Download to read offline
More Related Content
Similar to Security Architectures and Models.pptx
![UiPath Automation Suite Installation (Hands-On) [2/3]](https://cdn.slidesharecdn.com/ss_thumbnails/automationsuitecommunitysession2-251015095633-a6d862f1-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
Security Architectures and Models.pptx
- 1. S E CU R I T Y A R C H I T E C T U R E S A N D M O D E L S Chapter 1
- 2. Operating System Overview Operating system: collection of programs that allows user to operate computer hardware Three layers: – Inner layer – Middle layer – Outer layer
- 4. Key functionsof an operating system: – Multitasking, multisharing – Computer resource management – Controls the flow of activities – Provides a user interface – Administers user actions and accounts – Runs software utilities and programs – Enforce security measures – Schedules jobs
- 5. The Operating SystemSecurity Environment
- 6. The Components ofan Operating System Security Environment Used as access points to the database Three components: – Memory – Services – Files
- 7. Services Main componentof operating system security environment • Operating system core utilities • Used to gain access to the OS and its features Include – User authentication – Remote access – Administration tasks – Password policies
- 8. Files Common threats: –File permission – File sharing Files must be protected from unauthorized reading and writing actions Data resides in files; protecting files protects data Read, write, and execute privileges
- 9. File Transfer FTP(File Transfer Protocol): – Internet service for transferring files from one computer to another – Transmits usernames and passwords in plaintext – Root account cannot be used with FTP – Anonymous FTP: ability to log on to the FTP server without being authenticated
- 10. Best practices: –Use Secure FTP utility if possible – Make two FTP directories: • One for uploads with write permissions only • One for downloads with read permissions only – Use specific accounts with limited permissions – Log and scan FTP activities – Allow only authorized operators
- 11. Sharing Files Naturallyleads to security risks and threats • Peer-to-peer programs: allow users to share files over the Internet • Reasons for blocking file sharing: – Malicious code – Adware and spyware – Privacy and confidentiality – Pornography – Copyright issues
- 12. Memory Hardware memoryavailable on the system • Can be corrupted by badly written software • Two options: – Stop using the program – Apply a patch (service pack) to fix it • Can harm data integrity • Can potentially exploit data for illegal use
- 13. Authentication Methods Authentication: –Verifies user identity – Permits access to the operating system • Physical authentication: – Allows physical entrance to company property – Magnetic cards and biometric measures • Digital authentication: verifies user identity by digital means
- 14. Digital Authentication Mechanism Digital certificates: digital passport that identifies and verifies holder of certificate • Digital token (security token): – Small electronic device – Displays a number unique to the token holder; used with the holder’s PIN as a password – Uses a different password each time
- 15. Digital card: –Also known as a security card or smart card – Similar to a credit card; uses an electronic circuit instead of a magnetic strip – Stores user identification information • Public Key Infrastructure (PKI): – User keeps a private key – Authentication firm holds a public key – Encrypt and decrypt data using both keys
- 16. Authorization Process thatdecides whether users are permitted to perform the functions they request • Authorization is not performed until the user is authenticated • Deals with privileges and rights
- 17. User Administration Createuser accounts • Set password policies • Grant privileges to users • Best practices: – Use a consistent naming convention – Always provide a password to an account and force the user to change it at the first logon – Protect passwords – Do not use default passwords – Create a specific file system for users – Educate users on how to select a password – Lock non-used accounts – Grant privileges on a per host basis – Do not grant privileges to all machines
- 18. Password Policies Firstline of defense • Dictionary attack: permutation of words in dictionary • Make hard for hackers entering your systems • Best password policy: – Matches your company missions – Enforced at all level of the organization
- 19. Best practices: – Password aging – Password reuse – Password history – Password encryption – Password storage and protection – Password complexity – Logon retries – Single sign-on
- 20. Vulnerabilities of Operating Systems Top vulnerabilities to Windows systems: – Internet Information Services (IIS) – Microsoft SQL Server (MSSQL) – Windows Authentication – Internet Explorer (IE) – Windows Remote Access Services – Microsoft Data Access Components (MDAC) – Windows Scripting Host (WSH) – Microsoft Outlook and Outlook Express – Windows Peer-to-Peer File Sharing (P2P) – Simple Network Management Protocol (SNMP)
- 21. – BINDDomain Name System – Remote Procedure Calls (RPC) – Apache Web Server – General UNIX authentication accounts with no passwords or weak passwords – Clear text services
- 22. E-mail Security Toolmust widely used by public • May be the tool must frequently used by hackers: – Viruses – Worms – Spam – Others • Used to send private and confidential data as well as offensive material
- 23. Used byemployees to communicate with: – Clients – Colleagues – Friends • Recommendations: – Do not configure e-mail server on the same machine where sensitive data resides – Do not disclose technical details about the e-mail server
- 24. Computer Viruses Virus – Stands for Vital Information Resources Under Siege – Is a destructive computer program written to alter the way a computer operates – Is written by individuals to cause damage to computers and the data stored on them • Some Examples of virus are – Disk Killer – W97M – Sunday – Cascade – Anna Kournikova – Lovegate
- 25. Antivirus Software Antivirussoftware – Is a software to scan the computer for viruses – Is used to remove the viruses from the computer if found • Examples of antivirus software are: – Quick Heal – Net Protector – Avast – McAfee – VX2000 – Smartdog
- 26. How to PreventA Virus Attack Precautions that you can follow to keep your computer free from viruses are: – Scan all floppy disks/pen drives before opening or copying files – Install at least one antivirus software and run it regularly – Update the antivirus software regularly to check for new viruses – Make backup copies to minimize damage if virus attack occur
- 27. Hacking Hackers orCrackers – Are people who access the computers of others without their knowledge – They are intelligent programmers, who have high knowledge of computer systems and programming languages
- 28. Misusing Personal Information Chances of the data being intercepted, deleted or altered by others can happen – When data is transferred over a large network – In chat rooms and newsgroups, where people often reveal personal details in their interaction with others. People with bad intentions use this information maliciously
- 29. Theft of Information The different types of crimes and criminals that the digital world harbours are: • Software Piracy – Is the illegal copying, distribution, or use of software without the permission of its owner • Cracking – Cracker • Break into the computers of other users by means of a network, either for the challenge or for some malicious intention • Take advantage of any breach in security on a computer and steal vital information or even cause damage to files and programs
- 30. Stealing Data – Occurs when data is transferred from one network to another where there is a risk of the information being viewed, deleted, or altered by others – Occurs when Individuals share their information online or when they buy goods online