Republic of the Philippines

Northern Samar Colleges

Catarman, Northern Samar

COMPILATION LECTURES

IN

INFORMATION ASSURANCE AND

SECURITY (APC – 4)

THIRD YEAR- SECOND SEMESTER

___________________________
BSIT-III

Submitted to:

VENUS T. CAMPOSANO, LPT

IT Instructor
Chapter 1- Introduction to Information Technology
Information Assurance and Security: An Overview

This module presents fundamentals of information security where the students will learn about
the key information security concepts such as confidentiality, integrity, availability and other
opponents of a typical information system including software, hardware, data, people, etc.
Moreover, different types of malicious software (malware) will be presented including viruses,
worms, logic bombs, Trojan horses, and back doors and will discuss various security threats and
attacks including software attacks, forces of nature and equipment malfunction.

Learning Outcomes:

At the end of the lesson, you are expected to:

• Identify the relationship of physical security and cyber security.

• Identify the relationship of personnel security policies and procedures to cyber
security.
• Explain how awareness training strengthens cyber security practices.

Learning Content:

1.1 Security in Practice

1.2 What is a “Secure” Computer System?
1.3 Basic Components of Security (Confidentiality, Integrity, Availability)
1.4 System/security life-cycle
1.5 Security implementation Mechanisms
1.6 Disaster recovery (natural and man-made)

Start your lesson here.

Information security is a “well-informed sense of assurance that the information risks and
controls are in balance.” —Jim Anderson, Inovant (2002)

History of Information Security

The need for computer security, or the need to secure the physical location of hardware from
outside threats, began almost immediately after the first mainframes were developed. Groups
developing code-breaking computations during World War II created the first modern
computers. Badges, keys, and facial recognition of authorized personnel controlled access to
sensitive military locations. In contrast, information security during these early years was
rudimentary and mainly composed of simple document classification schemes.
There were no application classification projects for computers or operating systems at this time,
because the primary threats to security were physical theft of equipment, espionage against the
products of the systems, and sabotage.
What is information?

According to Blyth and Kovacich, p. 17, “Information is data endowed with relevance and
purpose. Converting data into information thus requires knowledge. Knowledge by definition is
specialized.” And the characteristics should information possess to be useful are the following:

accurate,
➢ timely,
➢ complete,
➢ verifiable,
➢ consistent,
➢ available.

According to Raggad (pp. 14ff), the following are all distinct conceptual resources:

➢ Noise: raw facts with an unknown coding system

➢ Data: raw facts with a known coding system
➢ Information: processed data
➢ Knowledge: accepted facts, principles, or rules of thumb that are useful for specific domains.
Knowledge can be the result of inferences and implications produced from simple information
facts.

Information Assurance (IA)

It is the study of how to protect your information assets from destruction, degradation,
manipulation and exploitation.
It also refers to a “Measures that protect and defend information and information systems by
ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. These
measures include providing for restoration of information systems by incorporating
protection, detection, and reaction capabilities.” According to the U.S. Department of Defense,

Information Assurance involves:

✓ Actions taken that protect and defend information and information systems by ensuring their
availability, integrity, authentication, confidentiality and non- repudiation. This includes
providing for restoration of information systems by incorporating protection, detection and
reaction capabilities.

According to the DoD definition, these are some aspects of information needing protection:

Availability: timely, reliable access to data and information services for authorized users;
Integrity: protection against unauthorized modification or destruction of information;
Confidentiality: assurance that information is not disclosed to unauthorized persons;
Authentication: security measures to establish the validity of a transmission, message, or
originator.
Non-repudiation: assurance
that the sender is provided
with proof of a data delivery
and recipient
is provided with proof of the
sender’s identity, so that
neither can later deny
having processed
the data.
Non-repudiation: assurance that the sender is provided with proof of a data delivery and
recipient is provided with proof of the sender’s identity, so that neither can later deny having
processed the data.

Thinking Box:
Which of the aspects of
information needing
protection are the most
important?
How would you decide?
Thinking Box:
Which of the aspects of information needing protection are the most important?
How would you decide?
Thinking Box:

Which of the aspects of information needing protection are the most important?

______________________________________________________________________________
______________________________________________________________________________
______________________________________________________________________________
______________________________________________________________________________
______________________________________________________________________________

Information Assurance and

______________________________________________________________________________
______________________________________________________________________________
______________________________________________________________________________

Security: An Overview
______________________________________________________________________________

How would you decide?

______________________________________________________________________________
This module presents
______________________________________________________________________________
______________________________________________________________________________

fundamentals of
______________________________________________________________________________
______________________________________________________________________________
______________________________________________________________________________

information security where

______________________________________________________________________________
______________________________________________________________________________

the students will learn

______________________________________________________________________________
______________________________________________________________________________
______________________________________________________________________________

about the
______________________________________________________________________________

key information security

concepts such as
confidentiality, integrity,
availability and other
opponents of a
typical information system
including software,
hardware, data, people, etc.
Moreover, different types of
malicious software
(malware) will be presented
including viruses, worms,
logic bombs, Trojan horses,
and
back doors and will discuss
various security threats and
attacks including software
attacks, forces of nature
and equipment
malfunction.
According to Debra Herrmann (Complete Guide to Security and Privacy
Metrics), IA should be
viewed as spanning four security engineering domains or major categories:
✓ -physical security
✓ personnel security
✓ IT security
✓ operational security

Thinking Box:

Into which of these would you put the following domain or categories?

- enforcing hard-to-guess passwords

_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
__________________________________________________________________________________

- encrypting your hard drive

_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
_______________________________________________________________________________________
__________________________________________________________________________________

- locking sensitive documents in a safe

_______________________________________________________________________________________
Four Security Domains
According to Debra
Herrmann, Complete Guide
to Security and Privacy
Metrics:

Four Security Domains

According to Debra Herrmann, Complete Guide to Security and Privacy
Metrics:
1.“Physical security refers to the protection of hardware, software, and
data against physical
threats to reduce or prevent disruptions to operations and services and loss
of assets.”
2. “Personnel security is a variety of ongoing measures taken to reduce
the likelihood and severity of accidental and intentional alteration,
destruction, misappropriation, misuse, misconfiguration, unauthorized
distribution, and unavailability of an organization’s logical and physical
assets, as the result of action or inaction by insiders and known outsiders,
such as business partners.”
3.“IT security is the inherent technical features and functions that
collectively contribute to an IT infrastructure achieving and sustaining
confidentiality, integrity, availability, accountability, authenticity, and
reliability.”
4.“Operational security involves the implementation of standard operational
security procedures that define the nature and frequency of the
interaction between users, systems, and system resources, the purpose
of which is to
a. achieve and sustain a known secure system state at all times, and
b. prevent accidental or intentional theft, release, destruction,
alteration, misuse, or sabotage of system resources.”
According to Raggad’s taxonomy of information security, a computing
environment is made up of five continuously interacting components:
1. activities,
2. people,
3. data,
4. technology,
5. networks.
According to Blyth and Kovacich, IA can be thought of as protecting
information at three distinct levels:
1. physical: which refers to a data and data processing activities in
physical space;
2. Information infrastructure: which refers to information and data
manipulation abilities in cyberspace;
3. Perceptual: which refers to knowledge and understanding in human
decision space.
A. Information Assurance Levels:

The Physical The lowest level focus of IA is the physical level which
consists of computers, physical networks, telecommunications and
supporting systems such as power, facilities and environmental controls.
Also at this level are the people who manage the systems.
Desired Effects: to affect the technical performance and the capability
of physical systems, to disrupt the capabilities of the defender.
Attacker’s Operations: physical attack and destruction, including:
electromagnetic attack, visual spying, intrusion, scavenging and removal,
wiretapping, interference, and eavesdropping.
Defender’s Operations: physical security, OPSEC, TEMPEST.

B. Information Assurance Levels: Infrastructure The second level focus

of IA is the information structure level. This covers information and data
manipulation ability maintained in cyberspace, including: data
structures, processes and programs, protocols, data content and
databases.

C. Information Assurance Levels: Perceptual The third level focus of IA

is the perceptual level, also called social engineering. This is abstract and
concerned with the management of perceptions of the target,
particularly those persons making security decisions.

Desired Effects: to influence decisions and behaviors.

Attacker’s Operations: psychological operations such as: deception,
blackmail, bribery and corruption, social engineering, trademark and
copyright infringement, defamation, diplomacy, creating distrust.
Defender’s Operations: personnel security including psychological
testing, education, and screening such as biometrics, watermarks, keys,
passwords.

Nature of the Threat

Six Types of Nature of Treat
1.
Insider – This consists of
employees, former
employees and contractors.
2.
Hackers - He is one who
gains unauthorized access
to or breaks into
information systems for
thrills, challenge, power, or
profit.
3.
Criminals- It refers to the
target information that
may be of value to them
such as bank
accounts, credit card
information, intellectual
property, etc.
4.
Corporations it actively
seeks intelligence about
competitors or steal trade
secrets.
5.
Governments and agencies
it seeks the military,
diplomatic, and economic
secrets of foreign
governments, foreign
corporations, and
adversaries. May also
target domestic
adversaries.
6.
Terrorists it usually
politically motivated and
may seek to cause
maximal damage to
information infrastructure
as well as endanger lives
and property.
Nature of the Threats
Six Types of Nature of Treat
1. Insider – This consists of employees, former employees and contractors.
2. Hackers - He is one who gains unauthorized access to or breaks into
information systems for thrills, challenge, power, or profit.
3. Criminals- It refers to the target information that may be of value
to them such as bank accounts, credit card information, intellectual
property, etc.
4. Corporations it actively seeks intelligence about competitors or steal trade
secrets.
5. Governments and agencies it seeks the military, diplomatic, and economic
secrets of foreign governments, foreign corporations, and adversaries. May
also target domestic adversaries.
6. Terrorists it usually politically motivated and may seek to cause
maximal damage to information infrastructure as well as endanger lives
and property.

Thinking Box:

Is there overlap among these categories of nature of the treat? Which do you think is the
biggest threat?

_____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________

_____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________

_____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________

_____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________
_____________________________________________________________________________

Information Assurance Functional Components

Information Assurance (IA) is both proactive and reactive involving
protection, detection, capability restoration, and response. IA environment
protection pillars: “ensure the availability, integrity, authenticity,
confidentiality, and non-repudiation of information”
Attack detection: “timely attack detection and reporting is key to initiating
the restoration and response processes.”
Capability restoration: “relies on established procedures and
mechanisms for prioritizing restoration of essential functions. Capability
restoration may rely on backup or redundant links, information system
components, or alternative means of information transfer.” “A post-attack
analysis should be conducted to determine the command vulnerabilities
and recommended security improvements.”
Attack response: “involves determining actors and their motives,
establishing cause and complicity, and may involve appropriate action
against perpetrators... contributes ... by removing threats and enhancing
deterrence.

IA Applies to Info Infrastructure

Global Information Infrastructure includes worldwide interconnection of
communication networks, computers, databases, and consumer
electronics that make vast amounts of information available to users.”
IA Relationship to Computer Security
IA includes considerations for non-security threats to information systems,
such as acts of nature and the process of recovery from incidents. IA
also emphasizes management, process, and human involvement, and not
merely technology.

IA deployments may involve multiple disciplines of security:

➢ COMPUSEC (Computer security)
➢ COMSEC (Communications security), SIGSEC (Signals security) and
TRANSEC (transmission security)
➢ EMSEC (Emanations security) denying access to information from
unintended emanations such as radio and electrical signals
➢ OPSEC (Operations security) the processes involved in protecting
information

Assets
An asset is the resource being protected, including:
a. physical assets- these are devices, computers, people;
b. logical assets - these are information, data (in transmission, storage,
or processing), and intellectual property;
c. system assets- it refers to any software, hardware, data,
administrative, physical, communications, or personnel resource within an
information system.
Subjects and Objects
Often a security solution/policy is phrased in terms of the following three
categories:
a. Objects: these are stems being protected by the system (documents,
files, directories, databases, transactions, etc.)
b. Subjects: are entities (users, processes, etc.) that execute activities
and request access to objects.
c. Actions: these are operations, primitive or complex, that can operate
on objects and must be controlled.
For example, in the Unix operating system, processes (subjects) may have
permission to perform read, write or execute (actions) on files (objects). In
addition, processes can create other processes, create and delete files, etc.
Certain processes (running with root permission) can do almost anything.
That is one approach to the security problem.

Thinking Box:

Can an entity be both a subject and an object? Why?

__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________
_________________________________________________________________________________

D. C.
__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________

E.
_________________________________________________________________________________

F. Information Assurance
Levels: Perceptual
G. The third level focus of
IA is the perceptual level,
also called social
 engineering. This is
abstract
H. and concerned with
the management of
perceptions of the
target, particularly those
persons making
I. security decisions.
J. Desired Effects: to
influence decisions and
behaviors.
K.
L. Attacker’s Operations:
psychological operations
such as: deception,
blackmail, bribery and
M. corruption, social
engineering, trademark
and copyright
infringement, defamation,
diplomacy,
N. creating distrust.
O. Defender’s Operations:
personnel security
including psychological
testing, education, and
P.screening such as
biometrics, watermarks,
keys, passwords

Critical Aspects
Information assets (objects) may have critical aspects such as:
a. availability: authorized users are able to access it;
b. accuracy: the information is free of error and has the value expected;
c. authenticity: the information is genuine;
d. confidentiality: the information has not been disclosed to unauthorized
parties;
e. integrity: the information is whole, complete and uncorrupted;
f. utility: the information has value for the intended purpose;
g. possession: the data is under authorized ownership and control.

Threat and Threat Actors

A threat is a category of entities, or a circumstance, that poses a potential
danger to an asset (through unauthorized access, destruction, disclosure,
modification or denial of service). Threats can be categorized by intent:
accidental or purposeful (error, fraud, hostile intelligence);
Threats can be categorized by the kind of entity involved: human (hackers,
someone flipping a switch), processing (malicious code, sniffers), natural
(flood, earthquake);
Threats can be categorized by impact: type of asset, consequences.
Examples of Threats

1. Interruption: an asset becomes unusable, unavailable, or lost.

2. Interception: an unauthorized party gains access to an information asset.
3. Modification: an unauthorized party tampers with an asset.
4. Fabrication: an asset has been counterfeit.
Examples:
Interruption: a denial of service attack on a website Interception:
compromise of confidential data, e.g., but packet sniffing
Modification: hacking to deface a website
Fabrication: spoofing attacks in a network
Vulnerabilities and Exploits
A vulnerability is a weakness or fault in a system that exposes information
to attack. A bug in a computer program is a very common vulnerability in
computer security (e.g. buffer overflow situation). A procedural failing can
subvert technology controls (e.g. a core dump of secure information upon a
failure). A lack of controls can result in vulnerabilities, if controls are
subverted (e.g. Enron financials).

A dangling vulnerability is one for which there is no known threat

(vulnerability is there but not exploitable). A dangling threat is one that does
not pose a danger as there is no vulnerability to exploit (threat is there, but
can’t do damage).

Thinking Box:

Can you give examples of these or situations in which they might occur?

__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________

_________________________________________________________________________________

__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________

_________________________________________________________________________________

__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________

_________________________________________________________________________________

__________________________________________________________________________________
__________________________________________________________________________________
__________________________________________________________________________________

Attacks
 An attack is an attempt to gain access, cause damage to or otherwise
compromise information and/or systems that support it.
a. Passive attack: an attack in which the attacker observes interaction with
the system.
b. Active attack: at attack in which the attacker directly interacts with the
system.
c. Unintentional attack: an attack where there is not a deliberate goal of
misuse

Thinking Box:
Mention some ways in
which the attack surface
Exposure, Compromise
can be reduced
Exposure is an instance when the system is vulnerable to attack. A
compromise is a situation in which the attacker has succeeded. An
indicator is a recognized action— specific, generalized or theoretical—
that an adversary (threat actor) might be expected to take in preparation for
an attack.
Consequences
A consequence is the outcome of an attack. In a purposeful threat, the
threat
actor has typically chosen a desired consequence for the attack, and selects
the IA objective to target to achieve this.

Countermeasures
Controls, safeguards and countermeasures are any actions, devices,
procedures, techniques and other measures that reduce the vulnerability of
an information system.
There are many kinds:
- technical
- policy, procedures and practices
- education, training and awareness
- cover and deception (camouflage)
- human intelligence (HUMINT), e.g. disinformation
- monitoring of data and transmissions
- surveillance countermeasures that detect or neutralize sensors, e.g.
TEMPEST
- assessments and inspections.