Chapter 1 Introduction Components of computer security Threats

  • Slides: 12
Download presentation
Chapter 1: Introduction • • Components of computer security Threats Policies and mechanisms The

Chapter 1: Introduction • • Components of computer security Threats Policies and mechanisms The role of trust Assurance Operational Issues Human Issues September 10, 2012 Introduction to Computer Security © 2004 Matt Bishop Slide #1 -1

Basic Components • Confidentiality – Keeping data and resources hidden • Integrity – Data

Basic Components • Confidentiality – Keeping data and resources hidden • Integrity – Data integrity (integrity) – Origin integrity (authentication) • Availability – Enabling access to data and resources September 10, 2012 Introduction to Computer Security © 2004 Matt Bishop Slide #1 -2

Classes of Threats • Disclosure – Snooping • Deception – Modification, spoofing, repudiation of

Classes of Threats • Disclosure – Snooping • Deception – Modification, spoofing, repudiation of origin, denial of receipt • Disruption – Modification • Usurpation – Modification, spoofing, delay, denial of service September 10, 2012 Introduction to Computer Security © 2004 Matt Bishop Slide #1 -3

Policies and Mechanisms • Policy says what is, and is not, allowed – This

Policies and Mechanisms • Policy says what is, and is not, allowed – This defines “security” for the site/system/etc. • Mechanisms enforce policies • Composition of policies – If policies conflict, discrepancies may create security vulnerabilities September 10, 2012 Introduction to Computer Security © 2004 Matt Bishop Slide #1 -4

Goals of Security • Prevention – Prevent attackers from violating security policy • Detection

Goals of Security • Prevention – Prevent attackers from violating security policy • Detection – Detect attackers’ violation of security policy • Recovery – Stop attack, assess and repair damage – Continue to function correctly even if attack succeeds September 10, 2012 Introduction to Computer Security © 2004 Matt Bishop Slide #1 -5

Trust and Assumptions • Underlie all aspects of security • Policies – Unambiguously partition

Trust and Assumptions • Underlie all aspects of security • Policies – Unambiguously partition system states – Correctly capture security requirements • Mechanisms – Assumed to enforce policy – Support mechanisms work correctly September 10, 2012 Introduction to Computer Security © 2004 Matt Bishop Slide #1 -6

Types of Mechanisms secure precise set of reachable states September 10, 2012 Introduction to

Types of Mechanisms secure precise set of reachable states September 10, 2012 Introduction to Computer Security © 2004 Matt Bishop broad set of secure states Slide #1 -7

Assurance • Specification – Requirements analysis – Statement of desired functionality • Design –

Assurance • Specification – Requirements analysis – Statement of desired functionality • Design – How system will meet specification • Implementation – Programs/systems that carry out design September 10, 2012 Introduction to Computer Security © 2004 Matt Bishop Slide #1 -8

Operational Issues • Cost-Benefit Analysis – Is it cheaper to prevent or recover? •

Operational Issues • Cost-Benefit Analysis – Is it cheaper to prevent or recover? • Risk Analysis – Should we protect something? – How much should we protect this thing? • Laws and Customs – Are desired security measures illegal? – Will people do them? September 10, 2012 Introduction to Computer Security © 2004 Matt Bishop Slide #1 -9

Human Issues • Organizational Problems – Power and responsibility – Financial benefits • People

Human Issues • Organizational Problems – Power and responsibility – Financial benefits • People problems – Outsiders and insiders – Social engineering September 10, 2012 Introduction to Computer Security © 2004 Matt Bishop Slide #1 -10

Tying Together Threats Policy Specification Design Implementation Operation September 10, 2012 Introduction to Computer

Tying Together Threats Policy Specification Design Implementation Operation September 10, 2012 Introduction to Computer Security © 2004 Matt Bishop Slide #1 -11

Key Points • Policy defines security, and mechanisms enforce security – Confidentiality – Integrity

Key Points • Policy defines security, and mechanisms enforce security – Confidentiality – Integrity – Availability • Trust and knowing assumptions • Importance of assurance • The human factor September 10, 2012 Introduction to Computer Security © 2004 Matt Bishop Slide #1 -12

ATTACK AND THREATS THREATS AND ATTACK THREATS ThreatsATTACK AND THREATS THREATS AND ATTACK THREATS Threats
NETWORK SECURITY THREATS NETWORK SECURITY THREATS In computerNETWORK SECURITY THREATS NETWORK SECURITY THREATS In computer
Session Agenda Threats Types of threats Threats againstSession Agenda Threats Types of threats Threats against
Chapter 1 Introduction Components of computer security ThreatsChapter 1 Introduction Components of computer security Threats
Chapter 1 Introduction Components of computer security ThreatsChapter 1 Introduction Components of computer security Threats
Chapter 1 Introduction Components of computer security ThreatsChapter 1 Introduction Components of computer security Threats
Chapter 1 Introduction Components of computer security ThreatsChapter 1 Introduction Components of computer security Threats
Chapter 1 Introduction Components of computer security ThreatsChapter 1 Introduction Components of computer security Threats
Internet security threats Countermeasures Internet security threats MappingInternet security threats Countermeasures Internet security threats Mapping
Introduction Components of computer security Threats Policies andIntroduction Components of computer security Threats Policies and
Introduction Components of computer security Threats Policies MechanismsIntroduction Components of computer security Threats Policies Mechanisms