Chapter1 Overview

Information Computer Network
Security
Chapter 1 - Overview
Dr. Safi Ibrahim
A definition of computer security
• Computer security: Measures and controls that
ensure confidentiality, integrity, and availability
of information system assets including hardware,
software, firmware, and information being
processed, stored, and communicated.
Three key objectives (the CIA triad)
• Confidentiality
– Data confidentiality: Assures that confidential information
is not disclosed to unauthorized individuals
– Privacy: Assures that individual control or influence what
information may be collected and stored
• Integrity
– Data integrity: assures that information and programs are
changed only in a specified and authorized manner
– System integrity: Assures that a system performs its
operations in unimpaired manner
• Availability: assure that systems works promptly and
service is not denied to authorized users
Other concepts to a complete security picture
• Authenticity: the property of being genuine
and being able to be verified and trusted;
confident in the validity of a transmission, or a
message, or its originator
• Accountability: generates the requirement for
actions of an entity to be traced uniquely to
that individual to support nonrepudiation,
deference, fault isolation, etc
Examples of security requirements:
Confidentiality
• Student grade information is an asset whose
confidentiality is considered to be very high
– The US FERPA Act: grades should only be available to
students, their parents, and their employers (when
required for the job)
• Student enrollment information: may have
moderate confidentiality rating; less damage if
enclosed
• Directory information: low confidentiality rating;
often available publicly
• A hospital patient’sIntegrity
allergy information (high
integrity data): a doctor should be able to trust
that the info is correct and current
– If a nurse deliberately falsifies the data, the database
should be restored to a trusted basis and the falsified
information traced back to the person who did it
• An online newsgroup registration data: moderate
level of integrity
• An example of low integrity requirement:
anonymous online poll (inaccuracy is well
understood)
• Availability
A system that provides authentication: high
availability requirement
– If customers cannot access resources, the loss of
services could result in financial loss
• A public website for a university: a moderate
availably requirement; not critical but causes
embarrassment
• An online telephone directory lookup: a low
availability requirement because unavailability is
mostly annoyance (there are alternative sources)
Challenges of computer security
1. Computer security is not simple
2. One must consider potential (unexpected)
attacks
3. Procedures used are often counter-intuitive
4. Must decide where to deploy mechanisms
5. Involve algorithms and secret info (keys)
6. A battle of wits between attacker / admin
7. It is not perceived on benefit until fails
8. Requires constant monitoring
9. Too often an after-thought (not integral)
10. Regarded as impediment to using system
Security Threats and Attacks
• A threat/vulnerability is a potential violation of
security.
– Flaws in design, implementation, and operation.
• An attack is any action that violates security.
– Active adversary
• An attack has an implicit concept of “intent”
– Router mis-configuration or server crash can also
cause loss of availability, but they are not attacks
Security concepts and relationships
The scope of computer security
Aspects of Security
 consider 3 aspects of information security:
• security attack
• Passive attacks :are in the nature of
eavesdropping on, or monitoring of, transmissions.
The goal of the opponent is to obtain information
that is being transmitted.
• Active Attacks
• security mechanism (control)
• security service
Passive Attack - Interception
Goal : release of message contents
Passive Attack: Traffic Analysis
Goal: monitor traffic flow to determine location and identity of communicating
hosts and could observe the frequency and length of messages being exchanged
Observe traffic pattern

Active Attack: Interruption
Block delivery of message

Active Attack: Fabrication
Fabricate message
Active Attack: Replay
Active Attack: Modification
Modify message
Handling Attacks
 Passive attacks – focus on Prevention
•Easy to stop
•Hard to detect
 Active attacks – focus on Detection and
Recovery
•Hard to stop
•Easy to detect
Model for Network Security
Model for Network Security
 using this model requires us to:
1. design a suitable algorithm for the security
transformation
2. generate the secret information (keys) used
by the algorithm
3. develop methods to distribute and share the
secret information
4. specify a protocol enabling the principals to
use the transformation and secret
information for a security service
Model for Network Access Security
•gatekeeper function. It includes password-based login procedures

that are designed to deny access to all but authorized users
Model for Network Access Security
 using this model requires us to:
1. select appropriate gatekeeper functions to
identify users
2. implement security controls to ensure only
authorised users access designated
information or resources
 note that model does not include:
1. monitoring of system for successful
penetration
2. monitoring of authorized users for misuse
3. audit logging for forensic uses, etc.
Security Standards
Standards have been developed to the overall architecture of security
mechanisms and services. Various .The most important organizations
that have been involved in the development of these standards ones are :
 National Institute of Standards and Technology: NIST is a U.S. federal
agency that deals with measurement science, standards, and technology
related to U.S. government, NIST Federal Information Processing
Standards (FIPS) and Special Publications (SP) have a worldwide impact.
Internet Society: ISOC is a professional membership society with
worldwide organizational and individual membership. It provides
leadership in addressing issues that confront the future of the Internet
and Internet infrastructure standards, including the Internet Engineering
Task Force (IETF) and the Internet Architecture Board (IAB). These
organizations develop Internet standards and related specifications, all of
which are published as Requests for Comments (RFCs).
Security Standards – Cont.
 ITU-T: The International Telecommunication Union (ITU) is an
international organization within the United Nations System in which
governments , (ITU-T) is one of the three sectors of the ITU. ITU-T’s
mission is the development of technical standards covering all fields of
telecommunications. ITU-T standards are referred to as
Recommendations.
ISO: The International Organization for Standardization (ISO) is a
worldwide federation of national. ISO is a nongovernmental
organization that promotes the development of standardization and
related activities with a view to facilitating the international exchange
of goods and services and to developing fields of intellectual,
scientific, technological, and economic activity. ISO’s work results in
international agreements that are published as International
Standards.

Chapter1 Overview

Uploaded by

Copyright:

Available Formats

Chapter1 Overview

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Chapter1 Overview

Uploaded by

Copyright:

Available Formats

Information Computer Network

Observe traffic pattern

Block delivery of message

•gatekeeper function. It includes password-based login procedures

You might also like