Computer Security, Types of Attacks, Security Model,Impacts,Services,Security Aspects

1. Name of the Staff : M.FLORENCE DAYANA
Head, Dept. of CA
Bon Secours College For Women
Thanjavur.
Cryptography and Network Security

2. Principles of Information
Security, 5th Edition
2
 The quality or state of being secure—to be free
from danger”
 A successful organization should have multiple
layers of security in place:
 Physical security
 Personal security
 Operations security
 Communications security
 Network security
 Information security
What is Security

3.  Plaintext – Original Message
 Ciphertext – Coded Message
 Cipher – Algorithm for transforming plaintext to ciphertext
 Key – Information used in cipher known only to sender /
receiver
 Encipher (encrypt) – Converting plaintext to ciphertext
 Decipher(decrypt) – Converting ciphertext to plaintext
 Cryptography – Study of encryption principles/ methods
 Cryptanalysis (Code breaking) – Study of principles /
methods of deciphering ciphertext without knowing key
 Cryptology – Field of both cryptography and cryptanalysis
Some Basic Terminologies

4.  The protection afforded to an automated
information system in order to attain the
applicable objectives of preserving the
integrity, availability and confidentiality of
information system resources (includes
hardware, software, firmware,
information/data, and telecommunications)
Computer Security

5.  Computer Security - generic name for the collection
of tools designed to protect data and to thwart
hackers
 Network Security - measures to protect data during
their transmission
 Internet Security - measures to protect data during
their transmission over a collection of interconnected
networks
Definitions

6. Principles of Information
Security, 5th Edition
6
 The value of information comes from the
characteristics it possesses:
 Availability
 Accuracy
 Authenticity
 Confidentiality
 Integrity
 Utility
 Possession
Critical Characteristics of Information

7.  The principles of access control determines who
should be able to access what.
 Access control specifies and controls who can
access what.
 Eg: User X can write to file P, but can only update
files R and S
Access Control

8. Key Security Concepts

9.  can define 3 levels of impact from a security
breach
 Low
 Moderate
 High
Levels of Impact

10.  The loss could be expected to have a limited adverse effect on
organizational operations, organizational assets, or individuals.
 A limited adverse effect means that, for example, the loss of
confidentiality, integrity, or availability might
 (i) cause a degradation in mission capability to an extent
and duration that the organization is able to perform its
primary functions, but the effectiveness of the functions is
noticeably reduced;
 (ii) result in minor damage to organizational assets;
 (iii) result in minor financial loss; or
 (iv) result in minor harm to individuals.
Low Impact

11.  The loss could be expected to have a serious adverse effect on
organizational operations, assets, or individuals.
 A serious adverse effect means that, e.g., the loss might
 (i) cause a significant degradation in mission capability to an
extent and duration that the organization is able to perform its
primary functions, but the effectiveness of the functions is
significantly reduced;
 (ii) result in significant damage to organizational assets;
 (iii) result in significant financial loss; or
 (iv) result in significant harm to individuals that does not
involve loss of life or serious, life-threatening injuries.
Moderate Impact

12.  The loss could be expected to have a severe or catastrophic
adverse effect on organizational operations, organizational
assets, or individuals.
 A severe or catastrophic adverse effect means that, for
example, the loss might
 (i) cause a severe degradation in or loss of mission
capability to an extent and duration that the organization is
not able to perform one or more of its primary functions;
 (ii) result in major damage to organizational assets;
 (iii) result in major financial loss; or
 (iv) result in severe or catastrophic harm to individuals
involving loss of life or serious life threatening injuries.
High Impact

13.  confidentiality – student grades
 integrity – patient information
 availability – authentication service
 authenticity – admission ticket
 non-repudiation – stock sell order
Examples of Security Requirements

14.  Confidentiality (privacy)
 Authentication (who created or sent the data)
 Integrity (has not been altered)
 Non-repudiation (the order is final)
 Access control (prevent misuse of resources)
 Availability (permanence, non-erasure)
 Denial of Service Attacks
 Virus that deletes files
Security Services

15. 1. not simple – easy to get it wrong
2. must consider potential attacks
3. procedures used counter-intuitive
4. involve algorithms and secret info
5. must decide where to deploy mechanisms
6. battle of wits between attacker / admin
7. not perceived to be of benefit until it fails
8. requires regular monitoring a process, not an event
Computer Security Challenges

16.  consider 3 aspects of information security:
 security attack
 security mechanism (control)
 security service
 note terms
 threat – a potential for violation of security
 vulnerability – a way by which loss can happen
 attack – an assault on system security, a deliberate
attempt to evade security services
Aspects of Security

17. Attacks, Services and Mechanisms
 Security Attack: Any action that compromises the security
of information.
 Security Mechanism: A mechanism that is designed to
detect, prevent, or recover from a security attack.
 Security Service: A service that enhances the security of
data processing systems and information transfers. A
security service makes use of one or more security
mechanisms.

18. Passive Attack - Interception

19. Observe traffic pattern
Passive Attack: Traffic Analysis

20. Block delivery of message
Active Attack: Interruption

21. Fabricate message
Active Attack: Fabrication

22. Active Attack: Replay

23. Modify message
Active Attack: Modification

24.  Passive attacks – focus on Prevention
• Easy to stop
• Hard to detect
 Active attacks – focus on Detection and Recovery
• Hard to stop
• Easy to detect
Handling Attacks

25.  a.k.a. control
 feature designed to detect, prevent, or recover
from a security attack
 no single mechanism that will support all
services required
 however one particular element underlies
many of the security mechanisms in use:
 cryptographic techniques
 hence our focus on this topic
Security Mechanism

26. Model for Network Security

27.  using this model requires us to:
1. design a suitable algorithm for the security
transformation
2. generate the secret information (keys) used by
the algorithm
3. develop methods to distribute and share the
secret information
4. specify a protocol enabling the principals to use
the transformation and secret information for a
security service
Model for Network Security

28. Model for Network Access Security

29. Model for Network Access Security
 using this model requires us to:
1. select appropriate gatekeeper functions to
identify users
2. implement security controls to ensure only
authorised users access designated information or
resources
 note that model does not include:
1. monitoring of system for successful penetration
2. monitoring of authorized users for misuse
3. audit logging for forensic uses, etc.
Model for Network Access Security

30. Thank You..