chapter1
Introduction to Security
Understanding security as a fundamental need within computing environments.
Importance of establishing trust between involved parties to mitigate risks.
Why Do We Need Security?
Security is essential to:
Balance the lack of "trust" among various parties involved in information systems.
Protect sensitive data from unauthorized access or modification.
Security Objectives
Key objectives of security in an organization include:
Confidentiality: Ensuring that sensitive information is accessed only by authorized individuals.
Integrity: Maintaining the accuracy and reliability of data by preventing unauthorized modifications.
Assurance: Providing confidence that security measures are functioning correctly and effectively.
Accountability: Ensuring that actions can be traced back to responsible individuals or entities, enabling auditing and compliance.
Availability: Ensuring that information and resources are available to users when needed.
Types of Security Breaches
Security can be compromised through various forms:
Exposures: Situations where unauthorized data access is possible.
Vulnerabilities: Weaknesses in systems that can be exploited by attackers.
Threats: Potential attacks or harm posed by malicious actors or events.
The People Involved
Different categories of individuals within the security landscape:
Amateurs: Casual hackers or hobbyists exploring security vulnerabilities.
Professionals:
Crackers: Individuals who break into systems, often for malicious purposes.
Career Criminals: Organized groups engaging in cybercrime for profit.
Revengists: Individuals motivated by personal revenge, often targeting specific entities or individuals.
Methods of Defense
Various strategies and tools for enhancing security include:
Controls: Policies and procedures to enforce security measures.
Measures: Concrete steps to protect information and infrastructure.
Counter-measures: Specific actions taken in response to detected vulnerabilities or attacks.
Thinking Process in Security
To effectively address security challenges, the following steps are crucial:
Threats: Identifying potential threats against the system.
Risks: Assessing the likelihood and impact of these threats.
Controls: Implementing appropriate security controls to mitigate identified risks.
Measures: Executing defensive measures to reinforce controls.
Countermeasures: Deploying responses when threats materialize.
Security Balance: Finding an effective balance between the effectiveness of security measures and their efficiency in resource usage.