Welcome to
Information Systems Security
(503009)
Nguyen Thi Ai Thao
Faculty of Computer Science & Engineering
HCMC University of Technology
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 2
Course Outline
2
Week
Lectures
1
Information systems security: basic concepts
2,3
Basic cryptography & key exchange protocols
4
Identification & Authentication
5,6
Discretionary Access Controls
7,8
Mandatory Access Controls
9
Auditing & Accountability
10, 11,
12, 13,
14
Presentations
15
Revision
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 3
References
[1] M. Gertz, S. Jajodia (2008). Handbook of Database
Security: Applications and Trends, Springer Verlag, ISBN
978-0-387-48532-4.
[2] S. Castano, M. Fugini, G. Martella, and P. Samarati
(1995). Database Security, ACM Press &
Addison-Wesley, ISBN 0-201-59375-0.
[3] D.C. Knox (2004). Effective Oracle Database 10g
Security by Design, Oracle Press, ISBN 0-07-223130-0.
[4] T.R. Peltier, J. Peltier, J. Blackley (2005). Information
Security Fundamentals, Auerbach Publications, ISBN
0-8493-1957-9.
[5] W. Mao (2003). Modern Cryptography: Theory and
Practice, 3
rd
Ed., Prentice Hall, ISBN 0-13-066943-1.
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 4
Course Outline - Details
Week
Lectures
References
1
1. Introduction
1.1 Basic concepts
1.2 Picture of DB security
1.3 Framework for DB & Applications security
[1,2,3,4,5]
2
2. Basic cryptography & key exchange protocols
2.1 Cryptography-related concepts
2.2 Key channel
2.3 Perfect encryption
[4,5]
3
2. Basic cryptography & key exchange protocols
2.4 Dolev-Yao threat model
2.5 Protocols
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 5
Course Outline - Details
Week
Lectures
References
4
3. Identification & Authentication
3.1 Introduction
3.2 Identification techniques
3.3 Authentication techniques
3.2 Authentication protocols
[2,3,4]
5
3. Discretionary Access Controls
3.1 Introduction to DAC
3.2 Models for DAC
[2,3,4]
6
3. Discretionary Access Controls
3.3 SQL for Data Control
3.4 DAC & Information Flow Controls
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 6
Course Outline - Details
Week
Lectures
References
7
4. Mandatory Access Control
4.1 Introduction to MAC
4.2 Models for MAC
[2,3,4]
8
4. Mandatory Access Control
4.3 Case study: Oracle Label Security
[2,3,4]
9
5. Auditing & Accountability
5.1 Introduction to Auditing & Accountability
5.2 Techniques to Auditing
5.3 Case study: Auditing in Oracle
[2,3]
10,
11,
12,
13,
14
Presentation
Tbc.
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 7
Assessments
Credits: 3
No mid-term test
Open-book exams
7
Assessment Pattern
%
Presentation 1
15
Presentation 2
15
Assignment
20
Final Examination
50
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 8
Presentation
Group of 2-3 students
Presentation topics:
http://cse.hcmut.edu.vn/~thaonguyen >> Teaching
Register for the presentations:
Send to
[email protected]
Deadline: February 3
rd
, 2015
Chapter 1:
Introduction to
Information Systems Security
Nguyen Thi Ai Thao
Faculty of Computer Science & Engineering
HCMC University of Technology
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 10
Outline
Picture of DB Security
2
Framework for DB & Applications Security
3
Basic concepts
1
Basic concepts
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 11
Basic Concepts
Data and Information
Information System
Information Security
Information System Security Requirements
Countermeasures
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 12
Basic Concepts - Information Systems Security
Data are plain facts. When data are processed, organized,
structured or presented in a given context so as to make them
useful, they are called Information.
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 13
Basic Concepts - Information Systems Security
Information System refers to a system of people, data
records and activities that process the data and information
in an organization.
Data
Process
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 14
Basic Concepts - Information Systems Security
Information Security means protecting information and
information systems from unauthorized access, use,
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 15
Basic Concepts - Security Requirements
Information System Security Requirements :
Confidentiality
Non-repudiation
Availability
Integrity
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 16
Basic Concepts - Security Requirements
Information System Security Requirements:
Confidentiality: Protection of data from unauthorized
disclosure
Example: In a bank system, preventing a client from finding
out the information of another client, such as balance.
Integrity: Only authorized users should be allowed to modify
data.
Example: In a bank system, preventing a client from changing
his or her balance.
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 17
Basic Concepts - Security Requirements
Information System Security Requirements:
Availability: Making data available to the authorized users
and application programs
Example: In a bank system, ensuring that the invoices are
printed on time as required by law.
Non-repudiation: The ability to prevent the effective denial
of an act.
Example: In a bank system, providing proof of the origin and
delivery of transactions from a client.
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 18
Basic Concepts - Countermeasures
Countermeasures ensures these security requirements for
information systems. There are some countermeasures:
Access control
Inference control
Flow control
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 19
Basic Concepts - Access Control
Access Control: The security mechanism for restricting
access to the database as a whole
Handled by creating user accounts and passwords to control
login process by the Database Management System (DBMS).
Two types of access control system
Closed system
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 20
Basic Concepts – Closed System
Is there a rule
authorizing the
access?
Access request
Access permitted
Access denied
Rules:
authorized
accesses
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 21
Basic Concepts – Opened System
Access permitted
Access denied
Is there a rule
denying the
access?
Access request
Rules:
denied
accesses
Opened system
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 22
Basic Concepts - Inference control
Inference control: The security problem associated with
databases is that of controlling the access to a statistical
database, which is used to provide statistical information or
summaries of values based on various criteria.
The countermeasures to statistical database security problem
is called inference control measures.
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 23
Inference attack
Infer
Access control
Meta data
Non-sensitive
database
Sensitive
database
Access denied
Access permitted
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 24
Inference control
Access control
Meta data
Non-sensitive
database
Sensitive
database
Access denied
Access permitted
INFERENCE
CONTROL
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 25
Basic Concepts - Flow control
Flow control prevents information from flowing in such a
way that it reaches unauthorized users.
Channels that are pathways for information to flow
implicitly in ways that violate the security policy of an
organization are called Covert Channels.
Storage channel
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 26
Convert chanel – Timing Chanel
In Python:
def validate_password(actual_pw,
typed_pw):
if len(actual_pw) <> len(typed_pw):
return 0
for i in len(actual_pw):
if actual_pw[i] <> typed_pw[i]:
return 0
return 1
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 27
Basic Concepts - Encryption
Data encryption refers to mathematical calculations and
algorithmic schemes that transform
plaintext
into
cyphertext
,
a form that is non-readable to unauthorized parties.
Only the user having a correct key can decrypt the
cyphertext, transforming it to the original plaintext version.
Data encryption is used to protect sensitive data (such as
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 28
Basic Concepts
Basic Steps in Access control Process:
Identification
A user presents an identity to the database
Authentication:
The user proves that the identity is valid
Authorization:
What privileges and authorizations the user
has
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 29
Outline
Picture of DB Security
2
Framework for DB & Applications Security
3
Basic concepts
1
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 30
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 31
Các thành phần cần bảo vệ trong một HTTT
Identify &Authenticate
Access control
Auditing & Accountability
Encryption
Design
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 32
Các thành phần cần bảo vệ trong một HTTT
Encryption
Key exchange protocols
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 33
Các thành phần cần bảo vệ trong một HTTT
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 34
Các thành phần cần bảo vệ trong một HTTT
Training
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 38
Outline
Picture of DB Security
2
Framework for DB & Applications Security
3
Basic concepts
1
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 39
Framework for DB & Applications Security
Privacy, Dependable Information Management, Secure
Information Management Technologies, Data Mining and
Security, Digital Forensics, Secure Knowledge Management
Technologies, Secure Semantic Web, Biometrics
Relational DB Security, Distributed/Federated DB Security, Web
DB Security, Object/Multimedia DB Security, Data Warehouse
Security, Inference Problem, Sensor DB and Stream Data
Processing Security
Database Systems, Information Retrieval, Knowledge
Management, Information Management, Information & Computer
Security
Ho Chi Minh City University of Technology Faculty of Computer Science and Engineering © 2011
Information Systems Security Chapter 1: Introduction to Information Systems Security 40
