Computer security concepts

Index
• Introduction to information security
• Introduction to data security
• Introduction to network security
• NIST FIPS 199 Standards
• Assets and Threat Models

Computer Security
• Cyber security, computer security or IT security is the
protection of computer systems from theft of or damage to
their hardware, software or electronic data, as well as
from disruption or misdirection of the services they provide.

Information Security
• The internet is not a single network, but a worldwide
collection of loosely connected networks
– accessible by individual computer hosts, in a variety of ways, to
anyone with a computer and a network connection.
• Along with the convenience and easy access to information
come risks.
• Risks :- valuable information will be lost, stolen, changed, or
misused.
• If information is recorded electronically and is available on
networked computers, it is more vulnerable than if the same
information is printed on paper

Components of Security
• Confidentiality,
integrity and availability.
• CIA triad is a model
designed to guide policies
for information security
within an organization.
• The model is also
sometimes referred to as the
AIC triad
Availability

Confidentiality
• Confidentiality is roughly equivalent to privacy.
• Loss of confidentiality :- When information is read or copied
by someone not authorized to do so.
• Some information need security like- research data, medical
and insurance records, new product specifications, and
corporate investment strategies.
• Access must be restricted to those authorized to view the data
in question.
• Data to be categorized according to the amount and type of
damage that could be done should it fall into unintended
hands.

Measures to be taken
• Special training for those privy to such documents.
• Strong passwords.
• information about social engineering methods.
• Example:-
– Data encryption is a common method of ensuring
confidentiality.
– two-factor authentication

Integrity
• Integrity involves maintaining the consistency, accuracy, and
trustworthiness of data over its entire life cycle.
• Data must not be changed in transit, and steps must be taken to
ensure that data cannot be altered by unauthorized people.
• Loss of integrity :- When information is modified in
unexpected ways .

• File permissions and user access controls.
• Version control may be used to prevent erroneous changes or
accidental deletion by authorized users.
• some means must be in place to detect any changes in data that
might occur as a result of non-human-caused events such as an
electromagnetic pulse (EMP) or server crash.
• Backups or redundancies must be available to restore the
affected data to its correct state.

Availability
• Availability of information refers to ensuring that authorized
parties are able to access the information when needed.
• Information only has value if the right people can access it at
the right times.
• Information can be erased or become inaccessible, resulting in
loss of availability.
• Availability is often the most important attribute in service-
oriented businesses that depend on information .
• When users cannot access the network or specific services
provided on the network, they experience a denial of service.

• To make information available organizations use
authentication and authorization.
• Security is strong when the means of authentication cannot
later be refuted—the user cannot later deny that he or she
performed the activity. This is known as non repudiation.

• a backup copy may be stored in a geographically-isolated
location, perhaps even in a fireproof, waterproof safe.
• software such as firewalls and proxy servers can guard against
downtime and unreachable data due to malicious actions such
as denial-of-service (DoS) attacks and network intrusions.

Data Security
• Data security means protecting digital data, such as those in
a database, from destructive forces and from the unwanted
actions of unauthorized users, such as a cyber attack or a data
breach.
• Data security is an essential aspect of IT for organizations of
every size and type.
• Technologies:-
– Disk encryption
– Backup
– Data masking
– Data erasure
– Software versus hardware based mechanism for protecting data.

• Difference between data security and data privacy.
Data security is commonly referred to as the confidentiality,
availability, and integrity of data. In other words, it is all of the
practices and processes that are in place to ensure data isn't
being used or accessed by unauthorized individuals or parties
whereas data privacy is suitably defined as the appropriate use
of data. When companies and merchants use data or
information that is provided or entrusted to them, the data
should be used according to the agreed purposes.

Disk Encryption
• Disk encryption refers to encryption technology that encrypts
data on a hard disk drive.
• Disk encryption typically takes form in either software or
hardware.
• Disk encryption is often referred to as on-the-fly
encryption (OTFE) or transparent encryption.

Software versus hardware based
Mechanism for protecting data.
• Software-based security solutions encrypt the data to protect it
from theft.
• However, a malicious program or a hacker could corrupt the
data in order to make it unrecoverable, making the system
unusable.
• Hardware-based security solutions can prevent read and write
access to data and hence offer very strong protection against
tampering and unauthorized access.

• Operating systems are vulnerable to malicious attacks
by viruses and hackers.
• The data on hard disks can be corrupted after a malicious
access is obtained. Software cannot manipulate the user
privilege levels.
• The hardware protects the operating system image and file
system privileges from being tampered.
• Therefore, a completely secure system can be created using a
combination of hardware-based security and secure system
administration policies.

Backups
• Backups are used to ensure data which is lost can be recovered
from another source.
• It is considered essential to keep a backup of any data in most
industries and the process is recommended for any files of
importance to a user.

Data Masking
• Data masking of structured data is the process of masking
specific data within a database table or cell to ensure that data
security is maintained and sensitive information is not exposed
to unauthorized personnel.
• This may include masking the data from users (for example -
banking customer representatives can only see the last 4 digits
of a customers national identity number), developers (who
need real production data to test new software releases but
should not be able to see sensitive financial data), outsourcing
vendors, etc

Data erasure
• Data erasure is a method of software based
overwriting that completely destroys all electronic
data residing on a hard drive or other digital media to
ensure that no sensitive data is lost when an asset is
retired or reused.

Network Security
• Network security consists of the policies and practices
adopted to prevent and monitor unauthorized access, misuse,
modification, or denial of a computer network and network-
accessible resources.
• Network security involves the authorization of access to data
in a network, which is controlled by the network
administrator.
• Users choose or are assigned an ID and password or other
authenticating information that allows them access to
information and programs within their authority.

Types of attacks
Basis for
comparison
Active Attack Passive Attack
Basic Active attack tries to change
the system resources or affect
their operation.
Tries to read or make
use of information from
the system but does not
influence system
resources.
Modification in the
information
occurs does not take place
Harm to the system Always causes damage to the
system.
Do not cause any harm.
Threat to Integrity and availability Confidentiality

Contd…
Basis for
comparison
Active attack Passive attack
Emphasis is on Detection Prevention
Example Spoofing , phishing ,
xss,etc
Sniffing , port scanning,
etc

Authentication , Authorization and
Accounting
• Authentication, authorization and accounting (AAA) is a
system for tracking user activities on an IP-based network and
controlling their access to network resources.
• AAA is often is implemented as a dedicated server.
• These combined processes are considered important for
effective network management and security.

• Authentication
– Authentication refers to unique identifying information
from each system user, generally in the form of a
username and password. System administrators monitor
and add or delete authorized users from the system.

• Authorization
– Refers to the process of adding or denying individual user
access to a computer network and its resources.
– Users may be given different authorization levels that limit
their access to the network and associated resources.
– Authorization determination may be based on geographical
location restrictions, date or time-of-day restrictions,
frequency of logins or multiple logins by single individuals
or entities.

• Accounting
– Refers to the record-keeping and tracking of user activities
on a computer network.
– For a given time period this may include, but is not limited
to, real-time accounting of time spent accessing the
network, the network services employed or accessed,
capacity and trend analysis, network cost allocations,
billing data, login data for user authentication and
authorization, and the data or data amount accessed or
transferred.

Types of AAA servers include:
• Access Network AAA (AN-AAA) which communicates with
radio network controllers
• Broker AAA (B-AAA), which manages traffic between
roaming partner networks
• Home AAA (H-AAA)

Examples of AAA protocols include:
• Diameter, a successor to Remote Authentication Dial-In User
Service (RADIUS)
• Terminal Access Controller Access-Control System
(TACACS)
• Terminal Access Controller Access-Control System Plus
(TACACS+) a proprietary Cisco Systems protocol that
provides access for network servers, routers and other network
computing devices.

NIST FIPS 199 Standard
• NIST: National Institute of Standards and Technology
• FIPS: Federal Information Processing Standard
• The FIPS Publication Series of the NIST is the official series
of publications relating to standards and guidelines adopted
and promulgated under the provisions of Section 5131 of the
Information Technology Management Reform Act of 1996 and
the Federal Information Security Management Act of 2002 .

• This publication establishes security categories for both
information1 and information systems.
• The security categories are based on the potential impact on an
organization should certain events occur which jeopardize the
information and information systems needed by the
organization to accomplish its assigned mission, protect its
assets, fulfil its legal responsibilities, maintain its day-to-day
functions, and protect individuals.

• Security Objectives : FIPS defines three security objectives
for information and information systems:
– CONFIDENTIALITY
– INTEGRITY
– AVAILABILITY

Assets and Threat Models
• Threat modelling is a process by which potential threats, such
as structural vulnerabilities can be identified, enumerated, and
prioritized – all from a hypothetical attacker’s point of view.
• The purpose of threat modelling is to provide defenders with a
systematic analysis of the probable attacker’s profile, the most
likely attack vectors, and the assets most desired by an
attacker.

• Threat modelling answers the questions :
– “Where are the high-value assets?”
– “Where am I most vulnerable to attack?”
– “What are the most relevant threats?”
– “Is there an attack vector that might go unnoticed?”
• Early IT-based threat modelling methodologies were based on
the concept of architectural patterns.

Threat Modelling Methodologies
STRIDE Methodology
– The STRIDE approach to threat modelling was introduced
in 1999 at Microsoft, providing a mnemonic for developers
to find 'threats to our products' .
– STRIDE is a threat classification model.
– It provides a mnemonic for security threats in six
categories.

• The threat categories are:
– Spoofing of user identity
– Tampering
– Repudiation
– Information disclosure (privacy breach or data leak)
– Denial of service (D.o.S)
– Elevation of privilege

• The STRIDE was initially created as part of the process
of threat modelling.
• STRIDE is a model of threats, used to help reason and find
threats to a system.
• It is used in conjunction with a model of the target system that
can be constructed in parallel.
• This includes a full breakdown of processes, data stores, data
flows and trust boundaries.

P.A.S.T.A.
• The Process for Attack Simulation and Threat Analysis
(PASTA) is a seven-step, risk-centric methodology.
• It provides a seven-step process for aligning business
objectives and technical requirements, taking into account
compliance issues and business analysis.
• The intent of the method is to provide a dynamic threat
identification, enumeration, and scoring process.

Seven steps of PASTA:-
1.Define Business Context of Application
2.Technology Enumeration
3.Application Decomposition
4.Threat Analysis
5.Weakness / Vulnerability Identification
6.Attack Simulation
7.Residual Risk Analysis

• Once the threat model is completed security subject matter
experts develop a detailed analysis of the identified threats.
Finally, appropriate security controls can be enumerated.
• This methodology is intended to provide an attacker-centric
view of the application and infrastructure from which
defenders can develop an asset-centric mitigation strategy.

Trike
• The focus of the Trike methodology is using threat models as a
risk-management tool.
• Within this framework, threat models are used to satisfy the
security auditing process.
• Threat models are based on a “requirements model.”
• The requirements model establishes the stakeholder-defined
“acceptable” level of risk assigned to each asset class.

• Analysis of the requirements model yields a threat model form
which threats are enumerated and assigned risk values.
• The completed threat model is used to construct a risk model
based on asset, roles, actions, and calculated risk exposure.

VAST
• VAST is an acronym for Visual, Agile, and Simple Threat
modelling.
• The underlying principle of this methodology is the necessity of
scaling the threat modelling process across the infrastructure and
entire SDLC, and integrating it seamlessly into an Agile software
development methodology.
• The methodology seeks to provide actionable outputs for the unique
needs of various stakeholders: application architects and developers,
cybersecurity personnel, and senior executives.
• The methodology provides a unique application and infrastructure
visualization scheme such that the creation and use of threat models
do not require specific security subject matter expertise.

Computer security concepts

More Related Content

What's hot

Similar to Computer security concepts

More from Prachi Gulihar

Recently uploaded

Computer security concepts

Editor's Notes