CYBER.pdf

(1)

qwertyuiopasdfghjklzxcvbnmqwertyui

opasdfghjklzxcvbnmqwertyuiopasdfgh

jklzxcvbnmqwertyuiopasdfghjklzxcvb

nmqwertyuiopasdfghjklzxcvbnmqwer

tyuiopasdfghjklzxcvbnmqwertyuiopas

dfghjklzxcvbnmqwertyuiopasdfghjklzx

cvbnmqwertyuiopasdfghjklzxcvbnmq

wertyuiopasdfghjklzxcvbnmqwertyuio

pasdfghjklzxcvbnmqwertyuiopasdfghj

klzxcvbnmqwertyuiopasdfghjklzxcvbn

mqwertyuiopasdfghjklzxcvbnmqwerty

uiopasdfghjklzxcvbnmqwertyuiopasdf

ghjklzxcvbnmqwertyuiopasdfghjklzxc

vbnmqwertyuiopasdfghjklzxcvbnmrty

uiopasdfghjklzxcvbnmqwertyuiopasdf

CYBER SECURITY: NOTES

MBA/AUC-002

13/08/2015 13/08/2015 VARUN MODI VARUN MODI

(2)

UNIT -1

TOPIC 1: Information systems

Information systems

Information systems are the software and hardware are the software and hardware systemssystems that that support data-intensive applications.

support data-intensive applications.

Such a system may be as simple as a 3x5 card catalog system on a desk,

or a desktop calendar. Or, it may be as complicated as a multi-node

computer database system used to manage vast quantities of related

information.

TOPIC 2: Components

The six

components

that must come together in order to produce an that must come together in order to produce an

information system are:

1.

1. HardwareHardware: The term hardware refers to machinery. This category: The term hardware refers to machinery. This category

includes the computer itself, which is often referred to as the central

processing unit (CPU), and all of its support equipments. Among the

support equipments are input and output devices, storage devices

and communications devices.

2.

2. SoftwareSoftware: The term software refers to computer programs and the: The term software refers to computer programs and the

manuals (if any) that support them. Computer programs are

machine-readable instructions that direct the circuitry within the

hardware parts of the system to function in ways that produce useful

information from data. Programs are generally stored on some input /

output medium, often a disk or tape.

3.

3. DataData: Data are facts that are used by programs to produce useful: Data are facts that are used by programs to produce useful

information. Like programs, data are generally stored in

machine-readable form on disk or tape until the computer needs them.

(3)

4.

4. ProceduresProcedures: Procedures are the policies that govern the operation of: Procedures are the policies that govern the operation of

a computer system. "Procedures are to people what software is to

hardware" is a common analogy that is used to illustrate the role of

procedures in a system.

5.

5. PeoplePeople: Every system needs people if it is : Every system needs people if it is to be useful. Often theto be useful. Often the

most over-looked element of the system are the people, probably the

component that most influence the success or failure of information

systems. This includes "not only the users, but those who operate

and service the computers, those who maintain the data, and those

who support the network of computers." <Kroenke, D. M. (2015). MIS

Essentials. Pearson

Essentials. Pearson Education>Education>

6.

6. FeedbackFeedback: it is another component of the IS, that defines that an IS: it is another component of the IS, that defines that an IS

may be provided with a feedback (Although this component isn't

necessary to function).

(4)

TOPIC 3: Types of

TOPIC 3: Types of Information SystemsInformation Systems

There are various

t

ypes

of informa

t

ion s

ys

te

ms

, for example:, for example: 1. Transaction processing

1. Transaction processing systemssystems,, 2. Decision support

2. Decision support systemssystems,, 3. Knowledge management

3. Knowledge management systemssystems,, 4. Learning management

4. Learning management systemssystems,, 5. Database management

5. Database management systemssystems,, 6. Office

(5)

TOPIC 4: Developing an Information System

The steps involved in

de

vel

oping

a

n I

nform

a

t

ion S

ys

te

m

are: are: Analysis

Analysis: This is a very important part in the development of an: This is a very important part in the development of an

Information System and involves looking at an organization or system Information System and involves looking at an organization or system (such as a nursery school) and finding out how information is being (such as a nursery school) and finding out how information is being handled at the moment.

handled at the moment. Feasibility Study

Feasibility Study: The aim of a feasibility study is to see whether it is: The aim of a feasibility study is to see whether it is possible to develop a system at a reasonable cost. At the end of the possible to develop a system at a reasonable cost. At the end of the feasibility study a decision is taken whether to proceed or not.

feasibility study a decision is taken whether to proceed or not. A feasibility stud

A feasibility study contains y contains the general the general requiremenrequirements of the prts of the proposedoposed system.

system.

System Design

System Design: The areas that need to be considered in the design: The areas that need to be considered in the design process are listed below:

process are listed below: 1. Outputs 1. Outputs 2. Inputs 2. Inputs 3. File Design 3. File Design 4. Hardware 4. Hardware 5. Software 5. Software Testing

Testing: Any new system needs to be thoroughly tested before being: Any new system needs to be thoroughly tested before being introduced.

introduced.

First of all the system should be tested with normal data to see if it works First of all the system should be tested with normal data to see if it works correctly.

correctly.

Secondly, the system is tested with data containing known errors to try and Secondly, the system is tested with data containing known errors to try and make it fail

make it fail ('crash').('crash').

Thirdly, the system is tested with very large amounts of data to see how it Thirdly, the system is tested with very large amounts of data to see how it can cope.

can cope.

It is important that processing time and response rates remain acceptable It is important that processing time and response rates remain acceptable with varying amounts of data.

with varying amounts of data. Implementation

Implementation: Implementing or introducing a new system can be done: Implementing or introducing a new system can be done in two ways:

in two ways: Direct Direct ImplementaImplementationtion & & Parallel Running Parallel Running Documentation

(6)

The guide should cover how to run the system, how to enter data, how to The guide should cover how to run the system, how to enter data, how to modify data and how to save and print reports.

modify data and how to save and print reports.

The guide should include a list of error messages and advice on what to do The guide should include a list of error messages and advice on what to do if something goes wrong.

if something goes wrong.

TOPIC 5: Information security

Information security Information security Information security

Information security, sometimes shortened to InfoSec, is the practice of, sometimes shortened to InfoSec, is the practice of defending

defending informationinformation from unauthorized access, use, disclosure, from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. disruption, modification, perusal, inspection, recording or destruction. It is a general term that can be used regardless of the form the data may It is a general term that can be used regardless of the form the data may take (e.g. electronic, physical).

take (e.g. electronic, physical).

TOPIC 6:

Need of Information Security

Why do you need Information Security? Why do you need Information Security?

This is sometimes tough to answer because the answer seems obvious. This is sometimes tough to answer because the answer seems obvious. No?

No?

As we know, inf

As we know, information seormation security is all acurity is all about protecting bout protecting the confidentiathe confidentiality,lity, integrity and availability of

integrity and availability of informationinformation..

Answer these

Answer these questionsquestions:: Do you

Do you have information that needs to be kept confidential (secret)? have information that needs to be kept confidential (secret)?

Do you

(7)

If you answered yes to any of these questions, then you have a need for If you answered yes to any of these questions, then you have a need for information security.

information security.

We need information security to reduce the risk of unauthorized information We need information security to reduce the risk of unauthorized information disclosure, modification, and destruction.

disclosure, modification, and destruction.

We need information security to reduce risk to a level that is acceptable to We need information security to reduce risk to a level that is acceptable to the business (management).

the business (management).

We need information security to improve the way we do business. We need information security to improve the way we do business.

TOPIC 7: Threats to Information Systems

Threats to Information Systems: Threats to Information Systems:

On next page On next page

(8)

TOPIC 8: Information Assurance

Information assurance

Information assurance (IA) is the practice of assuring (IA) is the practice of assuring informationinformation and and managing risks related to the use, processing, storage, and transmission managing risks related to the use, processing, storage, and transmission of

of informationinformation or data and the systems and processes used for those or data and the systems and processes used for those purposes.

purposes.

The information assurance process typically begins with the enumeration

(9)

practitioner will perform a risk

practitioner will perform a risk assessment for those assets. Vulnerabilitiesassessment for those assets. Vulnerabilities

in the information assets are determined in order to enumerate the threats

capable of exploiting the assets. The

capable of exploiting the assets. The assessment then considers both theassessment then considers both the

probability and impact of a threat exploiting a vulnerability in an asset, with

impact usually measured in terms of cost to the asset's stakeholders. The

sum of the products of the threats' impact and the probability of their

occurring is the total risk to the

occurring is the total risk to the informatioinformation asset.n asset.

With the risk assessment complete, the IA practitioner then develops a risk

management plan. This plan proposes countermeasures that involve

mitigating, eliminating, accepting, or transferring the risks, and considers

prevention, detection, and response to threats. A framework published by a

standards organi

standards organization, such as Risk IT, zation, such as Risk IT, CobiT, PCI DSS orISO/IECCobiT, PCI DSS orISO/IEC

27002, may guide development. Countermeasures may include technical

tools such as firewalls and anti-virus software, policies and procedures

requiring such controls as regular backups and configuration hardening,

employee training in security awareness, or organizing personnel into

dedicated computer emergency response team (CERT) or computer

security incident response team (CSIRT). The cost and benefit of each

countermeasure is carefully considered. Thus, the IA practitioner does not

seek to eliminate all risks, were that possible, but to manage them in the

most cost-effective way.

After the risk

After the risk managemmanagement plan is impent plan is implemented, ilemented, it is tested at is tested and evaluatend evaluated,d,

often by means of formal audits.

TOPIC 9:

CYBER SECURITY

WHAT IS CYBER SECURITY?

Cyber security, also referred to as information technology security, focuses

on protecting computers, networks, programs and data from unintended or

(10)

WHY IS CYBER SECURITY IMPORTANT?

Governme

Governments, military, nts, military, corporationcorporations, financial s, financial institutioninstitutions, hospitals s, hospitals andand

other businesses collect, process and store a great deal of confidential

information on computers and transmit that data across networks to other

computers. With the growing volume and sophistication of cyber attacks,

ongoing attention is required to protect sensitive business and personal

information, as well as safeguard national security.

TOPIC 10: Security Risk Analysis

Security in any system should be commensurate with its risks. However,

the process to determine which security controls are appropriate and cost

effective, is quite often a complex and sometimes a subjective matter. One

of the prime functions of security risk analysis is to put this process onto a

more objective basis.

There are a number of distinct approaches to risk analysis. However, these

essentially break down into two types:

essentially break down into two types: quantitativquantitative and e and qualitativqualitative.e.

Quantitative Risk Analysis

This approach employs two fundamental elements; the probability of an

event occurring and the likely loss should it occur.

Quantitative risk analysis makes use of a single figure produced from these

elements. This is called the 'Annual Loss Expectancy (ALE)' or the

'Estimated Annual Cost (EAC)'.

This is calculated for an event by

This is calculated for an event by simply multiplyinsimply multiplying the potential loss bg the potential loss byy

the

the probabilityprobability..The problems with this type of risk analysis are usuallyThe problems with this type of risk analysis are usually

associated with the unreliability and inaccuracy of the data.

Probability can rarely be precise and can, in some cases, promote

complacency

complacency. In . In addition, controls and countermeasures often tackle addition, controls and countermeasures often tackle aa

number of potential events and the events themselves are frequently

interrelated.

(11)

Qualitative Risk Analysis

This is by far the most widely used approach to risk analysis. Probability

data is not required and only estimated potential loss is used.

Most qualitative risk analysis methodologies make use of a number of

interrelated elements:

THREATS

These are things that can go wrong or that can 'attack' the system.

Examples might include fire or fraud. Threats are ever present for every

system.

VULNERABILITIES

These make a system more prone to attack by a threat or make an attack

more likely to have some success or impact. For example, for fire a

vulnerability would be the presence of inflammable materials (e.g. paper).

CONTROLS

These are t

These are the countermeasurehe countermeasures for s for vulnerabilitiesvulnerabilities.There are .There are four types:four types:

Deterrent controls

Deterrent controls reduce the likelihood of a deliberate attack reduce the likelihood of a deliberate attack

Preventative controls

Preventative controls protect vulnerabilities and make an attack protect vulnerabilities and make an attack

unsuccessful or reduce its impact

Corrective controls

Corrective controls reduce the effect of an attack reduce the effect of an attack

Detective controls

Detective controls discover attacks and trigger preventative or corrective discover attacks and trigger preventative or corrective

controls.

(12)

UNIT -2

TOPIC 1: Application security

Application secu

Application security is the urity is the use of softwse of software, hardware, hardware, and prare, and proceduralocedural

methods to protect applications from external threats. Once an afterthought methods to protect applications from external threats. Once an afterthought in software design, security is becoming an increasingly important concern in software design, security is becoming an increasingly important concern during development as applications become more frequently accessible during development as applications become more frequently accessible over networks and are, as a result, vulnerable to a wide variety of threats. over networks and are, as a result, vulnerable to a wide variety of threats. Actions taken

Actions taken to ensure ato ensure application sepplication security are socurity are sometimes callemetimes calledd countermeasures

countermeasures..

The most basic software countermeasure is an application

The most basic software countermeasure is an application firewall firewall that that limits the execution of files or the handling of data by specific installed limits the execution of files or the handling of data by specific installed programs. The most common hardware countermeasure is a

programs. The most common hardware countermeasure is a router router that that can prevent the IP address of an individual computer from being directly can prevent the IP address of an individual computer from being directly visible on

visible on the Internet. Other countermeasures include conventionalthe Internet. Other countermeasures include conventional firewalls, encryption/decryption programs, anti-virus programs, spyware firewalls, encryption/decryption programs, anti-virus programs, spyware detection/removal programs and biometric authentication systems.

detection/removal programs and biometric authentication systems. Application secu

Application security can be rity can be enhanced enhanced by rigorously by rigorously defining enterdefining enterpriseprise assets, identifying what each application does (or will

assets, identifying what each application does (or will do) with respect todo) with respect to these assets, creating a security profile for each application, identifying and these assets, creating a security profile for each application, identifying and prioritizing potential threats and documenting adverse events and the

prioritizing potential threats and documenting adverse events and the actions taken in each case. This process is known as threat modeling. In actions taken in each case. This process is known as threat modeling. In this context, a threat is any potential or actual adverse event that can this context, a threat is any potential or actual adverse event that can compromise the assets of an enterprise, including both malicious events, compromise the assets of an enterprise, including both malicious events, such as a denial-of-service (DoS) attack, and unplanned events, such as such as a denial-of-service (DoS) attack, and unplanned events, such as the failure of a storage device.

(13)

TOPIC 2: Data Security Considerations

Backups

::

Enterprise level backups are becoming the fundamental way to safeguard Enterprise level backups are becoming the fundamental way to safeguard your data.

your data.

Gone are the days where you can have a tape drive hooked up to every Gone are the days where you can have a tape drive hooked up to every machine in order to back it up. Now you might have 1 server backing up 20, machine in order to back it up. Now you might have 1 server backing up 20, 50, 100 or more clients, some backup solutions even allow thousands of 50, 100 or more clients, some backup solutions even allow thousands of clients on a single server.

clients on a single server. The primary reason for this

The primary reason for this is centralization: of media, of administration, ofis centralization: of media, of administration, of access. It is much easier to change 100 tapes on 1 machine than it is to access. It is much easier to change 100 tapes on 1 machine than it is to change 1 tape on 100 machines. It is easier to collect data and spot change 1 tape on 100 machines. It is easier to collect data and spot problems from a central server than it is to monitor 100 machines. problems from a central server than it is to monitor 100 machines. Along with the

Along with the greater ease greater ease in managein management that Enterpment that Enterprise Level Bacrise Level Backupskups provide, comes a greater threat to security. Centralized service means

provide, comes a greater threat to security. Centralized service means centralized access.

centralized access.

If an intruder gains access to your backup server he gains access to the If an intruder gains access to your backup server he gains access to the collected data from all of that server clients. This is an important security collected data from all of that server clients. This is an important security risk, one that should be considered and planned for. Not every risk can be risk, one that should be considered and planned for. Not every risk can be accounted for, good computer security is always a compromise between accounted for, good computer security is always a compromise between usability and precautions. A good overview of the security risks of

usability and precautions. A good overview of the security risks of

Enterprise level backup can provide you with the groundwork needed to Enterprise level backup can provide you with the groundwork needed to make the decisions for your environment.

make the decisions for your environment.

S

S ec

ecur

ure

e dat

data

a di

diss pos

pos al

al methods

methods ::

Information systems store data on a wide variety of storage media, Information systems store data on a wide variety of storage media,

including: internal and external hard drives; internal solid-state memory, including: internal and external hard drives; internal solid-state memory, removable flash memory cards and flash drives; floppy, ZIP and other removable flash memory cards and flash drives; floppy, ZIP and other types of removable magnetic disks; tapes, cartridges and other linear types of removable magnetic disks; tapes, cartridges and other linear magnetic media; optical storage using CDs and DVDs; and paper. magnetic media; optical storage using CDs and DVDs; and paper.

(14)

To prevent unauthorized access, it is critical that data be rendered To prevent unauthorized access, it is critical that data be rendered

unreadable when it or the device on which it resides are no longer needed. unreadable when it or the device on which it resides are no longer needed. This is required by law (and common sense) for all computers and media This is required by law (and common sense) for all computers and media containing sensitive

containing sensitive informationinformation..

Note that different kinds of data storage media require different methods for Note that different kinds of data storage media require different methods for secure removal or

secure removal or destructidestruction, some on, some simple but simple but others complex. others complex. Do itDo it incorrectly and the data remains for prying eyes to discover.

incorrectly and the data remains for prying eyes to discover.

Proof that secure disposal is not easy comes from this simple fact: insecure Proof that secure disposal is not easy comes from this simple fact: insecure disposal is one of the most common causes of sensitive data being

disposal is one of the most common causes of sensitive data being compromised.

compromised. Not coincidentally, it is Not coincidentally, it is one of one of the most the most common methodscommon methods by which identity theft occurs.

by which identity theft occurs. What is really secure?

What is really secure?

For each storage medium there are more and less secure methods. For each storage medium there are more and less secure methods.

P

Pape

aper media

r media

Paper containing

Paper containing sensitive information should sensitive information should be be shredded. shredded. Every Every officeoffice (and home) should have access to a shredder or a secure shredding (and home) should have access to a shredder or a secure shredding service.

service. Shredders Shredders are are cheap. cheap. "Dumpster-d"Dumpster-diving" iving" for for data data is is common.common. Secure recycling containers are distributed around the medical campus for Secure recycling containers are distributed around the medical campus for just this reason

just this reason.. Alternatively

Alternatively, paper recor, paper records can be pds can be pulverized (ulverized (rendered inrendered into a powder to a powder byby grinding), macerated (rendered into pulp by chemicals) or incinerated grinding), macerated (rendered into pulp by chemicals) or incinerated (burned).

(burned). This This is is appropriate for appropriate for extremely sensitive extremely sensitive informationinformation..

E

E le

lectronic

ctronic me

media

dia

The appropriate "cleaning" method for electronic media depends on the The appropriate "cleaning" method for electronic media depends on the type.

type. The main The main division is between division is between "magnetic media" and "magnetic media" and "optical media.""optical media." Though both contain information in electronic form, the methods for secure Though both contain information in electronic form, the methods for secure disposal are very different.

(15)

Many people are under the impression that all they need to do is "delete" a Many people are under the impression that all they need to do is "delete" a file from

file from a computer's a computer's hard drive hard drive or other or other storage media. storage media. UnfortunatUnfortunately,ely, that's almost

that's almost never never sufficientsufficient. . In In most most cases,"delcases,"delete" simply ete" simply changeschanges

indexing information about a file, sort of like marking through the entry in a indexing information about a file, sort of like marking through the entry in a book's table of contents but leaving the pages behind.

book's table of contents but leaving the pages behind.

Emptying the "recycle bin" or the "trash" folder of deleted files is usually Emptying the "recycle bin" or the "trash" folder of deleted files is usually also ineffective.

also ineffective. These methods These methods remove the remove the pointers (indexes) to pointers (indexes) to thethe deleted files, but the data itself still remains on the storage media as deleted files, but the data itself still remains on the storage media as unallocated space.

unallocated space.

Even if the unallocated space is subsequently used by new files, there are Even if the unallocated space is subsequently used by new files, there are sophisticated scanning methods that could be used to recover data

sophisticated scanning methods that could be used to recover data previously stored in those locations.

previously stored in those locations.

Some un-rewritable media, like CD-Rs and DVD-Rs,

Some un-rewritable media, like CD-Rs and DVD-Rs, can't have theircan't have their contents deleted in

contents deleted in any case. any case. Inoperable media, like Inoperable media, like a crashed a crashed hard drive,hard drive, may be so corrupted that you cannot access it using normal computer

may be so corrupted that you cannot access it using normal computer

operations; but it still may have data on it that can be recovered by others. operations; but it still may have data on it that can be recovered by others.

Dema

Demagg net

netizi

izing

ng m

ma

agg net

netic

ic me

media

dia

Removable magnetic "disks" (floppies, ZIP disks, and the

Removable magnetic "disks" (floppies, ZIP disks, and the like) and linearlike) and linear magnetic media (tape reels, cartridges) can be "degaussed" -- that is, magnetic media (tape reels, cartridges) can be "degaussed" -- that is, demagnetize

demagnetized. d. An An appropriatelappropriately-sized y-sized and and -powered -powered "degausser" is"degausser" is required.

required.

For each particular type of magnetic storage and size of degausser there is For each particular type of magnetic storage and size of degausser there is a minimum erasing time.

a minimum erasing time. As with disposal

As with disposal of paper inof paper information, formation, there are there are trade-offs rathetrade-offs rather thanr than absolute standards for

absolute standards for "erasing" magnetic media. "erasing" magnetic media. The more The more powerful andpowerful and lengthy the degaussing process applied to any given type of storage media, lengthy the degaussing process applied to any given type of storage media, the less likely it is to be subsequent recovered by others.

the less likely it is to be subsequent recovered by others.

Note that degaussing can make the media inoperable, so this method is not Note that degaussing can make the media inoperable, so this method is not recommended if the media needs to be reused and/or has resale value. recommended if the media needs to be reused and/or has resale value.

(16)

Over-writing

Over-writing ma

magg net

netic

ic me

media

dia

"Fixed" internal magnetic storage, such as computer hard drives, as well as "Fixed" internal magnetic storage, such as computer hard drives, as well as external "mini" and "micro" hard drive storage, can be cleaned by software external "mini" and "micro" hard drive storage, can be cleaned by software that u

that uses ses an an over-writiover-writing ng or or "wiping" processes. "wiping" processes. USB USB "flash drive" "flash drive" devicesdevices and plug-in memories like CompactFlash, Memory Stick, Secure Digital, and plug-in memories like CompactFlash, Memory Stick, Secure Digital, and SmartMedia can also be cleaned in this way.

and SmartMedia can also be cleaned in this way. Special software is

Special software is used to used to over-write all the over-write all the usable storage usable storage locations. locations. TheThe simplest method is a

simplest method is a single over-write; additional security is provided bysingle over-write; additional security is provided by multiple over-writes with variations of all 0s, all 1s, complements (opposite multiple over-writes with variations of all 0s, all 1s, complements (opposite of recorded characters) and/or random characters so that recovery even by of recorded characters) and/or random characters so that recovery even by the most sophisticated methods becomes almost impossible.

the most sophisticated methods becomes almost impossible.

There are a few free public domain programs like DBAN that perform There are a few free public domain programs like DBAN that perform secure over-writes.

secure over-writes. There are There are also also many many commercial offerings.commercial offerings.

Mang

Mang lin

ling

g ma

magg netic

netic media

media

You can take a hammer or a high-speed drill to your hard drive, USB drive You can take a hammer or a high-speed drill to your hard drive, USB drive or other

or other device. device. Chances are Chances are excellent that you'll excellent that you'll render it inoperable inrender it inoperable in short order.

short order.

But be warned that recovery of data from physically mangled magnetic But be warned that recovery of data from physically mangled magnetic devices is still possib

devices is still possible. le. Physical destrPhysical destruction is generally uction is generally something thasomething thatt must be done by a trained person to be completely effective, particularly for must be done by a trained person to be completely effective, particularly for hard drives.

hard drives.

Floppy disks can be

Floppy disks can be broken open and broken open and the internal magnetic disk cut the internal magnetic disk cut up. up. AsAs with optical media (see next discussion), caution is required to avoid

with optical media (see next discussion), caution is required to avoid personal injury from flying plastic parts, etc., and it is still

personal injury from flying plastic parts, etc., and it is still theoreticallytheoretically possible to recover data even from a mangled disk.

possible to recover data even from a mangled disk.

Opti

Opticca

al med

l mediia

a

"Write-many" optical media (such as CD-RWs and DVD-RWs) can be "Write-many" optical media (such as CD-RWs and DVD-RWs) can be processed via an over-write method similar to that for magnetic media. processed via an over-write method similar to that for magnetic media. However, the vast majority of optical media in use are of the "write once" However, the vast majority of optical media in use are of the "write once"

(17)

written.

written. Because such mBecause such media are edia are optical rather than optical rather than magnetic, neither canmagnetic, neither can they be degaussed.

they be degaussed. So, as with paper, on

So, as with paper, only physical destructily physical destruction will do. on will do. Many higher-caMany higher-capacitypacity paper shredders are rated for CD/DVD destruction for exactly this reason. paper shredders are rated for CD/DVD destruction for exactly this reason. It's a good investment to upgrade to a shredder that is CD/DVD capable if It's a good investment to upgrade to a shredder that is CD/DVD capable if you regularly rely on optical media for your data storage.

you regularly rely on optical media for your data storage. As with magne

As with magnetic media, ytic media, you can perfoou can perform a physicarm a physical attack. l attack. Cutting a CCutting a CDD or DVD

or DVD with scissors is with scissors is an alternative if an alternative if you have you have only a only a few to few to do. do. ButBut note that cut-up discs have been successfully reassembled and read, so note that cut-up discs have been successfully reassembled and read, so cut them into multiple pieces and, ideally, dispose of the pieces

cut them into multiple pieces and, ideally, dispose of the pieces in differentin different trash receptacles.

trash receptacles.

Breaking discs in half with your hands can send dangerous shards of Breaking discs in half with your hands can send dangerous shards of plastic flying.

plastic flying. Burning discs Burning discs (or (or microwaving them) microwaving them) can can release release toxictoxic fumes.

fumes. Don't Don't ever ever do do this!this!

C

C om

omput

puter recycling

er recycling prog

prog ra

ram

mss

For a whole system, some manufacturers (like Dell and Apple), and many For a whole system, some manufacturers (like Dell and Apple), and many retailers of computer equipment, offer recycling programs that meet both retailers of computer equipment, offer recycling programs that meet both security and environmental concerns. These programs will process the security and environmental concerns. These programs will process the entire old system for disposal, including cleaning the hard drive and any entire old system for disposal, including cleaning the hard drive and any other storage media, when you trade it in as part of a new purchase. other storage media, when you trade it in as part of a new purchase.

A

A rrcchi

hival

val S

S torag

torag e:

e:

In computers, archival storage is storage for data that may not be actively In computers, archival storage is storage for data that may not be actively needed but is kept for possible future use or for record-keeping purposes. needed but is kept for possible future use or for record-keeping purposes. Archival storage

Archival storage is often provis often provided using the ided using the same system same system as that used as that used forfor backup storage. Typically, archival and backup storage can be retrieved backup storage. Typically, archival and backup storage can be retrieved using a restore process.

(18)

TOPIC 3:

Data Security Technology

Firewall

Firewall ::

A firewall is a

A firewall is a system designsystem designed to preved to prevent unauthorizeent unauthorized access to d access to or fromor from a private network. Firewalls can be implemented in both hardware and a private network. Firewalls can be implemented in both hardware and software, or a combination of both.

software, or a combination of both.

Firewalls are frequently used to prevent unauthorized Internet users from Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. accessing private networks connected to the Internet, especially intranets. All messages e

All messages entering or ntering or leaving the inleaving the intranet pass thtranet pass through the firrough the firewall,ewall, which examines each message and blocks those that do not meet the which examines each message and blocks those that do not meet the specified security criteria.

specified security criteria.

Hardware firewalls can be purchased as a stand-alone product but are also Hardware firewalls can be purchased as a stand-alone product but are also typically found in broadband routers, and should be considered an

typically found in broadband routers, and should be considered an

important part of your system and network set-up. Most hardware firewalls important part of your system and network set-up. Most hardware firewalls will have a minimum of four network ports to connect other computers, but will have a minimum of four network ports to connect other computers, but for larger networks, business

for larger networks, business networking firewall solutions are available.networking firewall solutions are available. Software firewalls are installed on your computer (like any software) and Software firewalls are installed on your computer (like any software) and you can customize it; allowing you some control over its function and you can customize it; allowing you some control over its function and protection features. A software firewall will protect your computer from protection features. A software firewall will protect your computer from outside attempts to control or gain access your computer.

outside attempts to control or gain access your computer.

VPN: VPN:

VPN or virtual private network, is a network that is constructed by using VPN or virtual private network, is a network that is constructed by using public wires

public wires —— usually the Internet usually the Internet —— to connect to a private network, such to connect to a private network, such as a company's internal network. There are a number of systems that

as a company's internal network. There are a number of systems that enable you to create networks using the Internet as the medium for enable you to create networks using the Internet as the medium for transporting data. These systems use encryption and other security transporting data. These systems use encryption and other security

mechanisms to ensure that only authorized users can access the network mechanisms to ensure that only authorized users can access the network and that the data cannot be intercepted.

and that the data cannot be intercepted. A VPN is designed

A VPN is designed to provideto provides a secure, ens a secure, encrypted tunnecrypted tunnel in which tol in which to

transmit the data between the remote user and the company network. The transmit the data between the remote user and the company network. The information transmitted between the two locations via the encrypted tunnel information transmitted between the two locations via the encrypted tunnel cannot be read by anyone else because the system contains several

(19)

elements to secure both the company's private network and the outside elements to secure both the company's private network and the outside network through which the remote user connects through.

network through which the remote user connects through.

Intrusion detection (ID): Intrusion detection (ID):

It is a type of security management system for computers and networks. An It is a type of security management system for computers and networks. An ID system gathers and analyzes information from various areas within a ID system gathers and analyzes information from various areas within a computer or a network to identify possible security breaches, which include computer or a network to identify possible security breaches, which include both intrusions (attacks from outside the organization) and misuse (attacks both intrusions (attacks from outside the organization) and misuse (attacks from within the organization).

from within the organization).

ID uses vulnerability assessment (sometimes refered to as scanning), ID uses vulnerability assessment (sometimes refered to as scanning), which is a technology developed to assess the security of a computer which is a technology developed to assess the security of a computer system or network.

system or network.

Intrusion detection functions include: Intrusion detection functions include: Monitoring and analyzing

Monitoring and analyzing both user and system activities both user and system activities Analyzing sy

Analyzing system configurastem configurationstions and and vulnerabilitievulnerabilitiess Assessing sy

Assessing systemstem and file and file integrityintegrity Ability to

Ability to recognize patternsrecognize patterns typical of attacks typical of attacks Analysis of a

Analysis of abnormal abnormal activity ctivity patterns patterns Tracking

Tracking user policy violations user policy violations

Access Contr

Access Control:ol:

It is the

It is the selective restriction of access to a place or otherselective restriction of access to a place or other resourceresource. The act. The act

of

of accessing accessing may mean consuming, entering, or using. Permission to may mean consuming, entering, or using. Permission to

access a resource is called

access a resource is called authorizationauthorization..

When a credential is presented to a reader, the reader sends the When a credential is presented to a reader, the reader sends the

credential’s information, usually a number, to a control panel, a highly credential’s information, usually a number, to a control panel, a highly reliable processor.

reliable processor.

The control panel compares the credential's number to an access control The control panel compares the credential's number to an access control list, grants or denies the presented request, and sends a transaction log to list, grants or denies the presented request, and sends a transaction log to a database. When access is denied based on the access control list, the a database. When access is denied based on the access control list, the door remains locked. If there is a match between the credential and the door remains locked. If there is a match between the credential and the access control list, the control panel operates a relay that in turn unlocks access control list, the control panel operates a relay that in turn unlocks

(20)

The control panel also ignores a door open signal to prevent an alarm. The control panel also ignores a door open signal to prevent an alarm. Often the reader provides feedback, such as a flashing red LED for an Often the reader provides feedback, such as a flashing red LED for an access denied and a flashing green LED for an access granted.

access denied and a flashing green LED for an access granted.

There are three types (factors) of authenticating information:



 something the user knows, e.g. a password, pass-phrase or PINsomething the user knows, e.g. a password, pass-phrase or PIN 

 something the user has, such as smart card or a key fobsomething the user has, such as smart card or a key fob 

 something the user is, such as fingerprint, verified by biometric measurementsomething the user is, such as fingerprint, verified by biometric measurement

TOPIC 4:

Security Threats

Computer security threats are relentlessly inventive. Masters of disguise Computer security threats are relentlessly inventive. Masters of disguise and manipulation, these threats constantly evolve to find new ways to and manipulation, these threats constantly evolve to find new ways to annoy, steal and harm. Arm yourself with information and resources to annoy, steal and harm. Arm yourself with information and resources to

safeguard against complex and growing computer security threats and stay safeguard against complex and growing computer security threats and stay safe online.

safe online.

Computer Virus Threats Computer Virus Threats

Perhaps the most well known computer security threat, a computer virus is Perhaps the most well known computer security threat, a computer virus is a program written to alter the way a computer operates, without the

a program written to alter the way a computer operates, without the

permission or knowledge of the user. A virus replicates and executes itself, permission or knowledge of the user. A virus replicates and executes itself, usually doing damage to your computer in the process. Learn how to

usually doing damage to your computer in the process. Learn how to combat computer virus threats and stay safe

(21)

Spyware Threats Spyware Threats A serious com

A serious computer securputer security threat, ity threat, spyware is any spyware is any program thprogram that monitorat monitorss your online activities or installs programs without your consent for profit or your online activities or installs programs without your consent for profit or to capture personal information. We’ve amassed a wealth of knowledge to capture personal information. We’ve amassed a wealth of knowledge that will help you combat spyware threats and stay safe online.

that will help you combat spyware threats and stay safe online.

Hackers & Predators Hackers & Predators

People, not computers, create computer security threats

People, not computers, create computer security threats and malware.and malware. Hackers and predators are programmers who victimize others for their own Hackers and predators are programmers who victimize others for their own gain by breaking into computer systems to steal, change or destroy

gain by breaking into computer systems to steal, change or destroy

information as a form of cyber-terrorism. What scams are they using lately? information as a form of cyber-terrorism. What scams are they using lately? Learn how to combat dangerous malware and stay safe online.

Learn how to combat dangerous malware and stay safe online.

Phishing Threats Phishing Threats

Masquerading as a trustworthy person or business, phishers attempt to Masquerading as a trustworthy person or business, phishers attempt to steal sensitive financial or personal information through fraudulent email or steal sensitive financial or personal information through fraudulent email or instant messages. How can you tell the difference between a legitimate instant messages. How can you tell the difference between a legitimate message and a phishing scam? Educate yourself on the latest tricks and message and a phishing scam? Educate yourself on the latest tricks and scams.

scams.

Trojan Horse Trojan Horse

Trojan, in computing is any malicious computer program which Trojan, in computing is any malicious computer program which

misrepresents itself as useful, routine, or interesting in order to persuade a misrepresents itself as useful, routine, or interesting in order to persuade a

(22)

Logic Bombs

Logic bombs are small programs or sections of a program triggered by

some event such as a certain date or time, a certain percentage of disk

space filled, the removal of a file, and so on.

For example, a programmer could establish a logic bomb to delete critical

sections of code if she is terminated from the company. Logic bombs are

most commonly installed by insiders with access to the system.

Trap doors

Trap doors, also referred to as

Trap doors, also referred to as backdoorsbackdoors, are bits of code embedded in, are bits of code embedded in

programs by the programmer(s) to quickly gain access at a later time, often

during the testing or debugging phase.

If an unscrupulous programmer purposely leaves this code in or simply

forgets to remove it, a potential security hole is introduced. Hackers often

plant a backdoor on previously compromised systems to gain later access.

Trap doors can be almost impossible to remove in a reliable manner.

Often, reformatting the system is the only sure way.

E-Mail Virus E-Mail Virus An e-mail vir

An e-mail virus is computeus is computer code senr code sent to you as ant to you as an e-mail e-mail note attachmentnote attachment which, if activated, will cause some unexpected and usually harmful effect, which, if activated, will cause some unexpected and usually harmful effect, such as destroying certain files on your hard disk and causing the

such as destroying certain files on your hard disk and causing the attachment to be remailed to everyone in your address book.

(23)

known and undoubtedly cause the greatest loss of time and money overall. known and undoubtedly cause the greatest loss of time and money overall. The best two defenses against e-mail viruses for the individual user are: The best two defenses against e-mail viruses for the individual user are: (1) a policy of never opening (for example, double-clicking on) an e-mail (1) a policy of never opening (for example, double-clicking on) an e-mail attachment unless you know who sent it and what the attachment contains, attachment unless you know who sent it and what the attachment contains, and

and

(2) installing and using anti-virus software to scan any attachment before (2) installing and using anti-virus software to scan any attachment before you open it.

you open it.

Macro Virus Macro Virus A macro viru

A macro virus is a compus is a computer virus thater virus that "infects" a t "infects" a Microsoft WoMicrosoft Word or similard or similarr application and causes a sequence of actions to be performed

application and causes a sequence of actions to be performed

automatically when the application is started or something else triggers it. automatically when the application is started or something else triggers it. Macro viruses tend to be surprising but relatively harmless.

Macro viruses tend to be surprising but relatively harmless. A typical effe

A typical effect is the undect is the undesired insersired insertion of some tion of some comic texcomic text at certaint at certain points when writing a line.

points when writing a line. A macro viru

A macro virus is often sprs is often spread as an e-ead as an e-mail virus. A wmail virus. A well-known exell-known example inample in March, 1999 was the Melissa virus virus.

March, 1999 was the Melissa virus virus.

Worm Worm

A computer w

A computer worm is a stanorm is a standalone madalone malware complware computer progruter program thatam that replicates itself in order to spread to other computers. Often, it uses a replicates itself in order to spread to other computers. Often, it uses a

computer network to spread itself, relying on security failures on the target computer network to spread itself, relying on security failures on the target computer to access it.

computer to access it.

Unlike a computer virus, it does not need to attach itself to an existing Unlike a computer virus, it does not need to attach itself to an existing

(24)

even if only by consuming bandwidth, whereas viruses almost always even if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.

corrupt or modify files on a targeted computer.

Denial of Service (DoS) Denial of Service (DoS) A denial of ser

A denial of service (DoS) avice (DoS) attack is an inttack is an incident in which cident in which a user ora user or

organization is deprived of the services of a resource they would normally organization is deprived of the services of a resource they would normally expect to have. In a distributed denial-of-service, large numbers of

expect to have. In a distributed denial-of-service, large numbers of

compromised systems (sometimes called a botnet) attack a single target. compromised systems (sometimes called a botnet) attack a single target. Although a Do

Although a DoS attack doeS attack does not usualls not usually result in the y result in the theft of infortheft of information ormation or other security loss, it can cost the target person or company a great deal of other security loss, it can cost the target person or company a great deal of time and money. Typically, the loss of service is the

time and money. Typically, the loss of service is the inability of a particularinability of a particular network service, such as e-mail, to be available or the temporary loss of all network service, such as e-mail, to be available or the temporary loss of all network connectivity and services. A denial of service attack can also

network connectivity and services. A denial of service attack can also destroy programming and files in affected computer systems. In some destroy programming and files in affected computer systems. In some cases, DoS attacks have forced Web sites accessed by millions of people cases, DoS attacks have forced Web sites accessed by millions of people to temporarily cease operation.

to temporarily cease operation. A few of the b

A few of the better-knowetter-known attacks basen attacks based on the bud on the buffer characffer characteristics of ateristics of a program or system include:

program or system include: 1.

1. Sending e-mail messages Sending e-mail messages that have that have attachments with 256-characterattachments with 256-character file names to Netscape and Microsoft mail programs

file names to Netscape and Microsoft mail programs 2.

2. Sending oversized Internet Control Sending oversized Internet Control Message Protocol (ICMP) Message Protocol (ICMP) packetspackets (this is also known as the Packet Internet or Inter-Network Groper (this is also known as the Packet Internet or Inter-Network Groper (PING) of death)

(PING) of death) 3.

3. Sending to a user of the Sending to a user of the Pine e-mail program a message with aPine e-mail program a message with a "From" address larger than 256 characters

(25)

TOPIC 5: Threats to E-Com-

TOPIC 5: Threats to E-Com- Electronic Payment System

Electronic Payment System

E-commerce security is the protection of e-commerce assets from

E-commerce security is the protection of e-commerce assets from unauthorized access, use, alteration, or destruction.

unauthorized access, use, alteration, or destruction. 6 dimensions of e-commerce security:

6 dimensions of e-commerce security: 1.

1. Integrity: Integrity: prevention prevention against against unauthorized unauthorized data data modificatiomodificationn 2.

2. NonrepudiatiNonrepudiation: on: prevention prevention against against any any one one party party from from reneging reneging on on anan agreement after the fact

agreement after the fact 3.

3. AuthenticityAuthenticity: : authenticatioauthentication n of of data data sourcesource 4.

4. ConfidentialityConfidentiality: : protection protection against against unauthorized unauthorized data data disclosuredisclosure 5.

5. Privacy: Privacy: provision provision of of data data control control and and disclosuredisclosure 6.

6. Availability: Availability: preventioprevention n against against data data delays delays or or removalremoval E-COMMERCE THREATS

E-COMMERCE THREATS

Threats: anyone with the capability, technology, opportunity, and intent to Threats: anyone with the capability, technology, opportunity, and intent to do harm.Potential threats can be foreign or domestic, internal or external, do harm.Potential threats can be foreign or domestic, internal or external, state-sponsored or a single rogue element.Terrorists, insiders, disgruntled state-sponsored or a single rogue element.Terrorists, insiders, disgruntled employees, and hackers are included in this profile (President's

employees, and hackers are included in this profile (President's Commission on Critical

Commission on Critical InfrastrucInfrastructure Protection)ture Protection)

Concern

Concern 20012001 20002000

Loss

Loss of of Privacy/confidentiality, Privacy/confidentiality, data data misuse/abuse misuse/abuse 28% 28% 25%25% Cracking,

Cracking, eavesdropping, eavesdropping, spoofing, spoofing, rootkits rootkits 25% 25% 20%20% Viruses,

Viruses, Trojans, Trojans, worms, worms, hostile hostile ActiveX ActiveX and and Java Java 21% 21% 26%26% System

System unavailability, unavailability, denial denial of of service, service, natural natural disasters, disasters, power power interruptions interruptions 18% 18% 20%20%

Di

Di gg ita

ital

l S

S ig

ig na

natture

ure

A digital signa

A digital signature (not to ture (not to be confusebe confused with a digid with a digital certificatetal certificate) is a) is a mathematical technique used to validate the authenticity and integrity mathematical technique used to validate the authenticity and integrity

(26)

The digital equivalent of a handwritten signature or stamped seal, but The digital equivalent of a handwritten signature or stamped seal, but offering far more inherent security, a digital signature is intended to offering far more inherent security, a digital signature is intended to solve the problem of tampering and impersonation in digital

solve the problem of tampering and impersonation in digital communications. Digital signatures can provide the added communications. Digital signatures can provide the added

assurances of evidence to origin, identity and status of an electronic assurances of evidence to origin, identity and status of an electronic document, transaction or message, as well as acknowledging

document, transaction or message, as well as acknowledging informed consent by the signer.

informed consent by the signer.

In many countries, including the United States, digital signatures have the In many countries, including the United States, digital signatures have the same legal significance as the more traditional forms of signed documents. same legal significance as the more traditional forms of signed documents. The United

The United States Government Printing Office publishes electronic versionsStates Government Printing Office publishes electronic versions of the budget, public and private laws, and congressional bills with digital of the budget, public and private laws, and congressional bills with digital signatures.

signatures.

P

ubl

ic

-key c

rypto

g

ra

ph

y:

Public-key cryptography

Public-key cryptography, also known as, also known as asymmetric cryptographyasymmetric cryptography, is a, is a

class of

class of cryptographic protocolscryptographic protocols based on based on algorithmsalgorithms that require two that require two

separate

separate keyskeys, one of which is, one of which is secret secret (or (or private private) and one of which) and one of which

is

is public public . Although different, the two parts of this key pair are. Although different, the two parts of this key pair are

mathematically linked. The public key is used, for example,

to

to encryptencrypt plaintextplaintext or to verify a or to verify a digital signaturedigital signature; whereas the private key; whereas the private key

is used for the opposite operation, in these examples to decrypt

is used for the opposite operation, in these examples to decrypt cipher textcipher text or to create a

or to create a digital signature.digital signature.

The term "asymmetric" stems from the use of different keys to perform

these opposite functions, each the inverse of the other

these opposite functions, each the inverse of the other – – as contrasted with as contrasted with

conventional ("symmetric") cryptography which relies on the same key to

perform both.

(27)

(28)

UNIT

_–

3

3 TOPIC 1: Developing Secure Information Systems

TOPIC 1: Developing Secure Information Systems

Initiation Phase

Initiation Phase: During the : During the initiation phase, the organization establisheinitiation phase, the organization establishess the need for a system and documents its purpose. Security planning should the need for a system and documents its purpose. Security planning should