Week1.

Introduction to Information
Security. Basic Terminology.

Lecture slides by Zhanbolat Seitkulov

January IITU, Information Security 1

Teaching
•  Lectures – by Me (15 lectures on a weekly
basis)
•  Labs and Practical sessions – also by Me

•  Contact
Email: [email protected]
Office 802 or 112

January IITU, Information Security 2

 Some information to help you to take
this module

January IITU, Information Security 3

Course Objectives
•  15 lectures – one per week
–  Provide overview of Security Principles
•  Encryption, Network Security, Software Security, Data and
Network Protection methods
•  Laboratory works and Quizzes
•  Prerequisites:
–  Information systems
–  Networking
•  Programming and Basic Mathematical skills
•  Attendance is desirable!
January IITU, Information Security 4
What you can get from this course
•  Why protect? What protect? How protect?
•  Sorts of threats against modern computers
and networks
–  Network attacks, types of worms and viruses
•  How the above problems is being solved in the
industry
–  Concepts of encryption, hardware and software
protection (firewall, IDS, policies and procedures)

January IITU, Information Security 5

Syllabus at a glance
•  Basic terminology.
•  Classical Encryption. Early cryptography. Rotor machines: Enigma and its
relatives.
•  Block ciphers and the Data Encryption Standard.
•  Basic concepts in Number Theory and Finite Fields
•  Advanced Encryption Standard
•  Public Key Cryptography and RSA.
•  Cryptographic Hash Function
•  Digital Signatures
•  User Identification and Authentication
•  Access Control (Authorization)
•  Network Firewalls
•  Risk Management

January IITU, Information Security 6

How to take this course: reading
Basic literature (Required Reading!):
•  Cryptography and Network Security by
William Stallings, 5th edition, 2006
•  Security in Computing by Charles P. Pfleeger
and Shari Lawrence Pfleeger, 4th edition, 2006

January IITU, Information Security 7

How to take this course: schedule
•  Attend all lectures
•  Submit assignments on time
–  Do not leave until the last minute
–  Marks will be deducted for late submission (-10% for
each day)
–  Cannot mark what is not there
–  Plagiarism … will be detected!
•  Penalty will be given according to the University’s plagiarism
policy
•  See assignment description for submission date

January IITU, Information Security 8

Assessment
•  First term
–  Laboratory works (5x10%) = 50%
–  Quizzes (5x5%) = 25%
–  Term Exam 25%
•  The same for the second term
•  Overall mark:
–  30% - 1st term
–  30% - 2nd term
–  40% - Final Examination
January IITU, Information Security 9
Questions?

January IITU, Information Security 10

Basic Concepts and Terminology
•  Vulnerability
•  Threat
•  Attack
•  Security concepts:
–  Confidentiality, Integrity, Availability
•  Security Service

January IITU, Information Security 11

Vulnerability
•  Some state of the system of being open to
attacks or injuries.
•  Example in house analogy:
–  “Open Door” is the vulnerability for thieves

January IITU, Information Security 12

Threat
•  A statement of an intention to injure, damage
or any other enemy action.
•  A potential for violation of security.
•  In case of “house” example:
–  “Loss of Money” is a threat

January IITU, Information Security 13

•  4 kind of threats:
–  Interception
–  Interruption
–  Modification
–  Fabrication

January IITU, Information Security 14

•  Interception – unauthorized access to a data.
•  For example,
–  Illegal copying of program or data files

Source: https://genesisdatabase.wordpress.com/
January IITU, Information Security 15
•  Interruption – a data of the system becomes
lost, unavailable, or unusable.
•  Examples include
–  Erasure of a program or data file
–  Malicious destruction of a hardware device

Source: https://genesisdatabase.wordpress.com/
January IITU, Information Security 16
•  Modification – unauthorized, change tamper
with a data.
•  For example,
–  Someone might change the values in a database

Source: https://genesisdatabase.wordpress.com/
January IITU, Information Security 17
•  Fabrication – E.g. Unauthorized insertion to a
existing database.

Source: https://genesisdatabase.wordpress.com/
January IITU, Information Security 18
Attack
•  An assault on system security
•  A deliberate attempt to evade security
services

•  Kind of attacks:
–  Passive attacks
–  Active attacks

January IITU, Information Security 19

Passive Attacks

Source: Cryptography and Network Security by Stallings

January IITU, Information Security 20
Passive Attacks (cont.)

Source: Cryptography and Network Security by Stallings

January IITU, Information Security 21
Active Attacks

Source: Cryptography and Network Security by Stallings

January IITU, Information Security 22
Active Attacks (cont.)

Source: Cryptography and Network Security by Stallings

January IITU, Information Security 23
Why to attack? (MOM)
•  Method: skills, knowledge, tools, etc.
•  Opportunity: time and access
•  Motive: fame, money, etc.

January IITU, Information Security 24

Key Security Concepts
•  Used to prevent weaknesses from being
exploited
– Confidentiality – access only by authorized users;
E.g. Student grades
– Integrity – modify only by authorized users; E.g.
Patient information
– Availability – E.g. Users want to check their
accounts

January IITU, Information Security 25

Relationship between Confidentiality,
Integrity, and Availability

January IITU, Information Security 26

How to avoid security attacks?
•  Think about vulnerabilities

January IITU, Information Security 27

•  Viruses, worms, trojans

January IITU, Information Security 28

•  Servers, server rooms, laptops, etc. (Physical
Security)

January IITU, Information Security 29

•  Data protection
–  The most important thing in majority of
information systems

January IITU, Information Security 30

How to protect? 3Ds of Security
•  Defense – reducing risks and saving costs of
incidents (E.g. Firewalls, antivirus software,
spam filters, etc.)
•  Deterrence – punishing makes attackers think
twice (E.g. Laws, organizational policies and
procedures)
•  Detection – need alert if security incident
occurs (E.g. Audit logs, intrusion detection
system, network traffic monitoring)
January IITU, Information Security 31
How to protect? Security Service
•  Enhance security of data processing systems
and information transfers of an organization
•  Intended to counter security attacks
–  Using one or more security mechanisms
•  Often replicates functions normally associated
with physical documents
–  E.g. have signatures, dates; need protection from
disclosure

January IITU, Information Security 32

Security Services
•  X.800:
–  “a service provided by a protocol layer of
communicating open systems, which ensures
adequate security of the systems or of data
transfers”
•  RFC 2828:
–  “a processing or communication service provided
by a system to give a specific kind of protection to
system resources”

January IITU, Information Security 33

Security Services (X.800)
•  Authentication – assure that communication entity is
the one claimed
•  Access Control – prevention of the unauthorized use of
a resource
•  Data Confidentiality – protection of data from
unauthorized disclosure
•  Data Integrity – assure that data received is as sent by
an authorized entity
•  Non-Repudiation – protection against denial by one of
the parties in a communication
•  Availability – resource accessible/usable.

January IITU, Information Security 34

Security Mechanisms (X.800)
•  Features designed to protect, prevent, or
recover from a security attack
•  No single mechanism that will support all
services required

•  Specific security mechanisms:

–  Encipherment, digital signatures, access controls,
data integrity, authentication

January IITU, Information Security 35

Summary
•  Basic Information Security Terminology
•  Key Security Concepts
–  Confidentiality, Integrity, Availability
•  Subject of attacks? Hardware, Software and Data
•  How to avoid attacks?
–  Think about vulnerabilities
•  How to protect?
–  3 Ds: Defense, Deter, Detect
–  Security Services

January IITU, Information Security 36

Reading
•  Cryptography and Network Security by
Stallings
•  Chapter 1:
–  Sections 1.1, 1.3, 1.4, 1.5, 1.8

January IITU, Information Security 37

 Introduction to Information
Security. Basic Terminology.
Lecture slides by Zhanbolat Seitkulov

January IITU, Information Security 38