lec 1-IS

(1)

Information Security

(2)

Roadmap

• _Security?

• Security types

• Possible Security violation

• _{Key objectives of computer security} • _{OSI security architecture}

(3)

What is Security?

• _{“The quality or state of being secure—to be}

free from danger”

• _{A successful organization should have multiple}

layers of security in place:

– _{Physical security} – _{Personal security}

– _{Operations security}

– _{Communications security}

(4)

What is security?

• _{The protection of information and its}

critical elements, including systems and hardware that use, store, and transmit that information

• Necessary tools: policy, awareness,

(5)

Definitions

• _{Computer Security}_{- generic name for}

the collection of tools designed to protect data and to thwart hackers

• Network Security - measures to protect

data during their transmission over a network

• _{Internet Security}_{- measures to protect}

(6)

Information security:

• _{a “well-informed sense of assurance that}

(7)

Network and Internet security

• _{The field of} _{network and Internet}

(8)

Possible security violations:

• _{User A transmits a file to user B. The file}

(9)

…

•_{D transmits a message to computer E,}

instructing E to update an authorization

(10)

…

•_{User F constructs its own message and}

transmits to E as if coming from D

(11)

Key objectives of

computer Security

:

Three key objectives of computer security are:

• Confidentiality • Integrity

• Availability

Two additional most commonly mentioned security concepts :

(12)

Confidentiality:

This term covers two related concepts:

Data confidentiality:

Assures that private or confidential information is not made available or disclosed to unauthorized individuals.

Privacy:

(13)

Integrity

This term covers two related concepts:

Data integrity:

Assures that information and programs are changed only in a specified and authorized manner.

System integrity:

(14)

Availability

(15)

(16)

Authenticity:

• _{The property of being genuine and being}

able to be verified and trusted; confidence in the validity of a transmission, a message, or message originator.

• _{This means verifying that users are who}

(17)

Accountability

• _{The security goal that generates the}

requirement for actions of an entity to be traced uniquely to that entity. This supports nonrepudiation, deterrence, fault

isolation, intrusion detection and

(18)

OSI Security architecture

• _{ITU-T X.800 Security Architecture for OSI} local copy defines a systematic way of defining and providing security requirements provides a useful, although abstract, overview of network security concepts

• _{The OSI security architecture focuses on}

– _{security attack}

(19)

Security Attack

• _{any action that compromises the security of information}

owned by an organization

• _{information security is about how to prevent attacks, or}

failing that, to detect attacks on information-based systems

• _{have a wide range of attacks}

Threat Vs. Attack

• _Threat_{: a circumstance or scenario with the potential to}

exploit a vulnerability, and cause harm to a system.

(20)

Classify Security Attacks as

• _{passive attacks - eavesdropping on, or}

monitoring of, transmissions to:

– _{obtain message contents, or}

– _{monitor traffic flows}

• _{active attacks -modification of data stream to:}

– _{masquerade of one entity as some other}

– _{replay previous messages}

(21)

(22)

(23)

(24)

(25)

(26)

(27)

(28)

Security Service

– _{is something that enhances the security of the}

data processing systems and the information transfers of an organization

– intended to counter security attacks

– _{make use of one or more security mechanisms}

to provide the service

– replicate functions normally associated with

physical documents

• _{eg have signatures, dates; need protection}

(29)

Security Services

 X.800 defines it as:

A service provided by a protocol layer of

communicating open systems, which ensures adequate security of the systems or of data transfers

 RFC 2828 defines it as:

A processing or communication service provided by a system to give a specific kind of protection to system resources

(30)

Security Services (X.800)

• _{Authentication - assurance that the communicating entity is}

the one claimed

• _{Access Control - prevention of the unauthorized use of a}

resource

• _{Data Confidentiality –protection of data from unauthorized}

disclosure

• _{Data Integrity - assurance that data received is as sent by an}

authorized entity

• _{Non-Repudiation - protection against denial by one of the}

(31)

Security Mechanism

• _{A mechanism that is designed to detect, prevent,}

or recover from a security attack.

• _{Examples of mechanisms are encryption}

(32)

Security Mechanisms (X.800)

• _{specific security mechanisms:}

– _{encipherment, digital signatures, access}

controls, data integrity, authentication

exchange, traffic padding, routing control, notarization

• pervasive security mechanisms:

– _{trusted functionality, security labels, event}

(33)

Key information security concepts • Access • Asset • Attack • Control, safeguard / Countermeasure • Exploit • Exposure • Loss • Risk

• Subjects and

objects

• Threat

(34)

Security Policy

• _{At the least, a security policy is an}

informal description of desired systems behaviors.

• More usefully, a security policy is a formal

statement of rules and practices that specify or regulate how a system or

organization provides security services to protect sensitive and critical system

(35)

Factors needed to consider while developing a

Security Policy

(36)

Security

Implementation

Security implementation involves four complementary course of actions

(37)