Chapter 1 ITSS 4360

Data and Service

  • Confidentiality: data confidentiality, privacy

  • Integrity: data integrity, system integrity

  • Availability

  • Authenticity

  • Accountability



Computer Security 

Definition by National Institute of Standards and Technology

  • "The protection of information systems against unauthorized access to or modification of information, whether in storage, processing, or transit, and against the denial of service to authorized users, including those measures necessary to detect, prevent, and respond to security breaches." 

  • IIn essence, computer security focuses on safeguarding information systems and data from various threats, ensuring confidentiality, integrity, and availability, while also providing measures for detecting, preventing, and responding to security incidents



Assets of a Computer System

  • Hardware

  • Software

  • Data

  • Communication facilities and networks



Vulnerabilities, Threats, and Risks

  • Vulnerabilities: a weakness or flaw within an information system

  • Threats: a potential event or circumstance that could harm an organization or its assets

  • Risks: the probability and impact of a threat exploiting a vulnerability

Categories of vulnerabilities 

• Corrupted (loss of integrity) 

• Leaky (loss of confidentiality) 

• Unavailable or very slow (loss of availability) 

Threats 

• Capable of exploiting vulnerabilities 

• Represent potential security harm to an asset 

Attacks (threats carried out) 

• Active – attempt to alter system resources or affect their operation 

• Passive – attempt to learn or make use of system information that does not affect system resources 

• Insider – initiated by an entity inside the security parameter 

• Outsider – initiated from outside the perimeter

Countermeasures

  • Countermeasures are the actions taken to address security attacks.

  • These include:

+ Prevention - Steps to stop attacks before the occur

+ Detection - Techniques to identify attacks that have already happened or are ongoing

+ Recovery - Measures to restore systems and data after an attack



Passive and Active Attacks

*Passive Attack

  • Attempts to learn or make use of information from the system, but it does not affect system resources 

  • Eavesdropping on, or monitoring of, transmissions 

  • Goal of attacker is to obtain information that is being transmitted 

  • Two types: 

• Release of message contents 

• Traffic analysis

*Active Attack

  • Attempts to alter system resources or affect their operation 

  • Involve some modification of the data stream or the creation of a false stream 

  • Four categories: 

• Replay 

• Masquerade 

• Modification of messages 

• Denial of service



Challenges of computer security  

1. Computer security is not as simple as it might first appear to the novice 

2. In developing a particular security mechanism or algorithm, one must always consider potential attacks on those security features 

3. Procedures used to provide particular services are often counterintuitive 

4. Physical and logical placement needs to be determined 

5. Security mechanisms typically involve more than a particular algorithm or protocol and also require that participants be in possession of some secret information which raises questions about the creation, distribution, and protection of that secret information 

6. Attackers only need to find a single weakness, while the designer must find and eliminate all weaknesses to achieve perfect security 

7. Security is still too often an afterthought to be incorporated into a system after the design is complete, rather than being an integral part of the design process 

8. Security requires regular and constant monitoring 

9. There is a natural tendency on the part of users and system managers to perceive little benefit from security investment until a security failure occurs 

10. Many users and even security administrators view strong security as an impediment to efficient and user-friendly operation of an information system or use of information



Attack Surfaces

  • The attack surface refers to the total set of entry points or vulnerabilities in a system or network that could be exploited by an attacker. It includes all the ways an attacker could gain unauthorized access or cause harm to the system

Attack Surface categories

  • Network attack surface

  • Software attack surface

  • Human attack surface


Defense in Depth and Layering in Security

  • Defense in depth is a security strategy that uses multiple layers of defense mechanisms to protect assets, ensuring that if one layer fails, additional layers still provide protection.

  • Layering in security refers to the practice of implementing various security measures, technologies, or strategies at different levels within a system. 

  • Together, these approaches create a more robust defense, minimizing the likelihood of a successful attack by ensuring that if one layer is bypassed, other layers continue to safeguard critical systems and data



Attack Tree

  • An attack tree is a diagram or model used to represent the possible ways an attacker could compromise a system or achieve a malicious goal. It breaks down a security threat into various sub-goals or steps, showing how each component or action can lead to the ultimate objective.

  • The tree is structured in a hierarchical manner, with the root representing the main goal (e.g., unauthorized access to a system) and branches representing different methods or techniques that could be used to achieve that goal.


  • Each branch or leaf node typically represents a different attack vector or exploit, and the attack tree can help identify potential vulnerabilities, assess risk, and prioritize security measures.



Security Standards Organizations

  • Standards have been developed to cover management practices and the overall architecture of security mechanisms and services. The standards are usually set by a professional organization, institution, government, etc., and are agreed upon by the knowledgeable representatives of that community.

  • Some of the important standard's organizations are: 

  • National Institute of Standards and Technology (NIST)

- NIST is a U.S. federal agency that deals with measurement science, standards, and technology related to U.S. government use and to the promotion of U.S. private sector innovation

- telecom networks and services



  • International Organization for Standardization (ISO)

- ISO is a nongovernmental organization whose work results in international agreements that are published as International Standards



  • Information Systems Audit and Control Association(ISACA)

- Global organization for information governance, control, security and audit professionals.

- Publishes IS auditing and IS control standards are followed by practitioners worldwide



  • Center for Internet Security(CIS)

- CIS plays an important role in forming security policies and decisions by maintaining the CIS Controls and CIS Benchmarks and hosting the Multi-State Information Sharing and Analysis Center (MS-ISAC).[9]



Security Standards Publications

  • Security standards represent the norm and a minimum level of maturity that is expected to be met as a baseline for security controls