Information Security
Lecture1
Information Security
1
Roadmap
•
•
•
•
•
•
Security?
Security types
Possible Security violation
Key objectives of computer security
OSI security architecture
Security models
Information Security
2
What is
Security?
• “The quality or state of being secure—to be
free from danger”
• A successful organization should have multiple
layers of security in place:
–
–
–
–
–
–
Physical security
Personal security
Operations security
Communications security
Network security
Information security
Information Security
3
What is security?
• The protection of information and its
critical elements, including systems and
hardware that use, store, and transmit
that information
• Necessary tools: policy, awareness,
training, education, technology
Information Security
4
Definitions
• Computer Security - generic name for
the collection of tools designed to protect
data and to thwart hackers
• Network Security - measures to protect
data during their transmission over a
network
• Internet Security - measures to protect
data during their transmission over a
collection of interconnected networks
Information Security
5
Operational
security
• Operational security (OPSEC) is a security and risk
management process that prevents sensitive
information from getting into the wrong hands.
• Another OPSEC meaning is a process that identifies
seemingly innocuous(safe) actions that could
inadvertently reveal critical or sensitive data to a cyber
criminal. OPSEC is both a process and a strategy, and
it encourages IT and security managers to view their
operations and systems from the perspective of a
potential attacker. It includes analytical activities and
processes like behavior monitoring, social media
monitoring, and security best practice.
Information Security
6
Operational
security
• A crucial piece of what is OPSEC is the use of risk management to
discover potential threats and vulnerabilities in organizations’
processes, the way they operate, and the software and hardware
their employees use. Looking at systems and operations from a
third party’s point of view enables OPSEC teams to discover
issues they may have overlooked and can be crucial to
implementing the appropriate countermeasures that will keep their
most sensitive data secure.
Information Security
7
Information
security:
• a “well-informed sense of assurance that
the information risks and controls are in
balance.” — Jim Anderson, (2002)
Information Security
8
Network and
Internet security
• The field of network and Internet
security consists of measures to deter,
prevent, detect, and correct security
violations that involve the transmission of
information.
Information Security
9
Possible security
violations:
• User A transmits a file to user B. The file
contains
sensitive
information(e.g.,
payroll records) that is to be protected
from disclosure. User C, who is not
authorized to read the file, is able to
monitor the transmission and capture a
copy of the file during its transmission.
Information Security
10
…
•D transmits a message to computer E,
instructing E to update an authorization
file. User F intercepts the message, alters
its contents to add or delete entries and
forward to E which accepts the message
as being from D.
Information Security
11
…
•User F constructs its own message and
transmits to E as if coming from D
•Denying sending a message
Information Security
12
Key objectives of
computer Security:
✓ Three key objectives of computer security
are:
• Confidentiality
• Integrity
• Availability
✓ Two additional most commonly mentioned
security concepts :
• Authenticity
• Accountability
Information Security
13
Confidentiality:
This term covers two related concepts:
Data confidentiality:
Assures that private or
confidential
information is not made available or disclosed
to unauthorized individuals.
Privacy:
Assures that individuals control or influence
what information related to them may be
collected and stored and by whom and to
whom that information may be disclosed.
Information Security
14
Integrity
This term covers two related concepts:
Data integrity:
Assures that information and programs are
changed only in a specified and authorized
manner.
System integrity:
Assures that a system performs its intended
function in an unimpaired manner, free from
inadvertent unauthorized manipulation of the
system.
Information Security
15
Availability
• Assures that systems work promptly and
service is not denied to authorized users.
Information Security
16
CIA Triad
Information Security
17
Authenticity:
• The property of being genuine and being
able to be verified and trusted; confidence
in the validity of a transmission, a
message, or message originator.
• This means verifying that users are who
they say they are and that each input
arriving at the system came from a
trusted source.
Information Security
18
Accountability
• The security goal that generates the
requirement for actions of an entity to be
traced uniquely to that entity. This
supports nonrepudiation, deterrence, fault
isolation,
intrusion
detection
and
prevention, and after-action recovery and
legal action.
Information Security
19
OSI Security
architecture
• ITU-T X.800 Security Architecture for OSI local
copy defines a systematic way of defining and
providing security
requirements provides a
useful, although abstract, overview of network
security concepts
• The OSI security architecture focuses on
– security attack
– security mechanism
– security service
Information Security
20
Security Attack
• any action that compromises the security of information
owned by an organization
• information security is about how to prevent attacks, or
failing that, to detect attacks on information-based systems
• have a wide range of attacks
Threat Vs. Attack
• Threat: a circumstance or scenario with the potential to
exploit a vulnerability, and cause harm to a system.
• Attack: A deliberate attempt to breach system security.
• note: often threat & attack mean same
Information Security
21
Classify Security
Attacks as
• passive attacks - eavesdropping on, or
monitoring of, transmissions to:
– obtain message contents, or
– monitor traffic flows
• active attacks -modification of data stream to:
– masquerade of one entity as some other
– replay previous messages
– modify messages in transit
– denial of service
Information Security
22
Passive attack
Information Security
23
…
Information Security
24
Active attack
Information Security
25
…
Information Security
26
…
Information Security
27
…
Information Security
28
…
Information Security
29
Security Service
– is something that enhances the security of the
data processing systems and the information
transfers of an organization
– intended to counter security attacks
– make use of one or more security mechanisms
to provide the service
– replicate functions normally associated with
physical documents
• eg have signatures, dates; need protection
from disclosure, tampering, or destruction;
be notarized or witnessed; be recorded or
licensed
Information Security
30
Security Services
➢ X.800 defines it as:
A service provided by a protocol layer of
communicating open systems, which ensures
adequate security of the systems or of data
transfers
➢ RFC 2828 defines it as:
A processing or communication service provided
by a system to give a specific kind of protection to
system resources
➢ X.800 defines it in 5 major categories
Information Security
31
Security Services
(X.800)
• Authentication - assurance that the
communicating entity is the one claimed
• Access Control - prevention of the unauthorized
use of a resource
• Data Confidentiality –protection of data from
unauthorized disclosure
• Data Integrity - assurance that data received is as
sent by an authorized entity
• Non-Repudiation - protection against denial by
one of the parties in a communication
•
Information Security
32
Security
Mechanism
• A mechanism that is designed to detect, prevent,
or recover from a security attack.
• Examples of mechanisms are encryption
algorithms, digital signatures, and authentication
protocols.
Information Security
33
Security
Mechanisms (X.800)
• specific security mechanisms:
– encipherment, digital signatures, access
controls, data integrity, authentication
exchange, traffic padding, routing control,
notarization
• pervasive security mechanisms:
– trusted functionality, security labels, event
detection, security audit trails, security
recovery
Information Security
34
Key information
security
concepts
•
•
•
•
Access
•
Asset
•
Attack
•
Control, safeguard /
Countermeasure •
• Exploit
•
• Exposure
•
Loss
Risk
Subjects and
objects
Threat
Threat agent
Vulnerability
Information Security
35
Security Policy
• At the least, a security policy is an
informal description of desired systems
behaviors.
• More usefully, a security policy is a formal
statement of rules and practices that
specify or regulate how a system or
organization provides security services to
protect sensitive and critical system
resources.
Information Security
36
Factors needed to consider while
developing a
Security Policy
• The value of asset being protected
• The vulnerabilities of the system
• Potential threats
Information Security
37
Security
Implementation
Security implementation involves four
complementary course of actions
• Prevention
• Detection
• Response
• Recovery
Information Security
38
Questions
Information Security
39