Chapter One

Introduction to Computer Security

“The
most secure
computers are those
not connected
to the Internet and
shielded
from any interference”
Outline
1. Fundamentals of computer security
 Overview: history, vulnerabilities,
countermeasures, physical security
2. Goal of computer security
3. Security mechanisms and techniques
 Authentication, access control,
 Computer Security and privacy
Computer security is a branch of
Computer Science, focusing on
creating a secure environment for
the use of computers.

It is about provisions and policies

adopted to protect information and
property from theft, corruption, or
natural disaster while allowing the
information and property to remain
accessible and productive to its intended
users.
 Cont…

Privacy: The right of the individual to be protected

against intrusion into his personal life or affairs, or
those of his family, by direct physical means or by
publication of information.

Threat: Any person, act, or object that poses a

danger to computer security/privacy.
 Cont...
Network security on the other hand deals with
provisions and policies adopted to prevent and
monitor unauthorized access, misuse, modification, or
denial of the computer network and network-
accessible resources.

Not Sufficient!!

Internet
 Security Goals

To ensure :CIA
Confidentiality Safeguards
Confidentiality
information from being
accessed by individuals without
the proper clearance, access
level, and need to know.
Integrity Availaibility Integrity: Results from the
protection of unauthorized
modification or destruction of
information.
Availability: Information
services are accessible when
they are needed.
 Computer Security / History
Until 1960s computer security was limited to physical
protection of computers
In the 60s and 70s
 Evolutions
 Computers became interactive
 Multiuser/Multiprogramming was invented
 More and more data started to be stored in computer
databases
 Organizations and individuals started to worry about
 What the other persons using computers are doing to their
data
 What is happening to their private data stored in large
databases
 Cont…
In the 80s and 90s
Evolutions
 Personal computers were popularized
 LANs and Internet invaded the world
 Applications such as E-commerce, E-government and
E-health started to develop
 Viruses become majors threats
 Organizations and individuals started to worry
about
 Who has access to their computers and data
 Whether they can trust a mail, a website, etc.
 Whether their privacy is protected in the connected
world
 Cont…

Famous security problems

 Morris worm – Internet Worm
 November 2, 1988 a worm attacked more than 60,000 computers
around the USA
 The worm attacks computers, and when it has installed itself, it
multiplies itself, freezing the computer
 It exploited UNIX security holes in Sendmail and Finger
 A nationwide effort enabled to solve the problem within 12 hours

 Robert Morris became the first person to be indicted

under the Computer Fraud and Abuse Act.
 He was sentenced to three years of probation, 400 hours of
community service and a fine of $10,050
 Finally he is associate professor at the Massachusetts
Institute of Technology (MIT)
 Cont…

Famous security problems …

 NASA shutdown
In 1990, an Australian computer science student was
charged for shutting down NASA’s computer system
for 24 hours
 Airline computers
In 1998, a major travel agency discovered that
someone penetrated its ticketing system and has
printed airline tickets illegally
 Bank theft
In 1984, a bank manager was able to steal $25 million
through un-audited computer transactions
 Cont…
Famous security problems …
 In Ethiopia
 Employees of a company managed to change their salaries by
fraudulently modifying the company’s database
 In 1990s Internet password theft
Hundreds of dial-up passwords were stolen and sold to other
users
Many of the owners lost tens of thousands of Birr each
 A major company suspended the use of a remote login
software by technicians who were looking at the computer of
the General Manager
 In Africa: Cote d’Ivoire
 An employee who has been fired by his company deleted
all the data in his company’s computer
 Computer Security /Attacks/threat/Vulnerabilities

Security Attacks

Interruption: An attack on availability

Interception: An attack on confidentiality

Modification: An attack on integrity

Fabrication: An attack on authenticity

 Cont…

Source

Destination
Normal flow of information
Attack

Interruption Interception

Modification Fabrication
 Computer security/ Threats & Vulnerabilities
Threat
A threat is anything that can disrupt the operation, functioning, integrity,
or availability of a network or system.
Threats are potential causes of unwanted events that may result in harm
to the agency and its assets.
 A threat is a manifestation of vulnerability.
 Threats exploit vulnerabilities causing impact to assets
There are four main classes of threats:
 Structured threats
 Implemented by a technically skilled person who is trying to
gain access to your network.
 Unstructured threats
 Created by an inexperienced /non-technical person who is
trying to gain access to your network.
 Cont…
 Internal threats
 Occurs when someone from inside your network creates a security
threat to your network.
 External threats
 Occurs when someone from outside your network creates a security
threat to your network.
Vulnerabilities
A vulnerability is an inherent weakness in the design, configuration,
implementation, or management of a network or system that
renders it susceptible to a threat.
Vulnerabilities are what make networks susceptible to information
loss and downtime. Every network and system has some kind of
vulnerability.
A threat is blocked by control of a vulnerability.
 Cont…
Types of Vulnerabilities/ Susceptible to attack

Physical vulnerabilities (Ex. Buildings)

Natural vulnerabilities (Ex. Earthquake, fire, water…)

Hardware and Software vulnerabilities (Ex. Failures)

Media vulnerabilities (Ex. Disks can be stolen)

Communication vulnerabilities (Ex. Wires can be tapped)

Human vulnerabilities (Ex. Insiders)

 Cont…
 Vulnerabilities are classified according to the asset class they
related to:
1. Hardware
 susceptibility to humidity
 susceptibility to dust
 susceptibility to soiling
 susceptibility to unprotected storage
2. Software
 insufficient testing
 lack of audit trail
 Cont…

3. Network
 Unprotected communication lines
 Insecure network architecture
4. Personnel
 inadequate recruiting process
 inadequate security awareness
5. Site
 area subject to flood, unreliable power source
6. Organizational
 lack of regular audits, lack of continuity plans
 Cont…
The vulnerability is not the attack, but rather exploiting the
weak point/loops in order to gain access.

Vulnerability is the intersection of three elements:

1. A system susceptibility or flaw,

2. attacker access to the flaw, and

3. attacker capability to exploit the flaw

 Cont…
A vulnerability with one or more known instances of working and
fully-implemented attacks is classified as an exploitable
vulnerability, a vulnerability for which an exploit exists.

Fig. Threat agents, attack vectors, weakness, controls, IT asset and business impact
 Computer Security /Security policies

Security is a continuous process of protecting an object from

unauthorized access.

It is as state of being or feeling protected from harm.

That object in that state may be a person, an organization such as a

business, or property such as a computer system or a file.

An object can be in a physical state of security or a theoretical state

of security.

In a physical state, a facility is secure if it is protected by a barrier like a

fence, has secure areas both inside and outside, and can resist penetration
by intruders.
 Cont...
This state of security can be guaranteed if the following four
protection mechanisms are in place:
Deterrence: is usually the first line of defense against intruders
/who may try to gain access.
It works by creating an atmosphere intended to frighten
intruders.
This may involve warnings of severe consequences if security is
breached.
Prevention: is the process of trying to stop intruders from gaining
access to the resources of the system.
Barriers include firewalls, demilitarized zones (DMZs), and use
of access items like keys, access cards, biometrics, and others to
allow only authorized users to use and access a facility.
 Cont...
Detection: occurs when the intruder has succeeded or is in
the process of gaining access to the system.
Signals from the detection process include alerts to the
existence of an intruder.
Sometimes these alerts can be real time or stored for
further analysis by the security personnel.
Response: is an aftereffect mechanism that tries to respond
to the failure of the first three mechanisms.
It works by trying to stop and/or prevent future damage or
access to a facility.
 Cont…
Policy is the essential foundation of an effective information security program.
Policy maker sets the tone and emphasis on the importance of information
security.
Objectives
Reduced risk
Compliance with laws and regulations
Assurance of operational continuity, information integrity, and confidentiality

Why Policy?
Policies are the least expensive means of control and often the most difficult to
implement
Basic rules for shaping a policy
Policy should never conflict with law
Policy must be able to stand up in court if challenged
Policy must be properly supported and administered
 Computer Security / Countermeasures

Computer security controls

Authentication (Password, Cards, Biometrics)
(What we know, have, are!)
Encryption
Auditing
Administrative procedures
Standards
Certifications
Physical Security
Laws
 Computer Security / Physical Security

Physical security is much more difficult to achieve

today than some decades ago.

Safe area
Safe area often is a locked place where only authorized personnel
can have access
-Are the locks reliable?
The effectiveness of locks depends on the design,
manufacture, installation and maintenance of the keys!
Surveillance with guards
 The most common in Ethiopia
 Not always the most reliable since it adds a lot of human factor
Surveillance with video
 Uses Closed Circuit Television (CCTV)
 Software Security

Majority of security incidents result from defects

in software design or code
Attackers exploit the security holes left out by
software developers

Post-deployment security is more popular than

pre-deployment because:
 Easily understood by administrators
 Difficult to get security “assurance” from vendor
 Vendors are obsessed by “time-to-market”
 Difficult to know/tailor security requirements for general
purpose software
 Cont…
Risk Management

Software security as risk management!

Risk: “The possibility of suffering harm or loss”
Management: “The act or art of treating,
directing, carrying on, or using for a purpose”
Risk Management is the process concerned with
 identification, measurement, control and
minimization of security risks in information systems
to a level that commensurate with the value of the
assets protected
 Cont…

Risk Management …
Methods of risk treatment:
 Mitigate or suppress
 Accept
 Transfer (insurance)
 Ignore (poor – often used)
Types of countermeasures
 Preventive
 Detective
 Corrective
In case of risk acceptance
 Request documented justification
 Get formal approbation (sign-off) by senior management
 Have the decision reviewed after a year
 Cont…

Software Risk Management

Use a high quality software engineering

methodology
Risk analysis should be performed at every stage
of the development
 Requirement analysis
 Design
 Coding
 Testing, etc
 Cont…

Selecting Technologies
Languages
 The choice of a programming language has an
impact on how secure the software will be
 Security problems are common for some
languages
 C, C++ => Buffer overflow
 Java => Exception handling, etc
 High level languages hide what they are doing
(ex. Swapping to disk)
 The programmer doesn’t know that
 The attackers may use this
 Cont…
Selecting Technologies…

Operating systems
 Typical Operating Systems (Windows, Linux,
etc) have
 Authentication of users
 Resource access control (authorization & limitation)
Memory, Files, etc.
 Integrity of shared resources
 Operating systems have different levels of
security
 Cont…

Selecting Technologies…

Authentication technologies
 Password
 Host-Based (ex. IP)
 Physical token (ex. Smartcard)
 Biometrics
 Cont…
Open Source or Closed Source

Free Software
 Freedoms to use, copy, study, modify and redistribute both modified
and unmodified copies of software programs
Open Source
 Similar in idea to "free software" but slightly less rigid

FOSS/FLOSS
 Free/Libre/Open-Source Software is the name used by those who
wish to be inclusive
We use the common name Open source Software
(OSS)
 Cont…

Open Source or Closed Source …

OSS provides a number of benefits to security,

because security by obscurity does not work!
Hackers may not always need the code to find
security vulnerabilities
Reverse engineering is possible
 Disassemblers
 Decompilers
 Cont…
Open Source Software
OSS model gives some economic incentives for others to
review your code
 Users of the software may want to check the security of the
software
 Some users who want to make changes to the software will look
at the software
However, you cannot be sure of the security of the software
just because it is OSS
 Many vulnerabilities are hard to detect
 Some software sources are difficult to read
 Some software sources don’t have many readers
Additional vulnerabilities!
 Code scanning can be used by attackers!
 Cont…
Open Software Security Guiding Principles

Secure the weakest link

Practice defense in depth
Follow the principle of least privilege
Compartmentalize
Keep it simple
Promote privacy
Remember that hiding secrets is hard
Be reluctant to trust
Use your community resources
 Cont…
Auditing Software
Auditing software’s functionality is a complex activity
Auditing software’s security is even more complex
Most software development companies consider security of their
software only once or twice during the development cycle
Software teams prefer to use their time mainly on developing new
functionalities that can be seen
Ideally every software project should have an independent security
person or team
A good time for an initial security analysis is after the preliminary
design
 You can avoid security risks in the architecture of your software with
limited cost
 You will be more willing to make major changes
END OF CHAPTER !