Cfs 105 Digital Security Chapter 1 Introduction 2193

1

SECURITY IN COMPUTING, FIFTH EDITION Chapter 1: Introduction

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

2

Objectives for Chapter 1 • Define computer security as well as basic computer • • • •

security Introduce the C-I-A Triad Introduce basic access control terminology Explain basic threats, vulnerabilities, and attacks Show how controls map to threats

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

3

What Is Computer Security? • The protection of the assets of a computer

system • Hardware • Software • Data

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

4

Assets

Hardware: • Computer • Devices (disk drives, memory, printer) • Network gear

Software: • Operating system • Utilities (antivirus) • Commercial applications (word processing, photo editing) • Individual applications

Data: • Documents • Photos • Music, videos • Email • Class projects

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

5

Values of Assets

Off the shelf; easily replaceable Hardware: • Computer • Devices (disk drives, memory, printer) • Network gear

Software: • Operating system • Utilities (antivirus) • Commercial applications (word processing, photo editing) • Individual applications

Data: • Documents • Photos • Music, videos • Email • Class projects Unique; irreplaceable

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

6

Basic • Vulnerability • Threat • Attack • Countermeasure or control

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

7

Threat and Vulnerability

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

8

C-I-A Triad • Confidentiality • Integrity • Availability • Sometimes two other desirable characteristics: • Authentication • Nonrepudiation

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

9

Access Control Policy: Who  What  How  Yes/No

Subject (who)

Mode of access (how)

Object (what)

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

10

Types of Threats Threats Human causes

Natural causes

Examples: Fire, power failure

Benign intent

Malicious intent

Example: Human error Random Example: Malicious code on a general web site

Directed Example: Impersonation

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

11

Advanced Persistent Threat (APT) • Organized • Directed • Well financed • Patient • Silent

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

12

Types of Attackers Terrorist

Hacker

Criminalfor-hire

Individual

Loosely connected group Organized crime member

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

13

Types of Harm

Interception

Interruption

Modification

Fabrication

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

14

Method—Opportunity--Motive Opportunity

Motive

Method

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

15

Controls/Countermeasures Kind of Threat

Physical

Integrity

Technical

Protects

Procedural

Confidentiality

Availability

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

16

Different Types of Controls

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.

17

Summary • Vulnerabilities are weaknesses in a system; threats

exploit those weaknesses; controls protect those weaknesses from exploitation • Confidentiality, integrity, and availability are the three basic security primitives • Different attackers pose different kinds of threats based on their capabilities and motivations • Different controls address different threats; controls come in many flavors and can exist at various points in the system

From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson Education, Inc. All rights reserved.