Welcome to COSC4036

(Computer Security)
Chapter One
Introduction to Computer
Security
Overview
 Computer security is about provisions and policies
adopted to protect information and property from
theft, corruption, or natural disaster while allowing
the information and property to remain accessible
and productive to its intended users.
 Privacy is the right of the individual to be protected
against intrusion into his personal life or affairs, or
those of his family

2
Overview /Cont…
 Computer Security when there is connection to
networks (Network security) on the other hand deals
with provisions and policies adopted to prevent and
monitor unauthorized access, misuse, modification, or
denial of the computer network and network-
accessible resources.

Physical Security
Not Sufficient!!

Internet
Internet

3
History
 Until 1960s computer security was limited to physical protection of
computers
 In the 60s and 70s
– Evolutions
• Computers became interactive
• Multiuser/Multiprogramming was invented
• More and more data started to be stored in computer
databases.
– Organizations and individuals started to worry about
• What the other persons using computers are doing to their
data
• What is happening to their private data stored in large
databases. 4
History /Cont…
 In the 80s and 90s
– Evolutions
• Personal computers were popularized
• LANs and Internet invaded the world
• Applications such as E-commerce, E-government and
E-health started to develop
• Viruses become majors threats
– Organizations and individuals started to worry about
• Who has access to their computers and data
• Whether they can trust a mail, a website, etc.
• Whether their privacy is protected in the connected
world 5
History /Cont…
 Famous security problems
– Morris worm – Internet Worm
• November 2, 1988 a worm attacked more than 60,000 computers
around the USA
• The worm attacks computers, and when it has installed itself, it
multiplies itself, freezing the computer
• It exploited UNIX security holes in Sendmail and Finger
• A nationwide effort enabled to solve the problem within 12 hours
– Robert Morris became the first person to be indicted under the
Computer Fraud and Abuse Act.
• He was sentenced to three years of probation, 400 hours of
community service and a fine of $10,050
– Until recently, he has been an associate professor at the Massachusetts
Institute of Technology (MIT).
6
History /Cont…
 Famous security problems …
– NASA shutdown
• In 1990, an Australian computer science student was
charged for shutting down NASA’s computer system for
24 hours
– Airline computers
• In 1998, a major travel agency discovered that
someone penetrated its ticketing system and has
printed airline tickets illegally
– Bank theft
• In 1984, a bank manager was able to steal $25 million
through un-audited computer transaction.
7
History /Cont…
 Famous security problems …
 In Ethiopia
– Employees of a company managed to change their salaries by
fraudulently modifying the company’s database
– In 1990s Internet password theft
• Hundreds of dial-up passwords were stolen and sold to other
users
• Many of the owners lost tens of thousands of Birr each
– A major company suspended the use of a remote login software
by technicians who were looking at the computer of the General
Manager
 In Africa: Cote d’Ivoire
o An employee who has been fired by his company deleted all the
8
data in his company’s computer.
History /Cont…
 Early Efforts
 1960s: Marked as the beginning of true computer security
 1970s: Tiger teams
o Government and industry sponsored crackers who attempted to break down
defenses of computer systems in order to uncover vulnerabilities so that
patches can be developed
 1970s: Research and modeling
o Identifying security requirements
o Formulating security policy models
o Defining guidelines and controls
o Development of secure systems
 Standardization
 1985: Orange Book for Security Evaluation (or TCSEC - Trusted Computer System
Evaluation Criteria)
o Describes the evaluation criteria used to assess the level of trust that can be
placed in a particular computer system
 1978: DES selected as encryption standard by the US

9
History /Cont…
Legal Issues
 In the US, legislation was enacted with regards to computer
security and privacy starting from late 1960s
 The European Council adopted a convention on Cyber-crime
in 2001
 The World Summit for Information Society considered
computer security and privacy as a subject of discussion in
2003 and 2005
In Ethiopia
 The Ethiopian Penal Code of 2005 has articles on data and
computer related crimes
 Computer Crime Proclamation 2016

10
Basic Security Objectives (Pillars) - CIA
Confidentiality: This term covers two Confidentiality
related concepts:
 Data confidentiality: Assures that
private or confidential information or
resources (resource and configuration
hiding) are not made available or Integrity Availability
disclosed to unauthorized individuals

 Is compromised by reading and copying

 In network communication, it means only sender and
intended receiver should “understand” message contents
 Privacy: Assures that individuals control or influence what
information related to them may be collected and stored and
by whom and to whom that information may be disclosed
11
Security Objectives /Cont…
 Integrity: This term covers two related concepts
 Data integrity: Assures that information and programs are
changed only in a specified and authorized manner
 In network communication, sender and receiver want
to ensure that the message is not altered (in transit or
afterwards) without detection
 System integrity: Assures that a system performs its
intended function in an unimpaired manner, free from
deliberate or inadvertent unauthorized manipulation of
the system
 Is compromised by deleting, corrupting, and tampering
with

12
Security Objectives /Cont…
 Availability: Assures that systems work promptly and
service is not denied to authorized users
 Authenticity: Some say it is a missing component of
objectives in CIA. It is the property of being genuine
and being able to be verified and trusted; confidence
in the validity of a transmission, a message, or
message originator; or sender and receiver want to
confirm the identity of each other

13
Security Objectives /Cont…
Commercial example
 Confidentiality: patient’s medical information should not be
improperly disclosed
 Integrity: patient’s medical information should be correct
 Availability: patient’s medical information can be accessed
when needed for treatment
Education example
 Confidentiality: Student’s information should not be disclosed
 Integrity: student’s information must be correct
 Availability: Student’s information has to be accessed by those
allowed anytime

14
Computer security/ Threats
 A computer security threat is any person, act, or object that
poses a danger to computer security
 circumstances that have a potential to cause harm
 Can be
– Physical - weather, natural disaster, bombs, power failures,
etc.
– Human - stealing, trickery, bribery, spying, sabotage,
accidents.
– Software- viruses, Trojan horses, logic bombs, denial of
service, worms,etc.

15
Computer Security/ Attacks
Attack
 A threat that is carried out
 An intelligent act that is a deliberate attempt to evade
security services and violate the security policy of a system
Active attack:
o An attempt to alter system resources or affect their
operation.
Passive attack:
o An attempt to learn or make use of information from the
system that does not affect system resources.

16
Categories of Attacks
 Interruption: An attack on availability
 Interception: An attack on confidentiality
 Modification: An attack on integrity
 Fabrication: An attack on authenticity

17
 Source

Destination
Normal flow of information
Attack

Interruption Interception

Modification Fabrication

18
Goals of Security
 Given a security policy’s specification of “secure” and
“nonsecure” actions, security mechanisms can prevent (defend)
the attack, detect the attack, or recover from the attack
 Prevention/Defence: take measures to prevent the damage;
it means that an attack will fail; e.g., passwords to prevent
unauthorised users or Intrusion Prevention Systems (IPSs)
 Detection: if an attack cannot be prevented; when, how and
who of the attack have to be identified; e.g., when a user
enters a password three times; Intrusion Detection Systems
(IDSs)
 Recovery/Reaction: take measures to recover from the
damage; e.g., restore deleted files from backup; sometimes
retaliation (attacking the attacker’s system or taking legal
actions to hold the attacker accountable)
 The three strategies are usually used together
 A fourth approach is deterrence; involves active steps to beat off 19
attacks; discourage them even to try attacking
Goals of Security / Cont…
 Example 1: Protecting valuable items at home from a burglar
 Prevention: locks on the door, guards, hidden places, etc.
 Detection: burglar alarm, guards, Closed Circuit Television
(CCTV), etc.
 Recovery: calling the police, replace the stolen item, etc.
 Example 2: Protecting a fraudster from using our credit card in
Internet purchase
 Prevention: Encrypt when placing order, perform some check
before placing order, or don’t use credit card on the Internet
 Detection: A transaction that you had not authorized appears
on your credit card statement
 Recovery: Ask for new card, recover cost of the transaction
from insurance, the card issuer or the merchant
20
Computer Security/ Controls
 Security controls refer to mitigation techniques to achieve security
goals (prevention, detection, recovery)
A. Authentication (Password, Card, Biometrics) - For Prevention
(What the entity knows, has, is!)
 Authentication is the binding of an identity to a subject
 An entity must provide information to enable the system to confirm
its identity. This information comes from one (or a combination) of
the following
 What the entity knows (such as passwords or secret
information)
 User name: serves to identify user data stored in the system
 Password: establishes authenticity
 Password file contains not passwords, but their hash
values
21
Computer Security/ Controls…
 What the entity has (such as a badge or card)
 What the entity is (such as fingerprints or retinal characteristics -
Biometrics)
 Such attributes are suitable for biometric identification if the
following requirements are met:
 Pervasiveness: everybody has this attribute
 Uniqueness: any two people differ in their values of this
attribute
 Permanence: attribute value does not change with time
 Measurability: attribute can be measured
 Biometric system practices pattern recognition or comparison
 Attributes of a human are measured, and the measured data
are compared with stored data
22
Computer Security/ Controls…
 The goal is either
 verification: is it actually Alice? (comparison with
Alice’s stored data - typically for authentication) or
 identification: who is it? - typically for fighting crime
 Practical Systems

(a) Fingerprint system for computer authentication

(b) Fingerprint system for authentication of customers,
prior to charging a credit card
(c) Lock with fingerprint system

23
Computer Security/ Controls…
 Benefits with biometrics as opposed to passwords
 Simple and intuitive usage
 Forgery is difficult
 No oblivion (not forgettable like passwords), loss, theft
 The user must be present for authentication
B. Encryption - For Prevention and Detection
C. Auditing - For Recovery
 Auditing is essential for recovery and accountability
 Auditing is the process of analyzing systems to determine what
actions took place and who performed them; It is the analysis of
log records to present information about the system in a clear
and understandable manner
 Logging is the basis for most auditing; It is the recording of
events or statistics to provide information about system use and
performance 24
Computer Security/ Controls…
D. Administrative procedures - For Prevention,
Recovery and Deterrence
E. Standards and Best Practices - For Prevention
F. Physical Security - For Prevention
G. Laws - For Deterrence
H. Intrusion Detection/Prevention Systems - For
Detection/Prevention
I. Software Patches - For Prevention
J. Anti-malware - For Prevention
K. Access Control Technologies (Firewalls,
Authentication and Authorization Technologies) -
For Prevention
25
The Human Factor
 The human factor is an important component of computer
security
 Some organizations view technical solutions as “their
solutions” for computer security. However:
 Technology is fallible
 Ex. UNIX holes that opened the door for Morris worm
 The technology may not be appropriate
 Ex. It is difficult to define all the security requirements
and find a solution that satisfies those requirements
 Technical solutions are usually (very) expensive
 Ex. Antivirus purchased by ETC to protect its Internet
services
 Someone, a human, has to implement the solution

26
The Human Factor /Cont…
 Competence of the security staff
Ex. Crackers may know more than the security team
 Understanding and support of management
Ex. Management does not want to spend money on security
 Staff’s discipline to follow procedures
Ex. Staff members choose simple passwords
 Staff members may not be trustworthy
Ex. Bank theft

27
Physical Security
“The most robustly secured computer that is left sitting
unattended in an unlocked room is not at all secure !!”
[Chuck Easttom]

 Physical security is the use of physical controls to

protect premises, site, facility, building or other physical
asset of an organization [Lawrence Fennelly]
 Physical security protects your physical computer
facility (your building, your computer room, your disks
and other media) [Chuck Easttom]
 Physical security was overlooked in the past few years
by organizations because of the emphasis placed on
improving cyber security

28
Physical Security /Cont…
 In the early days of computing, physical security was simple
because computers were big, standalone, expensive machines
 It was almost impossible to move them (not portable)
 They were very few and it is affordable to spend on
physical security for them
 Management was willing to spend money
 Everybody understands and accepts that there is
restriction

29
Physical Security /Cont…
 Today
 Computers are more and more portable (PC, laptop,
Smart phone)
 There are too many of them to have good physical
security for each of them
 They are not “too expensive” to justify spending more
money on physical security until a major crisis occurs
 Users don’t accept restrictions easily
 Accessories (e.g., network components) are not
considered as important for security until there is a
problem
 Access to a single computer may endanger many more
computers connected through a network
Physical security is much more difficult to achieve today than
some decades ago
30
Computer Security / Vulnerabilities
 A flaw or weakness in a system’s design,
implementation, or operation and management that
could be exploited to violate the system’s security
policy
Types of Vulnerabilities
 Physical vulnerabilities (Eg. buildings)
 Natural vulnerabilities (Eg. Earthquake)
 Hardware and Software vulnerabilities (Eg. Failures)
 Media vulnerabilities (Eg. Disks can be stolen)
 Communication vulnerabilities (Eg. Wires can be
tapped)
 Human vulnerabilities (Eg. Insiders)

31
Some of the vulnerabilities in brief
1. Natural Disasters
Fire and smoke
 Fire can occur anywhere
 Solution – Minimize risk
 Good policies: No Food and Drinks, No Smoking, etc.
 Fire extinguisher, good procedure and training
 Fireproof cases (and other techniques) for backup tapes
 Fireproof doors
Climate
 Heat
 Direct sun
 Humidity

32
Some of the vulnerabilities in brief…
 Hurricane, storm, cyclone
 Earthquakes
 Water
Flooding can occur even when a water tab is not
properly closed
 Electric supply
Voltage fluctuation
o Voltage regulator
 Lightning
Avoid having servers in areas often
hit by Natural Disasters!

33
Some of the vulnerabilities in brief…
2. People
 Intruders
o Thieves
o People who have been given access unintentionally by
insiders
o Employees, contractors, etc., who have access to the
facilities
 External thieves
o Portable computing devices can be stolen outside the
organization’s premises
3. Loss of a computing device
 Mainly laptop

34
Safe Area
 Safe area is often a locked place where only authorized
personnel can have access
 Organizations usually have safe area for keeping
computers and related devices
 Challenges
 Is the area inaccessible through other opening
(window, roof-ceilings, ventilation hole, etc.)?
Design of the building with security in mind
Know the architecture of your building
 During opening hours, is it always possible to detect
when an unauthorized person tries to get to the safe
area?
Surveillance/guards, video-surveillance, automatic
doors with security code locks, alarms, etc.
Put signs so that everybody sees the safe area
35
Safe Area /Cont…
 Are the locks reliable?
 The effectiveness of locks depends on the design,
manufacture, installation and maintenance of the keys
 Among the attacks on locks are
 Illicit keys
 Duplicate keys
o Avoid access to the key by unauthorized persons
even for a few seconds
o Change locks/keys frequently
o Key management procedure
 Lost keys
o Notify responsible person when a key is lost
o There should be no label on keys
36
Safe Area /Cont…
 Circumventing of the internal barriers of the lock
 Directly operating the bolt completely bypassing
the locking mechanism which remains locked
 Forceful attacks
 Punching, Drilling, Hammering, etc
 Surveillance with Guards
o The most common in Ethiopia
o Not always the most reliable since it adds a lot of human
factor
o Expensive in terms of manpower requirement
o Not always practical for users (employees don’t like to be
questioned by guards wherever they go)

37
Safe Area /Cont…
 Surveillance with Video
 Use of Closed Circuit Television (CCTV) that started in the 1960s
 Became more and more popular with the worldwide increase of
theft and terrorism
Advantages
 A single person can monitor more than one location
 The intruder doesn’t see the security personnel
 It is cheaper after the initial investment
 It can be recorded and be used for investigation
 Since it can be recorded the security personnel are more careful
 Today’s digital video surveillance can use advanced techniques
such as face recognition to detect terrorists, wanted people, etc.
Drawback
 Privacy concerns
38
Internal Human Factor - Personnel
 Choose employees carefully
o Personal integrity should be as important a factor in the hiring
process as technical skills
 Create an atmosphere in which the levels of employee loyalty,
morale, and job satisfaction are high
 Remind employees, on a regular basis, of their continuous
responsibilities to protect the organization’s information
 Establish procedures for proper destruction and disposal of obsolete
programs, reports, and data
 Act defensively when an employee must be discharged, either for
cause or as part of a cost reduction program
o Such an employee should not be allowed access to the system
and should be carefully watched until s/he leaves the premises
o Any passwords used by a former employee should be
immediately disabled
39
Security Policy and Mechanism
 Policy: a statement of what is, and is not allowed.
 Security Mechanism: a procedure, tool, or method of
enforcing a policy. E.g.
• Encryption
• Authentication
• Authorization
• Auditing…
 Security mechanisms implement functions that help prevent,
detect, and respond to recovery from security attacks.

40
Some of commonly accepted aspects of security mechanism
 Authentication - assurance that the communicating entity is
the one claimed
 Access Control - prevention of the unauthorized use of a
resource
 Data Confidentiality –protection of data from unauthorized
disclosure
 Data Integrity - assurance that data received is as sent by an
authorized entity
 Non-Repudiation - protection against denial by one of the
parties in a communication

41
Software security assurance (SSA)
 is an approach to designing, building, and implementing
software that addresses security needs from the ground up.
 is the confidence that software will run as expected and be free
of vulnerabilities.
 Three standard techniques use to ensure software security
includes:
 Security by design
o These principles establish the context by determining all
the elements that compromise an application and its
desired functionalities.
 Continuous reviews
o This makes software security assurance an ongoing
process.
 Penetration testing
o provides an additional guarantee of security by simulating
a cyber attack on an application and probing for any
potentially exploitable weaknesses.
42
Questions
?

43