Computer Security

Chapter One

Fundamentals of Computer
Security
 Outline

Overview

Factors of Computer Security

Security Goals

Vulnerabilities

Threats

Countermeasures
 Computer Security Overview
Definitions
Dictionary.com
Dictionary.comsays:
says:
1.
1.Freedom
Freedomfrom
fromrisk
riskor
ordanger;
danger;safety.
safety.
2.
2.Freedom
Freedomfrom
fromdoubt,
doubt,anxiety,
anxiety,or
orfear;
fear;confidence
confidence

3.3. Something
Somethingthatthatgives
givesor
orassures
assuressafety,
safety,as:
as:
1.1.AAgroup
grouporordepartment
departmentofofprivate
privateguards:
guards:Call
Callbuilding
buildingsecurity
securityififaa
visitor
visitoracts
actssuspicious.
suspicious.
2.2.Measures
Measuresadopted
adoptedby byaagovernment
governmenttotoprevent
preventespionage,
espionage,
sabotage,
sabotage,or
orattack.
attack.
3.3.Measures
Measuresadopted
adoptedby
byaabusiness
businessor
orhomeowner,
homeowner,totoprevent
preventaacrime
crime
such
suchas
asburglary
burglaryor
orassault:
assault:…etc.
…etc.
 Computer Security Overview
Definitions
(Computer)
(Computer) Security:
Security: The The prevention
prevention andand
protection
protection ofof (computer)
(computer) assets
assets from
from unauthorized
unauthorized
access,
access, use,
use, alteration,
alteration, degradation,
degradation, destruction,
destruction, and
and
other
other threats.
threats.
Refers
Refers to
to techniques
techniques for
for ensuring
ensuring that
that data
data stored
stored in
in aa
computer
computer cannot
cannot bebe read
read oror compromised
compromised by by any
any
individuals
individualswithout
without authorization
authorization

The
The protection
protection afforded
afforded to
to an
an automated
automated information
information system
system in
in
order
order to
to attain
attain the
the applicable
applicable objectives
objectives of
of preserving
preserving the
the
integrity,
integrity, availability,
availability, and
and confidentiality
confidentiality of
of information
information system
system
resources
resources
 Security? What is that?
Lock the doors and windows and you are secure
NOT

Call the police when you feel insecure

Really?

Computers are powerful, programmable machines

Whoever programs them controls them (and not you)

Networks are ubiquitous

Carries genuine as well as malicious traffic

End result: Complete computer security is unattainable, it

is a cat and mouse game
Similar to crime vs. law enforcement

6
 Computer Security / History

Until
Until 1960s
1960s computer
computer security
security was
was limited
limited to
to
physical
physical protection
protection of
of computers
computers
In
In the
the 1960s
1960s
Evolutions
 Evolutions
Computers
Computersbecame
becameinteractive
interactive
Multiuser/Multiprogramming
Multiuser/Multiprogrammingwas wasinvented
invented
More
More and
and more
more data
data started
started to
to be
be stored
stored in
in computer
computer
databases
databases
Organizations
 Organizationsand andindividuals
individualsstarted
startedto worryabout
toworry about
What
Whatthe
theother
otherpersons
personsusing
usingcomputers
computersare aredoing
doingto totheir
their
data
data
What
What isis happening
happening toto their
their private
private data
data stored
stored inin large
large
databases
databases
 Computer Security and Privacy/ History

In
In the
the 1980s
1980s and
and 1990s
1990s
Evolutions
 Evolutions
Personal
Personalcomputers
computerswere
werepopularized
popularized
LANs
LANsand
andInternet
Internetinvaded
invadedthe
theworld
world
Applications
Applicationssuch
suchas
asE-commerce,
E-commerce,E-government
E-governmentand
and

E-health
E-healthstarted
startedto
todevelop
develop
Viruses

Virusesbecome
becomemajor
majorthreats
threats
Organizations/individuals
 Organizations/individuals startedstarted to worry about
to worry about
Who
Whohashasaccess
accessto
totheir
theircomputers
computersandanddata
data
Whether
Whetherthey
theycan
cantrust
trustaamail,
mail,aawebsite,
website,etc.
etc.
Whether
Whether their
their privacy
privacy isis protected
protected inin the
the connected
connected
world
 Computer Security Factors/CIA

Confidentiality:
Preserving authorized restrictions on information access and
disclosure
 prevent/detect/deter improper disclosure of information

Two concepts:
 Data confidentiality: Assures that private or
confidential information is not made available or
disclosed to unauthorized individuals.
 Privacy: Assures that individuals control or influence
what information related to them may be collected and
stored and by whom and to whom that information may
be disclosed.
9
 Confidentiality
Concered with access to assets
“Need to know” basis for data access
How do we know who needs what data?
Approach: access control specifies who can access what
How do we know a user is the person s/he claims to be?
Need her identity and need to verify this identity
Approach: identification and authentication
Confidentiality is:
difficult to ensure
Why????
 Computer Security Factors
Integrity:
 Guarding against improper information modification or
destruction
Prevent/detect/deter improper modification of information
Two concepts:
Data integrity: Assures that information and programs are
changed only in a specified and authorized manner.
System integrity : Assures that a system performs its intended
function in an unimpaired manner, free from deliberate or
inadvertent unauthorized manipulation of the system.

11
 Integrity
Concerned with unauthorized modification of assets
Integrity is more difficult to measure than
confidentiality
Not binary – degrees of integrity
Context-dependent - means different things in
different contexts
Could mean any subset of these asset properties:
{ precision / accuracy / currency / consistency /
meaningfulness / usefulness / ...}
 Computer Security Factors

Availability:
Assures that systems work promptly and service is not
denied to authorized users.
prevent/detect/deter improper denial of access to services

Additional
Authenticity: The property of being genuine and being
able to be verified and trusted; confidence in the validity of
a transmission, a message, or message originator.
Accountability: The security goal that generates the
requirement for actions of an entity to be traced uniquely to
that entity.

13
 Availability
Not understood very well yet
Full implementation of availability is security’s next challenge
Complex and Context-dependent
Could mean any subset of these asset (data or service)
properties : { usefulness / sufficient capacity / progressing at a
proper pace /completed in an acceptable period of time / ...}
We can say that an asset (resource) is available if:
 Timely request response
 Fair allocation of resources (no starvation!)
 Fault tolerant (no total breakdown)
 Easy to use in the intended way
 Provides controlled concurrency (concurrency control, deadlock
control, ...)
 Example
Military example
Confidentiality: target coordinates of a missile should not be
improperly disclosed
Integrity: target coordinates of missile should be correct/precise
Availability: missile should fire when proper command is issued

Commercial example
Confidentiality: patient’s medical information should not be
improperly disclosed
Integrity: patient’s medical information should be correct
Availability: patient’s medical information can be accessed when
needed for treatment
Education
Confidentiality: Student’s information should not be disclosed
Integrity: student’s information must be correct
Availability: Student’s information has to be accessed by those
allowed anytime 15
 Need to Balance CIA
 Example 1: C vs. I+A
 Disconnect computer from Internet to increase confidentiality
 Availability suffers, integrity suffers due to lost updates

 Example 2: I vs. C+A

 Have extensive data checks by different people/systems to
increase integrity
 Confidentiality suffers as more people see data, availability
suffers due to locks on data under verification)
 Activity
Availability,Confidentiality, Integrity

Abebe copies Hana’s assignment

Almaz crashes Kebede’s system
Dawit changes the amount of Abebe’s check from $100 to
$1,000
Hirut spoofs Jemal's IP address to gain access to his
computer.
 What is secured?
Securing computing resources: prevent/detect/deter
improper use of computing resources
Data contained in an information system; or a
service provided by a system; or a system capability,
such as processing power or communication
bandwidth; or an item of system equipment
Hardware
Software
Data
Network

18
 Computer Security
Computer
Computer Security
Security can
can bebe broken
broken down
down into
into two
two distinct
distinct
areas:
areas:
Physical
Physical security
security refers
refers to
to the
the issues
issues related
related toto the
the
physical
physical security
security of
of the
the equipment
equipment thatthat comprises
comprises or or isis
connected
connectedtotothe
thenetwork.
network.
Logical
Logical security
security isis concerned
concerned with
with security
security of
of data
data held
held
on
ondevices
devicesconnected
connectedto tothe
thenetwork.
network.
involves
involvescontrolling
controlling
•• passwords
passwordsandandpassword
passwordpolicies
policies
•• Access
Accessto
todata
dataon onservers
servers
•• Access
Accessto
tobackup
backuptapes
tapes
•• sources
sources outside
outside the
the network
network from
from gaining
gaining access
access to
to
the
thenetwork
network
Computer Security/ Vulnerabilities

r iittyy
c
c uu r
ssee e ss
t e
e r
r l iittii e
p uu t bbii l
m
m p e rraa
o
Co Vuullnn
C e
V
 Computer Security /Vulnerabilities

A
A flaw
flaw or
or weakness
weakness in
in aa system’s
system’s design,
design,
implementation,
implementation, or
or operation
operation and
and management
management that
that
could
could be
be exploited
exploited to
to violate
violate the
the system’s
system’s security
security
policy
policy

Corruption
Corruption

ItItdoes
does the
the wrong
wrong thing
thing or
or gives
gives wrong
wrong answers
answers

Leaky
Leaky

For
For example,
example, someone
someone who
who should
should not
not have
have access
access to
to
 Computer Security /Vulnerabilities

Physical
Physicalvulnerabilities
vulnerabilities(Eg.
(Eg.buildings)
buildings)

Natural
Naturalvulnerabilities
vulnerabilities(Eg.
(Eg.Earthquake)
Earthquake)

Hardware
Hardwareand
andSoftware
Softwarevulnerabilities
vulnerabilities(Eg.
(Eg.Failures)
Failures)

Media
Mediavulnerabilities
vulnerabilities(Eg.
(Eg.Disks
Diskscan
canbe
bestolen)
stolen)

Communication
Communicationvulnerabilities
vulnerabilities(Eg.
(Eg.Wires
Wirescan
canbe
betapped)
tapped)

Human
Humanvulnerabilities
vulnerabilities(Eg.
(Eg.Insiders)
Insiders)
 Why are there security vulnerabilities?
Lots of buggy software...
Why do programmers write insecure code?

Some contributing factors

Courses in computer security(few/none)
Programming text books do not emphasize security
Few security audits
Programmers have many other things to worry about
Consumers do not care about security
Security is expensive and takes time
 Computer Security/ Threats

atts
s
r
r e
e a
y t
t h
h
rriitty
eccuu
r s
s e
t
tee r
p
p u
u
oomm
C
C
 Computer security/Threats
A
A computer
computer security
security threat
threat isis any
any person,
person, act,
act,or
or
object
object that
that poses
poses aa danger
danger to
to computer
computersecurity
security
circumstances
circumstances that
that have
have aa potential
potential to
to cause
cause harm
harm
Can
Can be
be

Physical
Physical -- weather,
weather, natural
natural disaster,
disaster, bombs,
bombs,
power
power failures,
failures, etc.
etc.

Human
Human -- stealing,
stealing,trickery,
trickery,bribery,
bribery,spying,
spying,
sabotage,
sabotage, accidents.
accidents.

Software-
Software- viruses,
viruses,Trojan
Trojanhorses,
horses,logic
logicbombs,
bombs,
denial
denial of
of service,
service,worms,etc.
worms,etc.
 Computer security/Threats
A
A threat
threat consequence
consequence can
can be:
be:
Unauthorized
UnauthorizedDisclosure
Disclosure
 Exposure
Exposure
•• Can
Canbe bedeliberate
deliberateor
oraccidental
accidental
 Interception
Interception
•• Unauthorized
Unauthorizedparty
partygains
gainsaccess
accessto
toaaprotected
protectedasset.
asset.
 Intrusion
Intrusion
Deception
Deception
 Masquerade
Masquerade
•• Stealing
Stealingusername/password
username/password
 Falsification
Falsification
 Repudiation/rejection
Repudiation/rejection
 Computer security/Threats
A
A threat
threat consequence
consequence can
can be:
be:
Disruption
Disruption
 Interruption
Interruption
•• An
An asset
asset of
of aa computing
computing system
systembecomes
becomeslost,
lost,
unavailable
unavailable or or unusable
unusable
 Modification
Modification
•• Unauthorized
Unauthorized party
party gains
gains access
access and
and tamper
tamper aa
protected
protected asset.
asset.
 Forgery
Forgery
•• Unauthorized
Unauthorized party
party fabricate
fabricate counterfeit
counterfeit
objects
objects on
on aa computing
computing system
system
 Computer security/Threats
Digital
Digitalthreats
threatsare
arevery
verysimilar
similarto
tophysical
physicalworld
worldthreats
threats
BUT
BUT
Automation
Automation
 Repeated
Repeated attack
attack on
on hardware/software
hardware/software weakness
weakness
isis easy.
easy.
Action
Action at at distance
distance
 InIncomputing
computing system,
system,all
allcomputers
computers are
are
equidistant.
equidistant.
Propagation
Propagation
 Computing
Computing systemsystem facilitate
facilitate reproduction
reproduction of
of data
data
or
or software.
software.

 Electronic
Electronicplan
plandistributed
distributedon
onthe
theWeb
Web

 Exploit/Crack/Serial
Exploit/Crack/Serial
 Computer Security/ Attacks

Attack
A threat that is carried out
An intelligent act that is a deliberate attempt to
evade security services and violate the security
policy of a system
Active attack:
An attempt to alter system resources or affect their
operation.
Passive attack:
 An attempt to learn or make use of information from the
system that does not affect system resources.

29
 Types of Attacks
 Passive attacks: attempts to learn or make use of information
from the system but does not affect system resources
 Eavesdropping
 Monitoring
 Active attacks: involve some modification of the data stream
 Masquerade – one entity pretends to be a different
entity
 Replay – passive capture of information and its
retransmission
 Modification– legitimate message is altered
 Denial of service – prevents normal use of
resources

30
 Computer Security/Attacks

Four
FourCategories
Categoriesof
ofAttacks/Threats
Attacks/Threats(W.
(W.Stallings)
Stallings)

Normal flow of information

Interruption Interception

Modification Fabrication
 Computer security/Attacks
Types of Threats/Attacks (Chuck Eastom)

Malware
Malware Attack:
Attack:
Hacking
Hacking Attack
Attack
Denial
Denial of
of Service
Service Attack
Attack
Physical
Physical Attack
Attack
 Computer security/Attackers
Types of Attackers
Amateurs
Amateurs
Opportunistic
Opportunisticattackers:
attackers:(use
(useaapassword
passwordthey
theyfound)
found)
Script
Scriptkiddies
kiddies
Hackers
Hackers––non-malicious
non-malicious
In
Inbroad
broaduseusebeyond
beyondsecurity
securitycommunity:
community:also
alsomalicious
malicious
Crackers
Crackers––malicious
malicious
Career
Careercriminals
criminals
Nation-supported
Nation-supportedspies
spiesand
andinformation
informationwarriors
warriors
Attackers
Attackersneed
needMOM
MOM
Method
Method :: Skill,
Skill, knowledge,
knowledge, tools,
tools, etc.
etc. with
with which
which to
to pull
pull
off
offan
anattack
attack
Opportunity:
Opportunity: Time
Timeand
andaccess
accessto
toaccomplish
accomplishan anattack
attack
Motive:
Motive: Reason
Reasonto toperform
performananattack
attack
 Computer security/Countermeasures

Any
Anymeans
meanstaken
takentotodeal
dealwith
withaasecurity
securityattack
attack
An
An action,
action, device,
device, procedure,
procedure, technique
technique that
that reduces
reduces aa
threat,
threat,attack
attackororvulnerability
vulnerabilityby
by
Eliminating
Eliminatingor orPreventing
Preventing
Reducing
Reducingthetheconsequences
consequences
Discovering
Discovering& &reporting
reportingfor
forsecurity
securityactions
actions
Can
Can be:
be:
Prevention:
Prevention: avoid
avoid attacks
attacks from
from being
being
carried
carried out
out
Detection
Detection :: identify
identify when,
when, howhow && by
by
whom
whom anan asset
asset has
has been
been damaged
damaged
Recovery:
Recovery: restore
restore assets
assets after
after the
the damage
damage
 Countermeasures
Five basic approaches to defense of computing systems
Prevent attack
 Block attack / Close vulnerability

Deter attack
 Make attack harder

Deflect attack
 Make another target more attractive than this target

Detect attack
 During or after

Recover from attack

 Computer Security / Countermeasures

Computer
Computer security
security controls
controls
Authentication (Password,
Authentication (Password, cards,
cards, biometrics)

biometrics)
Cryptography
 Cryptography
Auditing
 Auditing
Administrative

Administrative policies
policiesand
andprocedures
procedures
Standards
 Standards
Certifications
 Certifications
Physical controls// security
Physical controls

security
Laws
 Laws
Backups
 Backups