Threats - Confidentiality, Integrity, and Availability (PDF)

Threats: Confidentiality; authorized people or systems can access to protected data;  Ensuring confidentiality can be difficult, Examples: ─ who determines which people or systems are authorized to access the current system? ─ By "accessing" data, do we mean that an author...

Threats: Confidentiality; authorized people or systems can access to protected data;  Ensuring confidentiality can be difficult, Examples: ─ who determines which people or systems are authorized to access the current system? ─ By "accessing" data, do we mean that an authorized party can access:  a single bit? the whole collection? pieces of data out of context? ─ Can someone who is authorized disclose those data to other parties? ─ Who owns the data: If you visit a web page? Here are some properties that could mean a failure of data confidentiality: ─ An unauthorized person accesses a data item, ─ An unauthorized process or program accesses a data item, ─ A person authorized to access certain data, where is accesses other data not authorized, ─ An unauthorized person accesses an approximate data value, ─ An unauthorized person learns the existence of a piece of data.  Threats: Confidentiality; A person, process, or program is (or is not) authorized to access a data item in a particular way; we call the:  Subject: The entity that requests access to a resource;  Subject can be; people, computer processes (executing programs), network connections, devices, and similar active entities (Who).  Object: The resource that a subject attempts to access (What).  the kind of access (such as read, write, or execute) is an access mode (How), and  Policy: the authorization a policy;  Who + What + How. Threats: Integrity When we survey the way some people use the integrity term, we find several different meanings;  if we say that we have preserved the integrity of an item, we may mean that the item is: ― Precise, Accurate, Unmodified, ― modified only in acceptable ways, ― modified only by authorized people, ― modified only by authorized processes, ― Consistent, internally consistent, ― Meaningful, and usable.  Welke and Mayfield recognize three particular aspects of: ― Integrity authorized Actions, ― Separation and protection of resources, and ― Error detection and correction.  Integrity can be enforced in much the same way as can confidentiality: ― by rigorous control of who or what can access which resources in how ways. Threats: Availability (1) Availability applies both to data and to services (that is, to information and to information processing), and it is similarly complex;  different people expect availability to mean different things,  Example: an object or service is thought to be available if the following are true: ― It is present in a usable form, ― It has capacity enough to meet the service's needs, ― It is making clear progress;  if in a wait mode:  it has a bounded waiting time.  The service is completed in an acceptable period of time. We can construct an overall description of availability by combining these goals; Threats: Availability (2) Criteria to define availability; we say a data item, service, or system is available if:  There is a timely response to our request;  Resources are allocated fairly; − Some requesters are not favored over others.  The service or system involved follows a philosophy of fault tolerance, whereby; − HW or SW faults lead to graceful cessation )‫ (انقطاع‬of service or to work-around, rather than, to crashes and abrupt loss )‫ (خسارة مفاجئة‬of information.  The service or system can be used easily and in the way it was intended to be used; and  Concurrency is controlled; that is, − simultaneous access, − deadlock management, and − exclusive access are supported as required. Threats: Availability and Related Areas; As we can see;  expectations of availability are far-reaching,  Figure 1-7 depicts some of the properties with which availability overlaps. FIGURE 1-7: Availability and Related Aspects  Threats: Computer security seeks to prevent:  unauthorized viewing (confidentiality) or modification (integrity) of data,  while preserving access (availability). A paradigm of computer security is access control:  To implement a policy; ‒ computer security controls all accesses by all subjects to all protected objects in all modes of access.  A small, centralized control of access is fundamental to: − preserving confidentiality and integrity, − but it is not clear that a single access control point can enforce availability. ‒ Indeed, experts on dependability will note that:  single points of control can become single points of failure:  making it easy for an attacker to destroy availability by disabling the single control point. Threats: Computer Network Vulnerabilities; FIGURE 1-8: Computer [Network] Vulnerabilities (from [WAR70]) Threats Types of Threats One way to analyze harm is to consider the cause or source;  We call a potential cause of harm a threat,  Harm can be caused by either nonhuman events or humans, Examples: − nonhuman threats include;  natural disasters like fires or floods; loss of electrical power; failure of a component such as a communications cable, processor chip, or disk drive; or attack by a wild boar. − Human threats can be either benign (nonmalicious) or malicious;  Nonmalicious include someone’s accidentally spilling a soft drink on laptop, unintentionally deleting text or file, inadvertently sending an email message to the wrong person, and carelessly typing “12” instead of “21” or clicking “yes” instead of “no” to overwrite a file.  Malicious: impersonation, malicious codes, HW destruction, … etc.  Threats Types of Threats  Most computer security activity relates to malicious, human-caused harm:  A malicious person actually wants to cause harm, and;  so we often use the term attack for a malicious computer security event. FIGURE 1-9: Kinds of Threats Threats Types of Threats Two retrospective lists of known vulnerabilities are of interest;  CVE, the Common Vulnerabilities and Exposures list;  is a dictionary of publicly known information security vulnerabilities and exposures.  see (http://cve.mitre.org/).  CVE’s common identifiers enable data exchange between: − security products and provide a baseline index point for evaluating coverage of security tools and services.  CVSS, the Common Vulnerability Scoring System, to measure the extent of harm;  provides a standard measurement system that allows accurate and consistent scoring of vulnerability impact.  see (http://nvd.nist.gov/cvss.cfm). Threats Advanced Persistent Threat Security experts are becoming increasingly concerned about a type of threat called advanced persistent threat (APT);  the resulting impact of individuals attack is limited to what that single attacker can organize and manage.  A collection of attackers-think, for example;  of the cyber equivalent of a street gang or an organized crime squad,  might work together to purloin credit card numbers or similar financial assets to fund other illegal activity. Advanced persistent threat attacks come from organized, well financed, patient assailants;  Often affiliated with governments or quasi- governmental groups. Threats Advanced Persistent Threat Advanced persistent threat attackers are:  engage in long term campaigns;  the attacks are silent, avoiding any obvious impact that would alert a victim,  allowing the attacker to exploit the victim’s access rights over a long time.  They carefully select their targets,  crafting attacks that appeal to specifically those targets;  email messages called spear phishing are intended to seduce their recipients. The motive of such attacks is sometimes unclear;  One popular objective is economic espionage. Threats Types of Attackers; Computer criminals have access to enormous amounts of, HW, SW, and data;  they have the potential to cripple much of effective business and government throughout the world. Computer crime;  is any crime involving a computer or aided by the use of one. this definition is admittedly broad, it allows us to consider ways to protect;  ourselves,  our businesses, and  our communities against those who use computers maliciously. the purpose of computer security is to prevent these criminals from doing damage; Threats Types of Attackers; The attacker types are:  Individuals: − acting with motives of fun, challenge, or revenge.  Organized, Worldwide Groups: − attacks have involved groups of people, − example: attacks on Estonia, loosely connected group.  Organized Crime: − Organized crime groups are discovering that computer crime can be lucrative. − Organized crime wants a resource; o such criminals want to stay under the radar to be able to extract profit from the system over time. The novice hacker can use a crude attack, whereas; the professional attacker wants a neat, robust, and undetectable method that can deliver rewards for a long time.  Terrorists; Threats Types of Attackers; terrorists The link between computer security and terrorism is quite evident; they using computers in 4-way:  Computer as targets of attack: − denial-of-service attacks and web site defacements are popular for any political organization, because;  they attract attention to the cause and bring undesired negative attention to the target of the attack.  Computer as enabler of attack: − web sites, web logs, and e-mail lists are:  effective, fast, and inexpensive ways to get a message to many people.  Computer as methods of attack: − to launch offensive attacks requires use of computers; − For example: Stuxnet worm.  Computer as enhance of attack: − The Internet has proved to be an invaluable means for terrorists to spread propaganda and recruit agents. Threats Types of Attackers FIGURE 1-10: Attackers Security Threats; Umesh Hodeghatta Rao, Umesha Nayak - The InfoSec Handbook_ An Introduction to Information Security-Apress (2014) The word ‘threat’ in information security means:  anyone or anything that poses danger to the information, the computing resources, users, or data. The threat can be from:  insiders: who are within the organization, or from;  outsiders who are outside the organization. ‒ Studies show that 80% of security incidents are coming from insiders. Security threats can be categorized in many ways;  One of the important ways they are categorized is on the basis of the “origin of threat,”; ‒ namely external threats and internal threats.  The same threats can be categorized based on the layers. Security Threats; External Threats Umesh Hodeghatta Rao, Umesha Nayak - The InfoSec Handbook_ An Introduction to Information Security-Apress (2014) External threats;  originate from outside the organization, ‒ primarily from the environment in which the organization operates. These threats may be primarily:  physical threats,  socio-economic threats specific to the country like a country’s current social and economic situation,  network security threats,  communication threats,  human threats like threats from hackers,  software threats, and  legal threats. Security Threats; External Threats Umesh Hodeghatta Rao, Umesha Nayak - The InfoSec Handbook_ An Introduction to Information Security-Apress (2014) Social engineering threats like:  using social engineering sites to gather data and impersonate people for the purpose of defrauding them and obtaining their credentials for unauthorized access is increasing.  Theft of personal identifiable information, confidential strategies, and intellectual properties of the organization are other important threats.  Some of these physical threats or legal threats may endanger an entire organization completely; ‒ Comparatively, other threats may affect an organization partially or for a limited period of time and may be overcome relatively easily.  Cybercrimes are exposing the organizations to legal risks too. Security Threats; External Threats Umesh Hodeghatta Rao, Umesha Nayak - The InfoSec Handbook, 2014) Some of the important external threats are illustrated in the following Figure; Security Threats; Internal Threats Umesh Hodeghatta Rao, Umesha Nayak - The InfoSec Handbook, 2014) Internal threats originate from within the organization.  The primary contributors to internal threats are: ‒ employees, contractors, or suppliers to whom work is outsourced. ‒ The major threats are: o frauds, misuse of information, and/or destruction of information. Many internal threats primarily originate for the following reasons:  Weak Security Policies,  Weak Security Administration, and  Lack of user security awareness. Security Threats; Internal Threats Umesh Hodeghatta Rao, Umesha Nayak - The InfoSec Handbook, 2014) Weak Security Policies, including: ‒ Unclassified or improperly classified information, leading to the divulgence or unintended sharing of confidential information with others, particularly outsiders. ‒ Inappropriately defined or implemented authentication or authorization, leading to unauthorized or inappropriate access. ‒ Undefined or inappropriate access to customer resources or contractors/suppliers, leading to fraud, misuse of information, or theft. ‒ Unclearly defined roles and responsibilities, leading to no lack of ownership and misuse of such situations. ‒ Inadequate segregation of duties, leading to fraud or misuse. ‒ Unclearly delineated hierarchy of “gatekeepers” who are related to information security, leading to assumed identities.  Security Threats; Internal Threats Umesh Hodeghatta Rao, Umesha Nayak - The InfoSec Handbook, 2014) Weak Security Administration, including: ‒ Weak administrative passwords being misused to steal data or compromise the systems. ‒ Weak user passwords allowed in the system and applications, leading to unauthorized access and information misuse. ‒ Inappropriately configured systems and applications, leading to errors, wrong processing, or corruption of data. ‒ Non-restricted administrative access on the local machines and/or network, leading to misuse of the system or infection of the systems. ‒ Non-restricted access to external media such as USB or personal devices, leading to theft of data or infection of the systems. Security Threats; External and Internal Threats Umesh Hodeghatta Rao, Umesha Nayak - The InfoSec Handbook, 2014) Weak Security Administration, including: Continue; ‒ Non-restricted access to employees through personal devices or from unauthenticated networks and the like, leading to data theft. ‒ Unrestricted access to contractors and suppliers leading to theft or misuse of information including through dumpster diving or shoulder surfing. ‒ Unrestricted website surfing, leading to infections of viruses, phishing, or other malware. ‒ Unrestricted software downloads leading to infection, copyright violations, or software piracy. ‒ Unrestricted remote access leading to unauthorized access or information theft. ‒ Accidentally deleting data permanently.