Comprehensive Notes on Computer Security Concepts and Fundamentals

Fundamental Security Concepts and Objectives

• Need for Digital Protection: Computer security focuses on safeguarding the storage, processing, and transmission of digital information.
• Impossibility of Absolute Security: Absolute security does not exist in computing. Systems can only reach acceptable risk levels through proper controls.
• Security Audits: Specialized cybersecurity organizations perform comprehensive system and procedure reviews. Operational security testing teams in this domain are commonly referred to as "tiger teams".
• Foundational Axiom of Computer Security: Gene Spafford stated: "The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a room lined with lead and guarded by armed guards."

Asset Classification for Protection

• Equipment (Hardware Assets):
  • Prevent physical theft of devices.
  • Enforce full disk encryption and mandate routine password updates.
  • Block unauthorized hardware and unauthorized peripheral devices from connecting to the network.
  • Perform continuous preventive physical and technical maintenance.
• Applications (Software Assets):
  • Strictly limit installations to essential software required for official operations.
  • Deploy standardized base operating system images across corporate devices.
  • Maintain active, updated antivirus and antimalware software.
  • Restrict administrative privileges, preventing standard system users from operating with root or administrative access.
  • Disable automatic application execution (autorun/autostart features) from removable media such as CDs, DVDs, or USB drives.
  • Verify software origin, developer certificates, and cryptographic hashes prior to installation.
• Data Assets:
  • Information loss disrupts organizational operations and can render business continuity impossible.
  • Data leakage or unauthorized access by competitors directly threatens organizational viability.
  • Systems must be secured against malicious software engineered to exfiltrate or tamper with sensitive records (such as identity documentation like the Spanish National Identity Document / DNI, cloud-stored files, or messaging application data).
  • Deploy redundant storage mechanisms to maintain fault tolerance.
  • Implement cryptographic storage solutions for data at rest.
• Communications Assets:
  • Mandate end-to-end encrypted transmission channels for all data in transit.
  • Monitor and enforce access controls on enterprise network access, particularly for teleworking and remote staff.
  • Inspect and restrict connections made to the enterprise infrastructure from external or unmanaged devices.
  • Implement robust filtering systems to prevent unwanted electronic mail (spam) and malicious advertising (malvertising).
  • Current paradigm shift involves migration to cloud computing infrastructure (hosting applications and data on remote Internet servers, such as Gmail for electronic mail, or services like Dropbox, Google Drive, and Amazon S3 for cloud storage).
• Data Tracking and Surveillance Documentation:
  • Analysis of digital footprints and tracking data is documented in public resources such as:
    • https://www.youtube.com/watch?v=NPE7i8wuupk
    • https://www.zeit.de/datenschutz/malte-spitz-vorratsdaten

Security Classification Models

• Physical Security: Encompasses all physical aspects of computer infrastructure, including general-use workstations, dedicated application servers, and network equipment (switches, routers, firewalls).
  • Natural Disasters: Physical location selection for Data Processing Centers (DPC / DPZ) must account for seismic, flood, and environmental risks. Organizations should maintain a geographically separate secondary DPC for disaster recovery.
  • Theft and Intrusion: Physical security of the DPC room must be enforced using physical security guards, biometric or smart access cards, keypads, and multi-factor access barriers.
  • Infrastructure and Utility Failures: Power supply interruptions require Uninterruptible Power Supply (UPS) battery systems and back-up generators. Redundant secondary Internet links from separate ISPs are required to maintain connectivity.
• Logical Security: Pertains to software applications, operating systems, and logic running across host machines.
  • Malicious Software: Protection against viruses, trojan horses, worms, and general malware threats.
  • Data Loss Risks: Software errors, application bugs, or faulty system configurations can lead to fatal data corruption or loss.
  • Server Infrastructure Vulnerabilities: Targeted network attacks directed against host application services.
• Passive Security: Recovery mechanisms and controls that come into action after an attack, failure, or security incident has occurred.
  • Uninterruptible Power Supplies (UPS): Battery backups that stabilize power during voltage drops and permit clean shutdowns.
  • Data Backups: System backups created to restore operations when primary storage media is damaged, corrupted, or encrypted by malware.
• Active Security: Proactive prevention mechanisms deployed to block attacks and protect corporate assets (hardware, software, data, communications) before compromise occurs.

Core Security Pillars (CIA Triad and Non-Repudiation)

• Confidentiality: Assures that information is accessible only to explicitly authorized users, processes, or devices.
  • Authentication: The procedure of verifying the identity claims of a user, host, or application.
  • Authorization: Granting specific granular operational privileges (e.g., read, write, execute, modify) to an authenticated entity.
  • Encryption: Cryptographic transformation of readable plain text into unintelligible cipher text to prevent unauthorized reading during access or transmission.
• Integrity: Guarantees that data remains accurate, complete, unaltered, and uncorrupted by unauthorized or accidental modifications throughout its lifecycle.
• Availability: Ensures authorized entities have uninterrupted access to system services, data, and resources according to operational schedules.
• Non-Repudiation: Guarantees that neither party involved in a digital communication, transaction, or interaction can deny having participated in or originated the action.

Authentication Factor Categories

• Something You Know (Knowledge Factor): Intangible information known strictly by the authorized identity holder.
  • Examples: Secret alphanumeric passwords, PIN codes, security question answers.
• Something You Have (Ownership Factor): A tangible physical object held exclusively by the entity.
  • Examples: Smart cards, security tokens, cryptographic USB keys, physical access keys.
• Something You Are (Inherence Factor): Unique physical, physiological, or behavioral characteristics analyzed via biometrics.
  • Examples: Fingerprint analysis, retina or iris scanning, facial structure recognition, voice pattern identification.

Architecture Protocols and Security Principles

• AAA Protocol Architecture:
  • Authentication: Verification of identity claims.
  • Authorization: Enforcing permissions and access boundaries based on identity.
  • Accounting: Collecting and maintaining detail-rich operational logs of system and user activities.
  • Log Isolation Principle: Accounting logs must be offloaded and stored on an isolated server to prevent localized tampering by an attacker.
  • Forensic Utility: Accounting records are critical for post-incident digital forensics and root-cause analysis.
• End-to-End Security Model (e2e):
  • Security controls must be applied at the data origin point, data destination point, and across the intermediate communication channel.
  • Origin and Destination Enforcement: Host devices and executing software must be verified to ensure system integrity has not been altered or compromised.
  • Transmission Channel Enforcement: Channel access must be restricted to authorized nodes, and all transferred data must be encrypted using strong cryptographic protocols.

Vulnerability Classification

• Vulnerability Definition: A software flaw, design bug, or implementation oversight in an application or operating system that can be exploited by an attacker to bypass security controls.
• Known Vulnerabilities with Patches: Vulnerabilities recognized by the software vendor for which security patches or updates have been issued.
  • Remediation: Systems should use automated updates to periodically poll vendor servers and automatically apply available patches.
• Known Vulnerabilities without Patches: Vulnerabilities acknowledged by the vendor or security community for which no software patch currently exists.
  • Remediation: The safest operational mitigation is to completely cease usage of the affected application until a valid patch is made available.
• Unknown Vulnerabilities (Zero-Day Vulnerabilities): Security flaws unknown to the vendor and security community, posing the highest operational risk because no passive defenses exist.

Malware Taxonomy and Threats

• Malware Definition: Software specifically developed to exploit target vulnerabilities and perform unauthorized, malicious operations on a target host machine.
• Viruses: Malicious code designed to infect host files and corrupt or render computing systems unusable.
• Worms: Self-propagating malware that consumes network bandwidth and target system resources, degrading operating system performance. A worm payload can drop secondary malicious software, transforming into a trojan.
• Trojans: Software masquerading as legitimate applications that open system backdoors, allowing remote threat actors to execute commands and take unauthorized control of host systems.
• Replication Vectors: Malware categories typically feature self-replication capabilities designed to maximize network dissemination across as many hosts as possible.
• Exploits: Specialized software code designed to take advantage of specific system vulnerabilities to gain unauthorized control of a host machine.
• Rogue Antivirus (Fake Antivirus): Malicious software disguised as genuine security or antivirus applications to trick users into executing malicious code.

Cyber Attack Typologies and Techniques

• Interruption: An attack directed against availability, cutting off or shutting down access to system services or network resources.
• Modification: An attack targeting integrity, where an unauthorized third party intercepts and alters data before it reaches its destination.
• Fabrication: An attack targeting authenticity, where an attacker impersonates a legitimate sender to insert fake data transmissions into a network.
• Social Engineering: Psychological manipulation techniques designed to extract confidential information or guess credentials by analyzing known target user details.
• Phishing: Creation of spoofed websites or messaging communications mimicking trusted organizations to trick users into revealing sensitive credentials.
• Keyloggers: Trojanized programs or hardware devices designed to record every keystroke entered by a user on a keyboard to steal credentials and sensitive text.
• Brute-Force Attacks: Automated malware programs that systematically generate and test every potential character combination to crack passwords.
  • Countermeasures:
    • Enforce complex password policies (length, character variability).
    • Mandate frequent password rotation schedules.
    • Block automated rapid burst login attempts.
    • Enforce account lockouts after a specified maximum limit of consecutive failed attempts.
• Spoofing: Falsifying host metadata, MAC addresses, or IP headers to impersonate another trusted system on a network.
• Sniffing: Intercepting and capturing unencrypted traffic traveling across a shared local area network segment.
• Denial of Service (DoS): Flooding a targeted server or application service with artificial requests to exhaust system resources and interrupt operations.
• Distributed Denial of Service (DDoS): Coordinating multiple compromised remote hosts (zombie systems infected via trojans and assembled into a botnet) to launch high-volume connection requests against a single target service.

Attacker Profiles and Threat Actors

• Hacker: An individual who probes and penetrates computer defenses strictly for intellectual challenge, skill building, or problem-solving.
• Cracker: A malicious threat actor who breaks into computing systems with explicit intent to inflict damage, steal assets, or corrupt data.
• Script Kiddies: Unskilled computer hobbyists or novices who launch pre-written exploit packages and malicious scripts without understanding the underlying code or mechanics.
• Malware Programmers: Software developers specializing in writing viruses, trojans, exploits, and specialized malicious code.
• Sniffers: Network protocol specialists who capture and perform detailed forensic inspection on unencrypted network packet traffic.
• Cyberterrorists: Highly motivated crackers operating to advance significant political, ideological, or high-stakes financial agendas through targeted infrastructure disruptions.

Security Management and Operational Best Practices

• Primary Security Officer Responsibilities:
  • Identify and catalog all corporate assets requiring protection, and continuously audit system backup policies.
  • Draft, maintain, and test disaster recovery plans and emergency procedures.
  • Enforce minimal software footprints by removing unneeded applications, while reviewing host security configurations.
  • Monitor security advisory feeds and subscribe to security mailing lists to stay informed on emerging threats and vulnerabilities.
  • Enable automatic security updates across all operating system and software deployments.
• Secondary Security Officer Responsibilities:
  • Conduct end-user security awareness training.
  • Inspect operating system and application activity logs regularly.
  • Contract independent third-party external security audits.
  • Audit active network devices and connected physical hosts.
  • Review active user directory accounts and prune stale privileges.
  • Implement real-time alert systems via SMS or email to notify administrators immediately of potential system disruptions or security breaches.

Legal Framework and Compliance

• Criminalization of Cybercrime: Unauthorized intrusion into corporate networks to alter or steal data constitutes a criminal offense prosecuted under law.
• Organic Law on Personal Data Protection (LOPD): Establishes statutory compliance obligations for handling personal data belonging to natural persons across physical and digital formats.
  • Basic Level: Applied to any structured file containing general personal identification data.
  • Medium Level: Applied to files containing administrative infractions, penal sanctions, financial records, tax management profiles, or composite behavioral identity data.
  • High Level: Applied to files containing highly sensitive personal information, including political ideology, sexual orientation, racial background, trade union affiliation, religious beliefs, or complete medical histories.
• Law on Information Society Services and Electronic Commerce (LSSI-CE):
  • Applies mandatory regulatory obligations to all websites generating commercial revenue or performing e-commerce.
  • Requires clear ownership disclosures, explicitly identifying the physical entity or registered business behind the web domain directly on the site.
• Intellectual Property Law (LPI):
  • Establishes legal copyright frameworks in digital environments.
  • Private Copy Exception: Permits individuals who have legally purchased copyrighted software or media to create private copies for personal use.
  • Private Copying Levy (Kanon): Imposes a compensatory surcharge tax on physical storage media (hard drives, flash drives, blank discs) to offset creator revenue loss from unmonitored private copying.
• Electronic Administration (E-Government):
  • Strategic initiatives implemented by public institutions to digitize administrative processes using advanced verification methods.
  • Implementation Example: The Electronic National Identity Document (DNIe / Electronic DNI), incorporating integrated cryptographic certificates for electronic signatures and remote identity verification.

Practical Activities and Case Studies

• Spanish DNI Check Letter Calculation Algorithm:
  • The check letter of a Spanish National Identity Document (DNI) is derived mathematically using modular arithmetic over the numerical sequence of the identity card.
  • Algorithm Formula: Take the 8-digit DNI integer value $N$ and compute the remainder modulo 23:         $R = N \bmod 23$
  • Letter Assignment Table: The resulting remainder $R \text{ where } 0 \neq R < 23$ corresponds to a fixed character index array:         $\text{Index Array} = [\text{'T', 'R', 'W', 'A', 'G', 'M', 'Y', 'F', 'P', 'D', 'X', 'B', 'N', 'J', 'Z', 'S', 'Q', 'V', 'H', 'L', 'C', 'K', 'E'}]$
  • Verification Example: For a sample DNI number $71440314$:         $71440314 \bmod 23 = 10$         Index position 10 maps directly to the letter 'X'.
• Direct Root Login Restrictions in Modern Operating Systems:
  • Early UNIX implementations permitted direct login as the root administrative superuser account.
  • Modern systems disable direct interactive root logins across remote shells (such as SSH) to protect administrative authentication vectors.
  • Direct logins bypass non-repudiation because individual administrative accountability is lost when multiple operators share a root shell. Modern systems enforce unprivileged individual logins followed by audited elevation commands (such as sudo).
• Multi-Factor Authentication in Financial Transactions:
  • Banking interfaces require initial authentication using something you know (Username and Password).
  • To execute money transfers, banks introduce a mandatory second authentication factor (Two-Factor Authentication / 2FA / Out-of-Band Authentication) using something you have (e.g., an SMS-delivered One-Time Password / OTP, a hardware security key, or an authenticator app code).
• Single Failure Point Self-Destruct Cutoff (The Andromeda Strain):
  • In the film The Andromeda Strain, the laboratory self-destruction sequence could be aborted using a single physical fail-safe override key (an operational example of single-point emergency system override mechanisms).
• Application Trust on Google Play:
  • Downloading applications directly from official application stores like Google Play does not guarantee absolute safety.
  • Malware authors bypass initial store vetting through dynamic code execution, post-installation payload drops, or zero-day store exploits, necessitating secondary on-device active monitoring software.