Unit 6.

Security
6.1. Security Goals
Measures to prevent a person from illegally using resources in a computer system, or interfering with
them in any manner. These measures ensure that data and programs are used only by authorized users
and only in a desired manner, and that they are neither modified nor denied to authorized users.
Security measures deal with threats to resources that come from outside a computer system, while
protection measures deal with internal threats. Passwords are the principal security tool.

Goal of Security System

• Integrity: Users with insufficient privileges should not alter the system’s vital files and
resources, and unauthorized users should not be permitted to access the system’s objects.
• Secrecy: Only authorized users must be able to access the objects of the system. Not everyone
should have access to the system files.
• Availability: No single user or process should be able to eat up all of the system resources;
instead, all authorized users must have access to them. A situation like this could lead to service
denial. Malware in this instance may limit system resources and prohibit authorized processes
from using them.

6.2. Security Attacks

A vulnerable application could subject people and systems to several kinds of harm. An attack occurs
when a malevolent actor takes advantage of security flaws or vulnerabilities to harm others. In this
article, we’ll examine various attack methods, so that you’ll know what to watch out for when
safeguarding your application.

1. Active Attacks
An active assault tries to change system resources or interfere with their functionality. Active attacks
entail some form of data stream manipulation or false statement generation. Active attacks can take the
following forms:

Masquerade
When one entity impersonates another, it commits a masquerade attack. One of the other active attack
types is included in a masquerade attack. An authorisation process can become extremely vulnerable to
a disguised attack if it isn’t always completely safeguarded. Masquerade attacks can be carried out via
stolen logins and passwords, by spotting holes in programmes, or by figuring out a way to get around
the authentication procedure.

Compiled by: Er Rupesh Shrestha NPI, DCOM III/I

 Modification of Messages
Modification denotes that a communication has been delayed, reordered, or had a piece of it changed to
achieve an unlawful effect. Modification compromises the accuracy of the source data. In essence, it
indicates that unauthorized individuals not only access data but also spoof it by initiating denial-of-
service attacks, such as modifying sent data packets or flooding the network with false data. An assault
on authentication is manufacturing. A notification that originally said, “Allow JOHN to view
confidential file X,” for instance, is changed to say, “Allow Smith to read confidential file X.”

Repudiation
This attack happens when the login control gets tampered with or the network is not totally secure.
With this attack, the author’s information can be altered by malicious user actions in order to save fake
data in log files, up to the broad alteration of data on behalf of others, comparable to the spoofing of
email messages.
Replay
When the network is not completely secure or the login control is tampered with, an attack occurs.
With this attack, the information of the author can be changed by malicious user actions to save
suspicious data in log files, up to the widespread alteration of data on behalf of others, similar to the
spoofing of email messages.

Denial of Service
Denial of service hinders the regular use of communication infrastructure. There may be a specified
target for this attack. An entity might, for instance, suppress all messages sent to a specific location.
Another example of service denial is when an entire network is disrupted, either by network
disablement or message overload that lowers performance.

2. Passive Attacks
A passive attack does not eat up system resources and instead makes an effort to gather or use
information from the system. Attacks that are passive in nature spy on or keep track of transmission.

Compiled by: Er Rupesh Shrestha NPI, DCOM III/I

The adversary wants to intercept the transmission of information in order to collect it. The following
are examples of passive attacks:

Releasing Message Content

Sensitive or confidential information may be present in a telephone conversation, an email, or a
transmitted file. We want to keep an adversary from finding out what is being transmitted. In this type
of passive attack, the information transmitted from one person to another gets into the hands of a third
person/hacker. It jeopardises the confidentiality factor in a conversation.

Traffic Analysis
Imagine that we had a method of hiding (encrypting) data, preventing the attacker from extracting any
data from the communication even if it was intercepted.
The adversary was able to ascertain the communication host’s location and identity as well as its
frequency and message length. It could be possible to infer the nature of the message from this
information.
SIP traffic encryption is the most practical defence against traffic analysis. An attacker would need
access to the SIP proxy or call log in order to find out who made the call to accomplish this.
6.4. Cryptography Basics
Cryptography is a technique of securing information and communications through the use of codes so
that only those persons for whom the information is intended can understand and process it. Thus,
preventing unauthorized access to information. The prefix “crypt” means “hidden” and the suffix
“graphy” means “writing”.
In Cryptography, the techniques that are used to protect information are obtained from mathematical
concepts and a set of rule-based calculations known as algorithms to convert messages in ways that
make it hard to decode them. These algorithms are used for cryptographic key generation, digital
signing, and verification to protect data privacy, web browsing on the internet and to protect
confidential transactions such as credit card and debit card transactions.

Features Of Cryptography
Confidentiality: Information can only be accessed by the person for whom it is intended and no other
person except him can access it.
Integrity: Information cannot be modified in storage or transition between sender and intended
receiver without any addition to information being detected.
Non-repudiation: The creator/sender of information cannot deny his intention to send information at a
later stage.
Authentication: The identities of the sender and receiver are confirmed. As well destination/origin of
the information is confirmed.

Compiled by: Er Rupesh Shrestha NPI, DCOM III/I

Interoperability: Cryptography allows for secure communication between different systems and
platforms.
Adaptability: Cryptography continuously evolves to stay ahead of security threats and technological
advancements.

6.5. Access Control

Access Control is a method of limiting access to a system or resources. Access control refers to the
process of determining who has access to what resources within a network and under what conditions.
It is a fundamental concept in security that reduces risk to the business or organization. Access control
systems perform identification, authentication, and authorization of users and entities by evaluating
required login credentials that may include passwords, pins, bio-metric scans, or other authentication
factors. Multi-factor authentication requires two or more authentication factors, which is often an
important part of the layered defense to protect access control systems.
Authentication Factors
• Password or PIN
• Bio-metric measurement (fingerprint & retina scan)
• Card or Key
For computer security, access control includes the authorization, authentication, and audit of the entity
trying to gain access. Access control models have a subject and an object.

Components of Access Control

Authentication: Authentication is the process of verifying the identity of a user. User authentication is
the process of verifying the identity of a user when that user logs in to a computer system.
Authorization: Authorization determines the extent of access to the network and what type of services
and resources are accessible by the authenticated user. Authorization is the method of enforcing
policies.
Access: After the successful authentication and authorization, their identity becomes verified, This
allows them to access the resource to which they are attempting to log in.
Manage: Organizations can manage their access control system by adding and removing authentication
and authorization for users and systems. Managing these systems can be difficult in modern IT setups
that combine cloud services and physical systems.
Audit: The access control audit method enables organizations to follow the principle. This allows them
to collect data about user activities and analyze it to identify possible access violations.
Types of Access Control
Attribute-based Access Control (ABAC): In this model, access is granted or declined by evaluating a
set of rules, policies, and relationships using the attributes of users, systems and environmental
conditions.
Discretionary Access Control (DAC): In DAC, the owner of data determines who can access specific
resources.
History-Based Access Control (HBAC): Access is granted or declined by evaluating the history of
activities of the inquiring party that includes behavior, the time between requests and content of
requests.
Identity-Based Access Control (IBAC): By using this model network administrators can more
effectively manage activity and access based on individual requirements.
Mandatory Access Control (MAC): A control model in which access rights are regulated by a central
authority based on multiple levels of security. Security Enhanced Linux is implemented using MAC on
the Linux operating system.
Organization-Based Access control (OrBAC): This model allows the policy designer to define a
security policy independently of the implementation.
Role-Based Access Control (RBAC): RBAC allows access based on the job title. RBAC eliminates
discretion on a large scale when providing access to objects. For example, there should not be
permissions for human resources specialist to create network accounts.
Rule-Based Access Control (RAC): RAC method is largely context based. Example of this would be
only allowing students to use the labs during a certain time of day.

Challenges of Access Control

Distributed IT Systems: Current IT systems frequently combine internet and on-premise networks.
These systems may be distributed geographically and comprise various devices, assets, and virtual
machines. Access is allowed to all of these devices, and keeping track of them can be challenging.
Policy Management: Policy makers within the organization create policies, and the IT department
converts the planned policies into code for implementation. Coordination between these two groups is
essential for keeping the access control system up to date and functioning properly.
Monitoring and Reporting: Organizations must constantly check access control systems to guarantee
compliance with corporate policies and regulatory laws. Any violations or changes must be recognized
and reported immediately.
Access Control Models: Access control mechanisms provide varying levels of precision. Choosing the
right access control strategy for your organization allows you to balance acceptable security with
employee efficiency.

Compiled by: Er Rupesh Shrestha NPI, DCOM III/I

6.6. Protection Mechanisms
System protection in an operating system refers to the mechanisms implemented by the operating
system to ensure the security and integrity of the system. System protection involves various
techniques to prevent unauthorized access, misuse, or modification of the operating system and its
resources.
There are several ways in which an operating system can provide system protection:
User authentication: The operating system requires users to authenticate themselves before accessing
the system. Usernames and passwords are commonly used for this purpose.
Access control: The operating system uses access control lists (ACLs) to determine which users or
processes have permission to access specific resources or perform specific actions.
Encryption: The operating system can use encryption to protect sensitive data and prevent
unauthorized access.
Firewall: A firewall is a software program that monitors and controls incoming and outgoing network
traffic based on predefined security rules.
Antivirus software: Antivirus software is used to protect the system from viruses, malware, and other
malicious software.
System updates and patches: The operating system must be kept up-to-date with the latest security
patches and updates to prevent known vulnerabilities from being exploited.
By implementing these protection mechanisms, the operating system can prevent unauthorized access
to the system, protect sensitive data, and ensure the overall security and integrity of the system.
Advantages of system protection in an operating system:
• Ensures the security and integrity of the system
• Prevents unauthorized access, misuse, or modification of the operating system and its resources
• Protects sensitive data
• Provides a secure environment for users and applications
• Prevents malware and other security threats from infecting the system
• Allows for safe sharing of resources and data among users and applications
• Helps maintain compliance with security regulations and standards
Disadvantages of system protection in an operating system:
• Can be complex and difficult to implement and manage
• May slow down system performance due to increased security measures
 • Can cause compatibility issues with some applications or hardware
• Can create a false sense of security if users are not properly educated on safe computing
practices
• Can create additional costs for implementing and maintaining security measures.

Compiled by: Er Rupesh Shrestha NPI, DCOM III/I