Chapter 1 Security Problems in Computing csci 5233

Chapter 1 Security Problems in Computing csci 5233 computer security & integrity

Status of security in computing In terms of security, computing is very close to the wild west days. n Some computing professionals & managers do not even recognize the value of the resources they use or control. n In the event of a computing crime, some companies do not investigate or prosecute. n csci 5233 computer security & integrity 2

Characteristics of Computer Intrusion A computing system: a collection of hardware, software, data, and people that an organization uses to do computing tasks n Any piece of the computing system can become the target of a computing crime. n The weakest point is the most serious vulnerability. n The principles of easiest penetration (p. 3) n csci 5233 computer security & integrity 3

Security Breaches - Terminology (p. 3) n Exposure – a form of possible loss or harm n Vulnerability – a weakness in the system Attack n Threats n – Human attacks, natural disasters, errors n Control – a protective measure n Assets – h/w, s/w, data csci 5233 computer security & integrity 4

Types of Security Breaches n Interruption – Example: DOS (Denial of Service) n Interception – Peeping eyes n Modification – Change of existing data n Fabrication – Addition of false or spurious data csci 5233 computer security & integrity 5

Security Goals n Confidentiality – The assets are accessible only by authorized parties. n Integrity – The assets are modified only by authorized parties, and only in authorized ways. n Availability – Assets are accessible to authorized parties. n See Fig. 1 -2 (p. 5) csci 5233 computer security & integrity 6

Computing System Vulnerabilities n See Fig. 1 -3 (p. 7) n Hardware vulnerabilities n Software vulnerabilities n Data vulnerabilities n Human vulnerabilities ? csci 5233 computer security & integrity 7

Software Vulnerabilities n Destroyed (deleted) software n Stolen (pirated) software n Altered (but still run) software – Logic bomb – Trojan horse – Virus – Trapdoor – Information leaks csci 5233 computer security & integrity 8

Data Security n The principle of adequate protection (p. 9) n Fig. 1 -4 (p. 10) – Confidentiality: preventing unauthorized access – Integrity: preventing unauthorized modification (e. g. , salami attack) – Availability: preventing denial of authorized access csci 5233 computer security & integrity 9

Other Exposed Assets n Storage media n Networks n Access n Key people csci 5233 computer security & integrity 10

People Involved in Computer Crimes n Amateurs n Crackers n Career Criminals csci 5233 computer security & integrity 11

Methods of Defense n Encryption n Software controls n Hardware controls n Policies n Physical controls csci 5233 computer security & integrity 12

Encryption n at the heart of all security methods n Confidentiality of data n Some protocols rely on encryption to ensure availability of resources. n Encryption does not solve all computer security problems. csci 5233 computer security & integrity 13

Software controls n Internal program controls n OS controls n Development controls n Software controls are usually the 1 st aspects of computer security that come to mind. csci 5233 computer security & integrity 14

Policies n Policy controls can be simple but effective – Example: frequent changes of passwords n Legal and ethical controls – Gradually evolving and maturing csci 5233 computer security & integrity 15

Principle of Effectiveness n Controls must be used to be effective. – Efficient • Time, memory space, human activity, … – Easy to use – appropriate csci 5233 computer security & integrity 16

Overlapping Controls n Fig. 1 -5 (p. 16) n Several different controls may apply to one potential exposure. – H/w control – S/w control – Data control csci 5233 computer security & integrity 17

Next chapter n Ch 2: Encryption and Decryption csci 5233 computer security & integrity 18