Information Security

Dr. Pranita Upadhyaya

[email protected]
 Course Detail
 Objectives:
Upon completion of this course, students will have gained knowledge
of information security concepts, basic components and
applications.
 Class hour:
 3 Hours per week
 Total Credit Hours: 45
 Course Credit
 Total Credit : 3
 Internal Assessment: 30 Marks
 Final : 45 Marks
 Course Outline- Units

1. Introduction to Information Security- 4 Hrs

2. Malicious code and application attacks - 8 Hrs
3. Cryptography and Key Management - 8 Hrs
4. Authentication and Access Control – 5 Hrs
5. Network Security- 5 Hrs
6. Auditing and Monitoring – 4 Hrs
7. Legal, Ethical and Professional issues in InfoSec – 6 Hrs
8. Disaster Recovery and Business Continuity – 5 hrs
 References
 Lecture notes and Papers provided in the class.
 Additional references
 International Information Systems Security Certification
Consortium (ISC)2 CISSP Certification Books
 Information Systems Audit and Control Association (ISACA)
CISA Certification Books.
 EC Council Certified Ethical Hacker (CEH) Resources
 Detail Course Outline-1
 Unit 1 Introduction to Information Security 4
 The History of Information Security
 What Is Information Security?
 Critical Characteristics of Information
 Information security concepts and practices ( CIA and other practices)
 Balancing Security and Access
 Unit 2 Malicious code and application attacks 8
 Malicious code
 Password attacks
 DOS Attack
 Application attacks
 Web application security
 Reconnaissance attack
 Masquerading attack
 Detail Course Outline-2
 Unit 3 Cryptography and Key Management 8
 Basics of cryptography
 Symmetric Cryptography (DES, Triple DES, AES, Key distribution)
 Asymmetric cryptography
• Public and private keys
• RSA
• Elliptic curve
• Hash function
• Digital signatures
• PKI
 Applied cryptography
 Unit 4 Authentication and Access Control 5
 Overview of access control
 Authentication and Authorization
 Identification and authentication techniques
 Access control techniques
 Access control methodologies, implementations and administration
 Detail Course Outline-3
 Unit 5 Network Security 5
 LAN security
 Wireless security threats and mitigation
 Internet threats and security
 Remote access security management
 Network attack and countermeasures

 Unit 6 Auditing and Monitoring 4

 Auditing
 Monitoring
 Penetration-testing techniques
 Inappropriate activities
 Indistinct threats and countermeasures
 Detail Course Outline-4
 Unit 7 Legal, Ethical and Professional issues in Information Security 6
 Types of Law
 Relevant Laws ( Computer Crime, IP, Licensing, Privacy)
 International Laws and Legal Bodies
 Ethical Concepts in Information Security
 Codes of Ethics, Certifications, and Professional Organizations

 Unit 8 Disaster Recovery and Business Continuity 5

 Business continuity planning
 Business impact assessment
 BCP documentation
 Nature of disaster
 Disaster recovery planning
 Unit 1

Introduction to Information Security

 Data, Information and Knowledge
 Data
 recording of “something” measured
 Raw material, just measured
 Information
 Information is the result of processing, manipulating and organizing data
in a way that adds to the knowledge of the receiver.
 Processed data
 Knowledge
 Knowledge is normally processed by means of structuring, grouping,
filtering, organizing or pattern recognition.
 Highly structured information
 Information Systems is the collection of hardware, software, data,
people and procedures that are designed to generate information
that supports the day-to-day, operations.
 What is Information Security?
 Information security is the process of protecting information from
unauthorized access, use, disclosure, destruction, modification, or
disruption
 The protection of computer systems and information from harm, theft,
and unauthorized use.
 Protecting the confidentiality, integrity and availability of information
 Information security is an essential infrastructure technology to achieve
successful information-based society
 Highly information-based company without information security will
lose competitiveness

 What kind of protection?

 Protecting important document / computer
 Protecting communication networks
 Protecting Internet
 Protection in ubiquitous world
 Cryptology =
Cryptography + Cryptanalysis
 Cryptography : designing secure cryptosystems
 Cryptography (from the Greek kryptós and gráphein, “to write”) was
originally the study of the principles and techniques by which
information could be concealed in ciphers and later revealed by
legitimate users employing the secret key.

 Cryptanalysis : analyzing the security of cryptosystems

 Cryptanalysis (from the Greek kryptós and analýein, “to loosen” or
“to untie”) is the science (and art) of recovering or forging
cryptographically secured information without knowledge of the key.

 Cryptology : science dealing with information security

 Science concerned with data communication and storage in secure
and usually secret form. It encompasses both cryptography and
cryptanalysis.
 Historical Aspects of InfoSec -1
 Earliest InfoSec was physical security
 In early 1960, a systems administrator worked on Message of the Day
(MOTD) and another person with administrative privileges edited the
password file. The password file got appended to the MOTD.
 In the 1960s, Advanced Research Projects Agency Network
( ARPANET )was developed to network computers in distant locations
 Multiplexed Information and Computing Service (MULTICS) operating
systems was developed in mid-1960s by MIT, GE, and Bell Labs with
security as a primary goal
 In the 1970s, Federal Information Processing Standards (FIPS)
examines DES (Data Encryption Standard) for information protection
 DARPA creates a report on vulnerabilities on military information
systems in 1978

13
 Historical Aspects of InfoSec -2
 In the 1980s the security focus was concentrated on
operating systems as they provided remote
connectivity
 In the 1990s, the growth of the Internet and the growth
of the LANs contributed to new threats to
information stored in remote systems
 IEEE, ISO, ITU-T, NIST, ISACA, (ISC)2 and other
organizations started developing many standards for
secure systems
 Information security is the protection of information and
the systems and hardware that use, store, and transmit
information

14
 Information Security Today

 Modern information security is influenced by many external and internal factors. It is a balance between
meeting the expectations and regulations of customers and government, and protecting the assets of the
shareholders in a cost effective manner.
 CIA Traid
 Confidentiality - Is the concept
of protecting the secrecy and
privacy of information
 Integrity - Is the concept of
protecting the “accuracy” of
information processing and data
from improper modification.
 Availability - Is the concept of
ensuring that the systems and
data can be accessed when
required.
Data Confidentiality
Data Confidentiality
Data Integrity
Data Integrity
Data Availability
Data Availability
Extended CIA Triangle
CIA of different components
But…….the question may arise…
 CNSS Security Model

Technology

Education

Policy

Confidentiality

Integrity

Availability

Storage Processing Transmission

CNSS: (United States) Committee on National Security Systems 26

CNSS Security Model
Information States
CNSS Security Model Contd..
CNSS Security Model Contd..
CNSS Security Model Contd..
 Security Threats

 Interruption/Denial of service
 Interception: eavesdropping(secretly listening),
wiretapping ( practice of connecting a listening device),
theft …
 Modification
 Fabrication(making)/Forgery
 Unauthorized access
 Denial of facts
 Security Services

 Security services
 A service that enhances information security using one or
more security mechanisms
 Confidentiality/Secrecy  Interception
 Authentication  Forgery
 Integrity  Modification
 Non-repudiation  Denial of facts
 Access control  Unauthorized access
 Availability  Interruption
 Security Needs for Communications
Confidentiality Authentication Availability

Interception Forgery Denial of Service

Is Private? Who am I dealing with? Wish to access!!

Integrity Non-Repudiation Access Control

Not
SENT !

Modification Claim Unauthorized access

Has been altered? Who sent/received it? Have you privilege?