Esson: Computer Security

LESSON 1
COMPUTER SECURITY
TOPICS
1. Computer Security Concepts
2. Threats, Assets, and Attacks
3. Security Functional Requirements
4. Fundamental Security Design and Principles
5. Attack Surfaces and Attack Trees
6. Computer Security Strategies
LEARNING OUTCOMES
At the end of the lesson, the students should be able to:
1. describe the key security requirements of confidentiality, integrity, and

availability;
2. discuss the types of security threats and attacks and categorize computer
and network assets;
3. summarize the functional requirements for computer security;
4. explain the fundamental security design principles;
5. discuss the use of attack surfaces and attack trees;
that must be dealt with and give; and
6. analyze the principle aspects of a comprehensive security strategy.
TOPIC 1: COMPUTER SECURITY CONCEPTS
What is Computer Security?

Computer Security refers to techniques for ensuring that data stored in a computer cannot
be read or compromised by any individual without authorization. According to NIST 1995, the
protection afforded to an automated information system to attain the applicable objectives of
preserving the integrity, availability and confidentiality of information system resources (includes
hardware, software, firmware, information/data, and telecommunications).
Security is a state of well-being of information and infrastructure.
Why Computer Security?
 Computer security is important for protecting the confidentiality, integrity, and availability of
computer systems and their resources.
 Computer administration and management have become more complex which produces
more attack and avenues.
 Evolution of technology has focused on the ease of use while the skill level needed for
exploits has decreased.
 Network environments and network-based applications provide more attack paths.
GOALS IN COMPUTING SECURITY
1. Confidentiality assures that confidential
information is not disclosed to unauthorized
individuals Privacy: Assures that individual
control or influence what information may be
collected and stored
2. Integrity assures that information and programs are
changed only in a specified and authorized
manner. System integrity: Assures that a system
performs its operations in unimpaired manner
3. Availability: assure that systems works promptly, and
service is not denied authorizing users.
EXAMPLES OF SECURITY REQUIREMENTS:

CONFIDENTIALITY
• Student grade information is an asset whose confidentiality is very high. Grades should only
be available to students, their parents, and their employers (when required for the job)
• Student enrollment information: may have moderate confidentiality rating; less damage if
enclosed
• Directory information: low confidentiality rating; often available publicly
INTEGRITY
 A hospital patient’s allergy information (high integrity data): a doctor should be able to trust
that the info is correct and current - If a nurse deliberately falsifies the data, the database
should be restored to a trusted basis and the falsified information traced back to the person
who did it
• An online newsgroup registration data: moderate level of integrity
• An example of low integrity requirement: anonymous online poll (inaccuracy is well
understood)
AVAILABILITY
• A system that provides authentication: high availability requirement - If customers cannot
access resources, the loss of services could result in financial loss
• A public website for a university: a moderate availably requirement; not critical but causes
embarrassment
• An online telephone directory lookup: a low availability requirement because unavailability is
mostly annoyance (there are alternative sources)
ELEMENTS OF SECURITY
Non-
Confidentiality Authenticity Integrity Availability
repudiation
THE
Ensuring Identification Ensuring that Ensuring that Ensuring that a

information is and assurance the information the info is party to a
accessible only of the origin of is accurate, accessible to contract or a
to those information complete, authorized comm. cannot
authorized to reliable, and is in persons when deny the
have access its original form required authenticity of
without delay their signature
on a document
THE SECURITY, FUNCTIONALITY, AND EASE OF USE TRIANGLE

Applications/software products by default are preconfigured for ease of use, which makes
the user vulnerable to various security flaws. Similarly, increased functionality features in an
application make it difficult to use in addition to being less secure.
Security
(Restrictions)
Functionality
Ease of Use
(Features)
FUNDAMENTAL CONCEPTS OF COMPUTER SECURITY
PRECAUTION – adhering to the preventive measures while using computer system

and application
MAINTENANCE – managing all the changes in the computer applications and keep them
up to date
REACTION – acting timely when security incidents occur.
LAYERS OF COMPUTER SECURITY

Ensures that a valid
user is logged in
Covers the use of and that the
software, logged-in user is
Protects the hardware, and allowed to use an
Protects the procedural application/
system and its
methods to protect program
networks and their information from
Safeguards the applications from
services from theft, corruption,
personnel, external threats
unauthorized unauthorized
hardware, modification, access, or misuse
programs, destruction, or
networks, and disclosure
data from physical
threats
LEVELS OF SECURITY BREACH IMPACT

• Low: the loss will have a limited impact, e.g., a degradation in mission or minor damage or
minor financial loss or minor harm
• Moderate: the loss has a serious effect, e.g., significance degradation on mission or significant
harm to individuals but no loss of life or threatening injuries
• High: the loss has severe or catastrophic adverse effect on operations, organizational assets or
on individuals (e.g., loss of life)

Esson: Computer Security

Uploaded by

Copyright:

Available Formats

Esson: Computer Security

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Esson: Computer Security

Uploaded by

Copyright:

Available Formats

LESSON 1

At the end of the lesson, the students should be able to:

1. describe the key security requirements of confidentiality, integrity, and

TOPIC 1: COMPUTER SECURITY CONCEPTS

What is Computer Security?

EXAMPLES OF SECURITY REQUIREMENTS:

Ensuring Identification Ensuring that Ensuring that Ensuring that a

THE SECURITY, FUNCTIONALITY, AND EASE OF USE TRIANGLE

FUNDAMENTAL CONCEPTS OF COMPUTER SECURITY

PRECAUTION – adhering to the preventive measures while using computer system

LAYERS OF COMPUTER SECURITY

LEVELS OF SECURITY BREACH IMPACT

You might also like