CSCI262 - System Security

What is Computer Security?

It measures and controls that ensure confidentiality, integrity and availability of information system assests i.e. hardware, software, firmware, including information being processed, stored and communicated.

What is the CIA Triad?

• Confidentiality

• Integrity

• Availability

What is Confidentiality?

The practice of assests being inaccessible to unauthorised parties.

What is Integrity?

The practice of assets being unmodifiable or unforegable, without detection, by unauthorised parties.

What is an Authorised person?

Persons who are allowed to do something.

What is an Unauthorised person?

Persons who are not allowed to do something.

How do we know someone (or something) is authorised?

Through authentication and access control.

What is Authnetication?

This is needed so we (the system) know who the someone trying to access is.

What is Access Control?

This is needed to determine what an idenfited someone is allowed to do.

What is Authneticity?

It is verifying that users are who they say they are and that each input arriving at the system came from a trusted source.

What is Accountability?

This makes sure that every action can be traced back to the specific entity that performed it

What are Computer System assets?

These are hardware (systems, storage and communication devices), software (OS, utilities apps), data (files, databases, password files) and communication facilities and networks i.e. LAN and WAN links, bridges and routers.

What is an Adversary?

• Threat agent

• An individual, group, organisation or government that conducts or has the intent to conduct detrimental activities

What is an Attack?

This is any kind of malicious activity that attempts to collect, disrupt, deny, degard or destroy information system resources or the information itself.

What is a Countermeasure?

• This is a device or technique that has the objective to impair the operational effectiveness of undesirable or adversarial activity

• It also can prevent espionage, sabotage, theft or unauthorised access to or use of sensitive information or information systems.

What is a Risk?

• A measure of the extent of how likely a threat is to happen and how much harm it could cause if it does

What is a Security Policy?

This is a set of rules and guidelines that defines how a computer system and its data are protected by controlling what users and systems are allowed to do.

What is a System Resource?

• It is an asset

• A major application, general support system, high impact program, physical plant, mission ciritical system, personnel, equipment or a logically related group of systems.

What is a Threat?

This is any circumstance or event with the potential to adversely impact organisational operations (including mission, functions, image, or reputation), organisational assets, individuals, other organisations, or the Nation through an information system via unauthorised access, destruction, disclosure, modification of information and/or denial of service.

What is a Vulnerability?

This is any weakness in an information system, system security procedures, internal controls or implementation that could be exploited or triggered by a threat source.

What is Prevention?

This is the prevention of an attack from succeeding.

What is Detection?

This is determing whether an attack is under way, or has occured and then reporting it.

What is Recovery?

There are 2 forms:

• Stopping an attack and then assess and repair any damage caused by that attack

• The system continues to function correctly while an attack is under way.

What is Network Exploitation?

• The most expensive computer crime is a denial of service which involves remotely accessing distributed systems through viruses, worms and Trojans.

• This attack is prevelant because of networks (interconnectedness) which allow problems such as spam and phishing to exist.

What is Authentication?

• The binding of an identity to a subject (user or an entity)

• Subject is often required to do this to itself to a computer system

What is a general model for user authentication?

• NIST SP 800-63-3

2 steps:

• User registration with the system

• Authentication

What are the different types of info for authentication?

• Something the individual knows: password

• Something the individual posesses (token): physical keys

• Something the individual is (static biometrics): fingerprint

• Something the individual does (dynamic biometrics): voice pattern

What is password-based authentication?

• The user supplies an identity and a password

• The server checks the supplied information

• If the password information matches with the user, the user’s identity is authenticated

What is a false positive in a password-based authentication?

• When we make a match but “shouldn’t have“

• False acceptance rate is the proportion of authentication attempts resulting in false acceptances

What is a false negative in a password-based authentication?

• When we don’t make a match but “should have“

• False rejection rate is the proportion of authentication attempts resulting in false rejections

What are threats againts password systems?

• Guessing

• Exposure

• Trojan programs

• Poor

• Dictionary, brute force and hybrid attacks

• Online or offline compromise

What are the types of password exposure?

• Seeing the password when it is typed

• Users writing their passwords down

• Passing their passwords to others

What is a Login Trojan horse in password systems?

• Programs produce a fake login screen

• The user logs in but the program captures the password and stores in along with the username for the owner

• Program then passes the info to the real login program

• User’s don’t realise something is wrong

What are dictionary attacks in password systems?

• Dictionaries of common words can be used as sets of passwords to try

• Attackers step through the words in a dictionary and tries them

• May not succeed but is fast

What are tailored dictionary attacks in password systems?

• Users may like cars, so a suitable dictionary could be a list of car brands

• Users may even use personal info i.e. birthdates, family names and pet names

• DIctionary doesn’t have to just be real English worfs, could be another language

What are brute force attacks in password systems?

• Trying every possible password and solution

• Always works

• Guessing is unlikely within the lifetime of the password so changing passwords makes it “harder to hit“

What is password entropy, and how is it calculated?

• Measures the randomness, info content, and uncertinty of a password and is measured in bits

• N equally likely passwords: log2 * N

E.g.

• 2 lowercase letters: 26²

• 4 numbers: 10^4

• 2 uppercase letters: 26²

N=262×104×262=4,569,760,000

log2​N≈32.08 bits≈33 bits