords are used to ensure this. Confidentiality: Ensuring that computer related assets are accessed only by authorised parties. Integrity: An asset can only be modified by authorised parties in authorised ways only. Availability: Digital assets are accessible to authorised parties at appropriate times. Loss of availability is the disruption of access to information. Vulnerability: A weakness in the security system. Can be in any element of the computer. Threat: A set of circumstances that have the potential to cause harm/loss. They can be human or computer initiated. Leading threats include viruses, worms, trojan horses, social engineering, botnets, zombies and rootkits. Viruses: Software programmes that are deliberately designed to invade a computer, to interfere with its operation, and to copy, corrupt or delete your data. They are designed not only to infect and damage a computer, but also to spread to others. Worm: Sophisticated viruses that can replicate automatically and send themselves to other computers by first taking control of certain software programmes on your computer, such as e-mail. Logic Bomb: A set of instructions secretly incorporated into a programme so that if a particular condition is satisfied, they will be carried out, usually with harmful effects. Trojan Horse: Masquerades as a beneficial programme while quietly destroying data or damaging your system. Social Engineering: Manipulating people into performing actions or divulging confidential information. The use of deception to gain information, commit fraud, or access computer systems. Phishing: A trustworthy entity asks via e-mail for sensitive information. Pharming: Directing a user to a masquerading website, where information can be gathered and transactions mimicked. Botnet: Many compromised computers used to create and send spam or viruses or flood a network as a denial-of-service attack. Compromised computers are called zombies. Rootkit: A collection of programmes that a hacker uses to mask intrusion and obtain administrative access to a computer or computer network. It can enable easy access for the hacker and keystroke logging. It eliminates the evidence of the break-in and modifies the operating system. Attack: An exploitation of a vulnerability. Can be launched by humans or another system. E.g. denial of service (sending an overwhelming number of messages, preventing proper function). Reasons for Security: Information can be stolen Confidential information can be copied and sold without detection Employees and partners can access critical business information. The three main aspects of security are prevention, detection and reaction. Security: The way in which we protect access to our computers and information. E.g. firewall/anti-virus. Safety: The way we behave while using the internet. Signs of a compromise: Antivirus detects a problem Pop ups appear Disk space disappears Files or transactions appear that should not be there System slows Unusual messages, sounds or displays on the monitor Mouse moves by itself Computer shits down itself Spyware Symptoms: Changes to your homepage Ending up on a strange site when searching System firewall turns off automatically Excessive pop-ups and network activities New programmes, icons, favourites Frequent firewall alerts Slow performance Anti-virus software detects viruses/malware and can destroy it before any damage is done. Firewall: A wall between your private network and the internet. Prevents hacker connections from entering your computer. Security Tips: Create a good, private, secret, non-guessable password with uppercase and lowercase letters, symbols, numbers. Don’t open attachments that look untrustworthy. Don’t click on untrustworthy links. Only download from pages you trust. Create backups. References: Notes based on MI4007 Lecture Slides