security in computing introduction to security in computing

Security in ComputingSecurity in Computing

Introduction to Security in Computing

Introduction – Security in Introduction – Security in ComputingComputingSecurity in computing is about

protecting computer-related assets, i.e. valuable information

The focus is security for computing systems

How banks protect physical currency cf. people protecting information (Pfleeger, p.2)

Can we learn from our analysis of banks, i.e. how they have protected e.g. money, gold etc.

I.I. Terms and definitionsTerms and definitions

A. Secure, protected1. Immune to attack2. Covered by certain controls

B. Threat1. A potential to do harm or cause

loss

C. Vulnerability1. Weaknesses in defences that could

allow harm to occur

Figure 1-1  Threats, Controls, and Vulnerabilities.

The water is a THREAT to the man

The crack is a VULNERABILTIY that threatens the man’s security

The man placing his finger in the whole is controlling the threat.

1.1. Terms and definitionsTerms and definitions

D. Attack1. Threat + Vulnerability

E. Control, countermeasure

F. Risk, residual [remaining] risk

G. Penetration[making way through], weakest point

II.II. Attacks and attackersAttacks and attackersA. Attacks

1. Malicious; non-malicious; natural causes2. Accidental, intentional

B. Attackers1. MOM – Method + Opportunity + Motive

a) Method: tools, knowledge, capabilityb) Opportunity: time, physical access,

availabilityc) Motivation: reason for attack

2. Work factor: difficult in pulling off attack; measured in time, skill, resources

Figure 1-3  Relationship Between Confidentiality, Integrity, and Availability

(Pfleeger, p.11)

III.III. The Security Triad: C-I-The Security Triad: C-I-AA

Figure 1-5  Security of Data (Pfleeger, p.18)

III.III. The Security Triad: C-I-The Security Triad: C-I-AA

III.III. The Security Triad: C-I-The Security Triad: C-I-AA

A. Confidentiality: protection from unauthorised disclosure

1. Privacy; personal private information

2. Sensitive information, e.g. student grades, company inventions, juvenile arrest records

3. Protection of classified information

III.III. The Security Triad: C-I-The Security Triad: C-I-AA

B. Integrity: protection from inappropriate modification

1. Precision, accuracy

2. Possible ways to limit modification

a) Not modified ( for example, read-only)

b) Only in acceptable ways, e.g. ?

c) Only by acceptable people, e.g. ?

d) Only using appropriate processes, e.g.?

III.III. The Security Triad: C-I-The Security Triad: C-I-AA

3. Internally consistenta) The disk contents match what was

originally recorded

b) Update to once instance causes change to be propagated to all instances

4. Meaningful and usablea) Readable

b) Not protected against legitimate access (see also availability)

III.III. The Security Triad: C-I-The Security Triad: C-I-AA

C. Availability1. Usable (readable, accessible)2. Sufficient capacity (bandwidth,

sharable, or copied as needed)3. Is making progress (not hung in a loop

or never attended to)4. Completes in an acceptable amount of

time

D. These goals can conflict1. High confidentiality may limit availability2. Strong integrity controls may impose a

slowdown that affect availability

IV.IV. VulnerabilitiesVulnerabilities

A. Kinds of vulnerabilities1. Interruption (breaking a pathway of

use, deleting, destroying)2. Interception (taking or obtaining

without permission; either taking an object itself or making an unauthorised copy)

3. Modifications (changing without permission)

4. Fabrication (creating a new – illicit – version)

IV.IV. VulnerabilitiesVulnerabilitiesB. Targets of vulnerabilities

1. Hardware (including firmware)2. Software3. Data and Information4. Access, time, bandwidth, network

resources(cable, switches and routers, addressing and routing information, wireless services)

5. People6. Supplies

V.V. Computer attackersComputer attackers

A. Most computers attacks are committed by insiders as unintentional, non- malicious errors

1. Security awareness is the most effective and least expensive control

B. Amateurs1. Often insiders with privileges

(necessary to do their jobs)2. Outside probers or tinkerers

V.V. Computer attackersComputer attackers

C. Crackers1. Advanced form of probing or tinkering

– fine line between probing and hacking

2. Intention to undermine or circumvent security controls

3. Various motivations: challenge, ego, curiosity, adventure, experimentation

4. Non-malicious attacks or attacks with non-malicious intent are still attacks

V.V. Computer attackersComputer attackers

D. Criminals1. Motivation: payoff, revenge,

competition2. Rapidly growing attack segment3. Financial reward potential is attractive4. Some evidence that organised crime is

becoming involved in computer crime – it’s where the money is

5. Definition of “computer crime” not precise

VI.VI. Defence ObjectivesDefence Objectives

A. Prevent harm1. Block attack, close [plug]

vulnerability2. Although obviously most effective,

sometimes prevention is not possible

a) Insiders need elevated privileges to do work

b) Vulnerabilities may be unknown

c) Even a fortes can be breached with the right attack

VI.VI. Defence ObjectivesDefence ObjectivesB. Deter harm

1. Make the attacker work harder or longer2. Hope the attacker will choose another

easier target3. Example: protect bank tellers with

bulletproof glass: not impenetrable, but requires a long time and a lot of force

C. Deflect harm1. Push the attacker to another target2. Example: a “honeypot” [trap] - website to

attract and occupy the attacker

VI.VI. Defence ObjectivesDefence Objectives

D. Detect harm1. Determine that attack is under way

(realtime) or has occurred sometime in the past (non-realtime)

2. Goals:a) to be able to increase defences (to block

an attack in realtime)b) To determine the kind and extend of

attack (after the fact) and strengthen defences for the future (close vulnerability) or know what has been lost

VI.VI. Defence ObjectivesDefence ObjectivesE. Recover from harm

1. Resume normal operation2. Increase or strengthen so future

attacks do not succeed3. Deal with loss or exposure of date

F. Note: More cost effective to allow unlikely harm to occur and spend money or recovery than to spend much more money trying in vain to prevent the harm

VII.VII.ControlsControls

A. Physical1. Gates, guns, guards2. Access control devices, e.g., badge

readers, motion detectors3. Fire suppression, extinguishers

B. Administrative1. Security awareness training2. Security policies, procedures,

guidelines, practices

VII.VII.ControlsControls3. Rules of acceptable use, code of

ethics4. Hiring and termination practices5. Software development practices6. Human oversight, management,

review

C. Technical1. Firewall2. Intrusion detection system3. Virus scanner

VII.VII.ControlsControls4. Encryption

5. Identification and authentication technologies (e.g. smart cards, biometrics, password)

6. Logical access controls (program-based controls limiting access based on identity, proposed use, date, time etc); implemented by network infrastructure, operating systems, database management, application program, utility

VII.VII.ControlsControls7. Honeypot 8. Protocol9. Networking infrastructure,

“middleware” (object request broker, runtime environment), operating systems, database management systems, applications

Figure 1-2  System Security Threats.

Figure 1-4   Vulnerabilities of Computing Systems.

Figure 1-6  Multiple Controls.