INTRODUCTION TO COMPUTER

SECURITY
Paul Mutinda Kathale

Email: paulkathale@gmail.com

1
 Introduction to Security
Outline
1. Examples – Security in Practice
2. What is „Security?”
3. Pillars of Security:
Confidentiality, Integrity, Availability
(CIA)
4. Vulnerabilities, Threats, and Controls
5. Attackers
6. How to React to an Exploit?
7. Methods of Defense
8. Principles of Computer Security
2
 Computer Security
 This is a study, which is a branch of
Computer Science, focusing on creating a
secure environment for the use of
computers.
 It is a focus on the “behavior of users,”
and the protocols in order to create a
secure environment for anyone using
computers.

3
 Security? What is that?
 Lock the doors and windows and you are secure
 NOT
 Call the police when you feel insecure
 Really?
 End result: Complete computer security is unattainable, it
is a cat and mouse game
 Similar to crime vs. law enforcement

4
 Goals of Computer Security
 Integrity:
 Guarantee that the data is what we expect
 Confidentiality
 The information must just be accessible to the authorized people
 Availability
 Service is available to users whenever they need
 Reliability
 Computers should work without having unexpected problems
 Authentication
 Guarantee that only authorized persons can access to the
resources

5
 Computer Security Issues
 Vulnerability is a point where a system is
susceptible to attack.
 A threat is a possible danger to the system. The
danger might be a person (a system cracker or a
spy), a thing (a faulty piece of equipment), or an
event (a fire or a flood) that might exploit a
vulnerability of the system.
 Countermeasures are techniques for protecting
your system

6
 Security Basics
 What does it mean to be secure?
 “Include protection of information from theft or corruption, or the
preservation of availability, as defined in the security policy.” - The
Wikipedia
 Types of Security
 Network Security
 System and software security
 Physical Security
 Very little in computing is inherently secure, you must
protect yourself!

7
 Critical Infrastructure Areas
Include:
 Telecommunications
Electrical power systems
Water supply systems

Gas and oil pipelines

Transportation

Government services

Emergency services

Banking and finance

…

8
 2. What is a “Secure” Computer System?
 To decide whether a computer system is “secure”, you must
first decide what “secure” means to you, then identify the
threats you care about.

You Will Never Own a Perfectly Secure System!

 Threats - examples
 Viruses, trojan horses, etc.
 Denial of Service
 Stolen Customer Data
 Modified Databases - SQL Injections
 Identity Theft and other threats to personal privacy
 Equipment Theft
 Espionage in cyberspace
 Hack-tivism
 Cyberterrorism
 …
9
 3. Basic Components of Security:
Confidentiality, Integrity, Availability (CIA)
 CIA
 Confidentiality: Who is authorized to use data? C I
 Integrity: Is data „good?” S
 Availability: Can access data whenever need it?
A

S = Secure
 CIA or CIAAAN… 
(other security components added to CIA)
 Authentication
 Authorization
 Non-repudiation
 …

10
 Need to Balance

CIA
Example 1: C vs. I+A
 Disconnect computer from Internet to increase confidentiality
 Availability suffers, integrity suffers due to lost updates

 Example 2: I vs. C+A

 Have extensive data checks by different people/systems to
increase integrity
 Confidentiality suffers as more people see data, availability
suffers due to locks on data under verification)

11
 Confidentiality
 “Need to know” basis for data access
 How do we know who needs what data?
Approach: access control specifies who can access
what
 How do we know a user is the person she claims to be?
Need her identity and need to verify this identity
Approach: identification and authentication
 Analogously: “Need to access/use” basis for physical
assets
 E.g., access to a computer room, use of a desktop
 Confidentiality is:
 difficult to ensure
 easiest to assess in terms of success (binary in nature:
12
 Integrity
 Integrity vs. Confidentiality
 Concerned with unauthorized modification of assets (=
resources)
Confidentiality - concered with access to assets
 Integrity is more difficult to measure than confidentiality
Not binary – degrees of integrity
Context-dependent - means different things in different
contexts
Could mean any subset of these asset properties:
{ precision / accuracy / currency / consistency /
meaningfulness / usefulness / ...}

13
 Availability

 We can say that an asset (resource) is

available if:
 Timely request response
 Fair allocation of resources (no starvation!)
 Fault tolerant (no total breakdown)
 Easy to use in the intended way
 Provides controlled concurrency (concurrency
control, deadlock control, ...)
[Pfleeger &
Pfleeger]
14
 4. Vulnerabilities, Threats, and Controls
 Understanding Vulnerabilities, Threats, and Controls
 Vulnerability = a weakness in a security system
 Threat = circumstances that have a potential to cause harm
 Controls = means and ways to block a threat, which tries to
exploit one or more vulnerabilities
 Most of the class discusses various controls and their effectiveness
[Pfleeger & Pfleeger]

15
  Attack (materialization of a vulnerability/threat combination)
 = exploitation of one or more vulnerabilities by a threat; tries to defeat
controls
 Attack may be:

 Successful (a.k.a. an exploit)

 resulting in a breach of security, a system penetration, etc.

 Unsuccessful
 when controls block a threat trying to exploit a vulnerability

16
 Kinds of Threats
 Kinds of threats:
 Interception
 an unauthorized party (human or not) gains access to

an asset
 Interruption
 an asset becomes lost, unavailable, or unusable

 Modification
 an unauthorized party changes the state of an asset

 Fabrication
 an unauthorized party counterfeits an asset

[Pfleeger & Pfleeger]

17
 Software Level of Vulnerabilities / Threats
 Software Deletion
 Easy to delete needed software by mistake
 To prevent this: use configuration management
software
 Software Modification
 Trojan Horses, , Viruses, Logic Bombs,
Trapdoors, Information Leaks (via covert
channels), ...
 Software Theft
 Unauthorized copying
18
 Data Level of Vulnerabilities / Threats

 How valuable is your data?

 Credit card info vs. your home phone number
 Source code
 Visible data vs. context
 „2345” -> Phone extension or a part of SSN?

 Adequate protection
 Cryptography
 Good if intractable for a long time

 Threat of Identity Theft

 Cf. Federal Trade Commission: http://www.consumer.gov/idtheft/ \

19
 Types of Attacks on Data CIA

 Disclosure
 Attack on data confidentiality
 Unauthorized modification / deception
 E.g., providing wrong data (attack on data integrity)
 Disruption
 DoS (attack on data availability)
 Usurpation
 Unauthorized use of services (attack on data confidentiality, integrity
or availability)

20
 5. Attackers
 Attackers need MOM
 Method
Skill, knowledge, tools, etc. with which to pull off an attack
 Opportunity
Time and access to accomplish an attack
 Motive
Reason to perform an attack

21
 Types of Attackers
 Types of Attackers - Classification 1
 Amateurs
 Opportunistic attackers (use a password they found)
 Script kiddies
 Hackers - nonmalicious
 In broad use beyond security community: also malicious
 Crackers – malicious
 Career criminals
 State-supported spies and information warriors

 Types of Attackers - Classification 2 (cf. before)

 Recreational hackers / Institutional hackers
 Organized criminals / Industrial spies / Terrorists
 National intelligence gatherers / Info warriors

22
 Example: Hacking As Social Protest

 Hactivism
 DDOS attacks on government agencies
 SPAM attacks as “retaliation”

23
 6. Reacting to an Exploit

Exploit = successful attack

 Report to the vendor first?

 Report it to the public?

 What will be public relations effects if you do/do not?

24
 “To Report or Not To Report:”
Tension between Personal Privacy
and Public Responsibility
An info tech company will typically lose between
ten and one hundred times more money from
shaken consumer confidence than the hack attack
itself represents if they decide to prosecute the
case.

Mike Rasch, VP Global Security, testimony before the

Senate Appropriations Subcommittee, February 2000
reported in The Register and online testimony transcript

25
 Further Reluctance to Report
 One common fear is that a crucial piece of equipment,
like a main server, say, might be impounded for
evidence by over-zealous investigators, thereby
shutting the company down.

 Estimate: fewer than one in ten serious intrusions are

ever reported to the authorities.

Mike Rasch, VP Global Security, testimony before the Senate

Appropriations Subcommittee, February 2000
reported in The Register and online testimony transcript

Barbara Edicott-Popovsky and Deborah Frincke, CSSE592/492, U. Washington]

26
 How can you achieve security?
 Many techniques exist for ensuring computer and
network security
 Cryptography
 Secure networks
 Antivirus software
 Firewalls
 In addition, users have to practice “safe
computing”
 Not downloading from unsafe websites
 Not opening attachments
 Not trusting what you see on websites
 Avoiding Scams
27
7. Methods of Defense
 Five basic approaches to defense of
computing systems
 Prevent attack
 Block attack / Close vulnerability

 Deter attack
 Make attack harder (can’t make it impossible )
 Deflect attack
 Make another target more attractive than this

target
 Detect attack
 During or after

 Recover from attack

28
 A) Controls
 Castle in Middle Ages  Computers Today
 Location with natural  Encryption
obstacles  Software controls
 Drawbridge  Hardware controls
 Heavy walls  Policies and procedures
 Arrow slits

Physical controls
 Strong gate
 Tower

 Guards / passwords

29
  Multiple controls in computing systems can include:
 system perimeter – defines “inside/outside”

 preemption – attacker scared away

 deterrence – attacker could not overcome defenses

 faux environment (e.g. honeypot, sandbox) – attack

deflected towards a worthless target (but the attacker

doesn’t know about it!)
 Note layered defense /
multilevel defense / defense in depth (ideal!)

30
 A.1) Controls: Encryption

 Cleartext scambled into ciphertext (enciphered text)

 Protects CIA:
 confidentiality – by “masking” data
 integrity – by preventing data updates
 e.g., checksums included
 availability – by using encryption-based protocols
 e.g., protocols ensure availablity of resources for
different users

31
 Controls: Policies and Procedures

 Policy vs. Procedure

 Policy: What is/what is not allowed
 Procedure: How you enforce policy
 Advantages of policy/procedure controls:
 Can replace hardware/software controls
 Can be least expensive
 Be careful to consider all costs
 E.g. help desk costs often ignored for for passwords (=> look cheap
but migh be expensive)

32
  Policy - must consider:
 Alignment with users’ legal and ethical standards
 Probability of use (e.g. due to inconvenience)
Inconvenient: 200 character password,
change password every week
(Can be) good: biometrics replacing passwords
 Periodic reviews
 As people and systems, as well as their goals, change

33
 A.5) Controls: Physical Controls

 Walls, locks
 Guards, security cameras
 Backup copies and archives
 Cables and locks (e.g., for notebooks)
 Natural and man-made disaster protection
 Fire, flood, and earthquake protection
 Accident and terrorism protection
 ...

34
 B) Effectiveness of Controls
 Awareness of problem
 People convined of the need for these controls

 Likelihood of use
 Too complex/intrusive security tools are often disabled

 Overlapping controls
 >1 control for a given vulnerability
 To provide layered defense – the next layer compensates for a

failure of the previous layer

 Periodic reviews
 A given control usually becomess less effective with time
 Need to replace ineffective/inefficient controls with better ones

35
 8. Principles of Computer Security

 Principle of Easiest Penetration

An intruder must be expected to use any available
means of penetration.
The penetration may not necessarily be by the most obvious
means, nor is it necessarily the one against which the most
solid defense has been installed.

 Principle of Adequate Protection

Computer items must be protected to a degree
consistent with their value and only until they lose
their value.

36
  Principle of Effectiveness
Controls must be used—and used properly—to be
effective.
They must be efficient, easy to use, and appropriate.

 Principle of Weakest Link

Security can be no stronger than its weakest link.
Whether it is the power supply that powers the firewall or
the operating system under the security application or the
human, who plans, implements, and administers controls, a
failure of any control can lead to a security failure.
37
End of Section 1:
Introduction

38