Chapter1

Book targeted at both academic and professional audiences, suitable for a one-semester undergraduate course in computer science.
Aligns with CS2013 recommendations on Information Assurance and Security (IAS).
CS2013 categorizes course work into:
- Core-Tier 1: Essential topics.
- Core-Tier 2: Important but not essential topics.
- Elective: Desirable topics for breadth and depth.
Covers virtually all CS2013 topics in these categories, serving as a basic reference and self-study resource.

Chapter Structure

1.1 Cybersecurity, Information Security, and Network Security

Cybersecurity: Protection of information in networked systems, involving:
- Key Objectives: Confidentiality, integrity, availability, authenticity, accountability.
Information Security: Covers confidentiality, integrity, and availability of information, alongside authenticity, accountability, and nonrepudiation.
Network Security: Protects networks from unauthorized access, modification, or destruction.

1.2 OSI Security Architecture

Provides a systematic approach for defining security requirements linked to security attacks, mechanisms, and services.
Definitions:
- Security Attack: Any action compromising information security.
- Security Mechanism: Processes designed to detect, prevent, or recover from attacks.
- Security Service: Enhances security through processing or communication.

1.3 Security Attacks

Classification of attacks into passive and active:
- Passive Attacks: Eavesdropping (e.g., traffic analysis).
- Active Attacks: Involving modifications (e.g., masquerade, denial of service).

1.4 Security Services

Services that support security requirements:
- Authentication: Validates communication origin.
- Access Control: Limits access to systems and applications.
- Data Confidentiality: Protects information from unauthorized access.
- Data Integrity: Ensures data accuracy and reliability.
- Nonrepudiation: Ensures proof of origin and receipt.
- Availability: Assures system access for authorized users.

Key Cryptographic Concepts

Cryptography

Influential frameworks:
- Keyless Algorithms: No keys involved (e.g., cryptographic hash functions).
- Single-Key Algorithms: Use of one secret key for encryption and decryption (e.g., symmetric encryption).
- Two-Key Algorithms: Involve public and private keys for secure communications (e.g., asymmetric encryption).

Network Security

Communications Security

Protects data transmission using protocols (e.g., IPsec, TLS).

Device Security

Protects hardware (routers, switches) and systems connected to networks:
- Firewalls: Limit access based on security rules.
- Intrusion Detection: Monitors for unauthorized access attempts.
- Intrusion Prevention: Stops intrusive actions before they compromise systems.

Trust and Trustworthiness

Trust Models in Information Security

Trust involves relying on entities to behave as expected, with concepts including:
- Trustworthiness: Degree to which an entity deserves trust.
- Ability, Benevolence, and Integrity: Factors affecting trust in individuals and organizations.

Standards in Security

Established organizations contributing to setting protocols and standards include:
NIST: Develops standards impacting security aspects globally.
ISOC: Addresses global internet issues through standards.
ITU-T: Develops technical standards for telecommunications.
ISO: Promotes international standardization for various sectors.

Review Questions

1.1 What is the OSI security architecture?The OSI security architecture provides a systematic approach for defining security requirements linked to security attacks, mechanisms, and services.

1.2 List and briefly define the three key objectives of computer security.

Confidentiality: Ensures that information is not disclosed to unauthorized individuals.
Integrity: Guarantees the accuracy and reliability of information.
Availability: Assures that authorized users have access to information when needed.

1.3 List and briefly define categories of passive and active security attacks.

Passive Attacks: Involve eavesdropping, such as traffic analysis, intended to obtain information without detection.
Active Attacks: Involve modifications to data or systems, such as masquerade (impersonating another user) or denial of service (disrupting service).

1.4 List and briefly define categories of security services.

Authentication: Validates the source of communication.
Access Control: Limits access to systems and applications based on user permissions.
Data Confidentiality: Protects sensitive information from unauthorized access.
Data Integrity: Ensures that the data remains accurate and unchanged during transmission.
Nonrepudiation: Ensures that a sender cannot deny sending a message.
Availability: Guarantees that systems are accessible to authorized users.

1.5 List and briefly define categories of security mechanisms.

Security Attacks Detection: Mechanisms that identify ongoing attacks.
Protection Techniques: Processes that prevent potential attacks.
Recovery Processes: Systems in place to recover from attacks once they occur.

1.6 List and briefly define the fundamental security design principles.

Least Privilege: Granting users only the permissions essential for their tasks.
Defense in Depth: Implementing multiple layers of security controls.
Fail-Safe Defaults: Configuring permissions to deny access by default unless explicitly granted.
Economy of Mechanism: Keeping security design simple to avoid complexity-induced vulnerabilities.
Open Design: Transparency in security mechanisms to undergo scrutiny.

1.7 Provide an overview of the three types of cryptographic algorithms.

Keyless Algorithms: Functions like cryptographic hash functions that don’t require keys.
Single-Key Algorithms: Symmetric encryption, where the same key is used for both encryption and decryption.
Two-Key Algorithms: Asymmetric encryption, utilizing a public key for encryption and a private key for decryption.

1.8 Provide an overview of the two major elements of network security.

Communications Security: Protects data transmission via various protocols (e.g., IPsec, TLS).
Device Security: Safeguards hardware and systems connected to networks with measures such as firewalls and intrusion detection systems.

1.9 Briefly explain the concepts of trust and trustworthiness.

Trust: The reliance on entities to act as expected within a system.
Trustworthiness: The degree to which an entity is deemed deserving of trust, encompassing aspects like ability, benevolence, and integrity.

Problems

1.1 Automated Cash Deposit Machine:

Confidentiality: High - Users must trust that their personal information (e.g., account numbers) is protected.
Integrity: High - Ensuring the deposit amount recorded is accurate is crucial.
Availability: Moderate - While users need access, the machine can be offline for maintenance without critical impact.

1.2 Payment Gateway System:

Confidentiality: High - Sensitive information like credit card numbers must be kept secure.
Integrity: High - Transactions must reflect the accurate amount to avoid disputes.
Availability: High - Users need 24/7 access to perform transactions without inconvenience.

1.3 Financial Report Publishing System:

a. Confidentiality: Sensitive financial reports meant for a small audience, such as internal audits.
b. Integrity: Annual financial statements where accuracy in reported numbers is essential.
c. Availability: Real-time stock market reports where immediate access is vital.

1.4 Impact Assessment:

a. Student Blog:
- Confidentiality: Low - Public and non-sensitive.
- Integrity: Moderate - Accuracy matters but not vital.
- Availability: Low - Access isn’t critical.
b. Examination Section:
- Confidentiality: High - Sensitive exam material.
- Integrity: High - Accuracy in exam content essential.
- Availability: Moderate - Some downtime is tolerable before exams.
c. Pathological Laboratory:
- Confidentiality: High - Patient data is sensitive.
- Integrity: High - Test results must be accurate.
- Availability: Moderate - Critical for timely treatment but manageable.
d. Student Information System:
- Personal Info Impact: High for confidentiality and integrity.
- Administrative Info Impact: Low impact for confidentiality but moderate for integrity.
- Overall System: High impact considering personal information.
e. Library Management System:
- Student Data Impact: Moderate for confidentiality, high for integrity.
- Book Data Impact: Low for confidentiality, moderate for integrity.
- Overall System Impact: High, as it combines both data types.