CYBR 4820 Midterm

What is information assurance?

Measures that protect and defend information and information systems

What does information assurance include?

- integrity
- availability
- confidentiality
- authenticity
- non-repudiation

Why computer security?

Most online transactions involve using computers and database

is Technology a need or preference?

Need

What has attracted many network and database users to use them?

The progression in technology

What attracts intruders to seek destruction and monetary gain?

Information shared and stored about users

What was the old view of intruders?

some lonely hacker residing in the basement of his/her parent's home

What has the view of intruders transformed into?

a collection of hacking brigades professionally trained by the militaries of nations around the globe

Has computer security become an issue of global importance? True or False?

True

As networks become more sophisticated...

so do intruders

What does computer security rest on?

- confidentiality
- integrity
- availability

What is confidentiality?

The concealment(hiding) of information or resources

Where does the need for concealment occur?

in institutions with sensitive information
(e.g Government, industry)

Where do access control mechanisms support?

confidentiality and sometimes conceal the existence of data

Example of access control mechanism

cryptography

What does cryptography do?

- transforms data to make it incomprehensible
- Cryptographic key controls access to the encrypted data
- but then the key itself also becomes important to be protected

What does confidentiality apply to?

the existence of data

Why is the existence of data important?

because existence of data sometimes is more information revealing than the data itself

Example of why existence of data is important

The precise number of people who distrust a politician might be less important than the fact that such people in the politician's staff exist

Resource hiding

another important aspect of confidentiality

Why is resource hiding important?

organizations often wish to conceal their network configurations.

e.g internet mapping challenge (network structure)

What are confidentiality requirements?

- block unauthorized access (authentication)
- limit authorized access to resource (access controls)

What could a breach in confidentiality result in?

- stolen identity
- exposed business trade secrets

What is Integrity?

- the trustworthiness of data/resources
-the prevention of improper/unauthorized change

What does Integrity include?

Data integrity and origin integrity

What is data integrity?

ensures the content of the information is unchanged (think Dropbox example)

What is origin integrity?

the source of the data is legitimate

What are the two classes of integrity mechanisms?

prevention mechanisms and detection mechanisms

what is a prevention mechanism?

prevents unauthorized attempts to maintain integrity

Common examples of prevention mechanisms

- usernames
- passwords

What is a detection mechanism?

- do not try to prevent violations of integrity
- simply report that the data's integrity is no longer trustworthy.

Example of detection mechanism

md5sum

What is auditing?

used to compare data with older, backed-up versions of the data

What are the results of an integrity breach?

- unreliable data
- flawed programs
- system failures

example of unreliable data

someone modifies data without authorization

example of flawed programs

You download a program to do a specific task. That program should do exactly what it says nothing more and nothing less. If someone makes changes to the program to do something different you have a flawed program

What is availability?

the ability to use information or resources

Why is availability so important?

an unavailable system is as bad as no system at all

Why is availability relevant to security?

convenience and cruciality

example of why availability is important

an attack on availability could cause financial loss, health issues, etc

Example of threats to availability

- technical failures
- natural disasters
- user-caused harm

What is the most well-know attempt to block availability?

Denial of Service (DoS) attacks

The target coordinates of a missile should not be improperly modified is a violation of confidentiality, integrity, or availability?

Integrity

The target coordinates of a missile should not be improperly disclosed is a violation of confidentiality, integrity, or availability?

confidentiality

When the proper command is issued the missile should fire is a violation of confidentiality, integrity, or availability?

availability

John copies Mary's homework is a violation of confidentiality, integrity, or availability?

confidentiality

Paul crashes Linda's system is a violation of confidentiality, integrity, or availability?

availability

Carol changes the amount of Angelo's check from $100 to $1,000 is a violation of confidentiality, integrity, or availability?

integrity

What is non-repudiation?

the assurance that someone cannot deny something. When someone executes a task there should be no way to deny they did it.

What do you use in order to assure non-repudiation?

- use digital signatures
-involve the private key in transaction

What is authentication?

the process of determining whether someone or something is, in fact, who or what is declares itself to be

What is vital to implement a secure system?

authentication

What is required to establish access controls?

authentication

How do you assure authentication in cryptography?

- Digital Signatures
- MAC (message authentication codes)

What is a threat?

potential violation of security

what is an attack?

the actions to be guarded against

What are attackers?

those who execute attacks

What are the four classes of threats?

- Disclosure
- Deception
- Disruption
- Usurpation

what is disclosure?

unauthorized access to information

what is deception?

acceptance of false data

what is disruption?

interruption or prevention of correct operation

what is usurpation?

unauthorized control of some part of the system

What class of threat does snooping or eavesdropping fall under?

- disclosure
e.g passively sniffing, snooping in the area

what class of threat does modification or alteration fall under?

- deception
- disruption
- usurpation
e.g. active wiretapping (alter moving data

What class of threat does masquerading or spoofing fall under?

- deception
- usurpation
e.g luring a victim into believing that they are communicating with the bank, IP spoofing, meddler-in-the-middle attacks

what class of threat does repudiation or origin fall under?

- decpetion
e.g Alice denies that she made an order on amazon when she actually did

What class of threat does delay fall under?

- usurpation
e.g an attacker delaying the delivery of some goods to the customer

what class of threat does Denial of service fall under?

- usurpation
e.g an attacker prevents a server from providing a service

what is a security policy?

a statement of what is and what isn't allowed.

what makes a system secure or unsecure

what is a security mechanism?

a method, tool, or procedure for enforcing a security policy

A security policy and security mechanism are important to establish a ...

secure system

What does recording of passwords and other sensitive information do?

helps increase security

What do policies provide?

a precise description of secure and nonsecure states

Given a security policy's specification of what is secure and what is nonsecure, security mechanisms help

- prevent attacks
- detect attacks
- recover from attacks

Prevention

Attack will fail

Example of prevention

attacker tries to log into a system using ssh but the system is protected with a strong password

Detection

useful when an attack cannot be prevented

example of detection

user entering password incorrectly multiple times

What are the two forms of recovery?

- stop an attack, assess and repair any damage caused by the attack
- system continues to function correctly while an attack is under way

Does a policy always correctly describe the require level of security?

no

- there will always be room for a flaw in system

- security rests on assumptions specific tot he type of security required

Example of assumptions and trust

door locks

What are the two assumptions policy designers always make?

- the policy correctly and unambiguously partitions the system states into "secure" and "nonsecure" states

- the security mechanisms prevent the system from entering a "nonsecure" state

What happens if assumptions are erroneous?

the system will be nonsecure

What is assurance?

the specification of how much one can trust a system

What are the steps to Assurance?

1. Detailed specification of what is allowed/disallowed

2. analysis of the design of the system to show that it will not violate the specifications

3. proof that the implementation will produce the desired behavior

What is specification?

a statement of the desired functioning of the system (what is required)

What is the formal specification?

mathematically

what is the the informal specification?

in english

What is design?

translates specifications into components that will implement them

What is implementation?

creates a system that satisfies the design

What does a useful policy and mechanism balance?

the benefits of protection and cost

what does risk analysis do?

- determine whether an assess should be protected

- determine to what level is it to be protected

What does the level of protection depend on?

- the probability of an attack occurring
- the effects of the attack should it succeed

What is the problem of "analysis paralysis"?

no solution or course of action is decided upon

What do laws restrict?

The use of technology and affect procedural controls

What must any policy and mechanism consider?

legal requirements

Besides laws what is another constraint on policies and procedures?

Society distinguishes between legal and acceptable practices

Does security provide direct financial gain to users?

no

How do organizations often view security? Why?

a waste or money and effort. Security adds extra complexity

Example of organizational problems regarding security?

not backing up your data