Scribd
Upload
19 views36 pages

Computer Security

The document outlines key concepts in computer security, including definitions of security, information security, and various types of attacks and attackers. It emphasizes the importance of protecting assets, understanding vulnerabilities, and implementing controls to mitigate risks. Additionally, it provides insights into safeguarding systems through risk management, authentication, and security policies.

Uploaded by

A J
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
19 views36 pages

Computer Security

The document outlines key concepts in computer security, including definitions of security, information security, and various types of attacks and attackers. It emphasizes the importance of protecting assets, understanding vulnerabilities, and implementing controls to mitigate risks. Additionally, it provides insights into safeguarding systems through risk management, authentication, and security policies.

Uploaded by

A J
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 36

COMPUTER SECURITY

PAUL K. ARHIN JNR


(Bsc, MPHIL, PhD (C))
[CEO, EXPERT Laboratories and Analytics ; Data Analysis, Modelling & Security Group]

DEPARTMENT OF COMPUTER SCIENCE AND I.T

[email protected]

+233543360606
Do not figure on
opponents not
attacking; worry about
your own lack of
preparation.
PROFFESIONAL COURSES
1.CISSP
2.CERTIFIED ETHICAL HACKER
3.CCNA
4.CISA
5.CISM
6.CRISC
FUNCTIONAL
CODING

VRS
SPEED
VRS
SECURITY
What Is Security?
• In general, security is “the quality or state of being secure
—to be free from danger.” In other words, protection
against adversaries—from those who would do harm,
intentionally or otherwise—is the objective. National
security, for example, is a multilayered system that
protects the sovereignty of a state, its assets, its
resources, and its people. Achieving the appropriate level
of security for an organization also requires a
multifaceted system.
What Is Information Security ?
•The Committee on National Security
Systems (CNSS) defines information
security as the protection of information
and its critical elements, including the
systems and hardware that use, store,
and transmit that information.
AREAS OF SECURITY
 Personal Computer Security
Organizational Security
Internet Security
Network Security
Total Security
Key Information Security Concepts

1. ACCESS:
A subject or object’s ability to use,
manipulate, modify, or affect another
subject or object. Authorized users have
legal access to a system, whereas hackers
have illegal access to a system. Access
Key Information Security Concepts

2. Asset:
The organizational resource that is being protected.
An asset can be logical, such as a Web site,
information, or data; or an asset can be physical, such
as a person, computer system, or other tangible
object. Assets, and particularly information assets,
are the focus of security efforts; they are what those
efforts are attempting to protect.
Key Information Security Concepts

3. Attack:
An intentional or unintentional act that
can cause damage to or otherwise
compromise information and/or the
systems that support it.
Key Information Security Concepts

3. Attack:
Attacks can be ACTIVE or PASSIVE, INTENTIONAL or
UNINTENTIONAL, and DIRECT or INDIRECT.
Key Information Security Concepts

3. Attack:
Someone casually reading sensitive
information not intended for his or
her use is a passive attack.
Key Information Security Concepts

3. Attack:

A hacker attempting to break


into an information system is
an intentional attack
Key Information Security Concepts

3. Attack:

A direct attack is a hacker


using a personal computer to
break into a system.
Key Information Security Concepts

3. Attack:
An indirect attack is a hacker
compromising a system and using it to
attack other systems, for example, as part
of a botnet (slang for robot network).
Key Information Security Concepts
3. Attack:
This group of compromised computers, running software of
the attacker’s choosing, can operate autonomously or under
the attacker’s direct control to attack systems and steal user
information or conduct distributed denial-of-service
attacks. Direct attacks originate from the threat itself.
Indirect attacks originate from a compromised system or
resource that is malfunctioning or working under the
control of a threat.
Key Information Security Concepts
4. Control, safeguard, or countermeasure:

Security mechanisms, policies, or procedures


that can successfully counter attacks, reduce risk,
resolve vulnerabilities, and otherwise improve
the security within an organization. The various
levels and types of controls are discussed more
fully in the following chapters.
Key Information Security Concepts
5. Exploit:

A technique used to compromise a system. This term can be


a verb or a noun. Threat agents may attempt to exploit a
system or other information asset by using it illegally for
their personal gain. Or, an exploit can be a documented
process to take advantage of a vulnerability or exposure,
usually in software, that is either inherent in the software or
is created by the attacker. Exploits make use of existing
software tools or custom-made software components.
Key Information Security Concepts
6. Exposure:

A condition or state of being exposed. In


information security, exposure exists when
a vulnerability known to an attacker is
present.
Key Information Security Concepts
Loss:

A single instance of an information asset suffering


damage or unintended or unauthorized
modification or disclosure. When an organization’s
information is stolen, it has suffered a loss.
Key Information Security Concepts
Protection profile or security posture:

The entire set of controls and safeguards, including policy,


education, training and awareness, and technology, that
organization implements (or fails to implement) to protect the
asset. The terms are sometimes used interchangeably with the
term security program, although the security program often
comprises managerial aspects of security, including planning,
personnel, and subordinate programs.
Key Information Security Concepts
Risk:

The probability that something unwanted


will happen. Organizations must minimize
risk to match their risk appetite
Key Information Security Concepts
Subjects and objects:

A computer can be either the subject of an attack—an


agent entity used to conduct the attack—or the object of
an attack—the target entity. A computer can be both the
subject and object of an attack, when, for example, it is
compromised by an attack (object), and is then used to
attack other systems (subject)
Key Information Security Concepts
Threat:

A category of objects, persons, or other entities that


presents a danger to an asset. Threats are always
present and can be purposeful or undirected. For
example, hackers purposefully threaten
unprotected information systems, while severe
storms incidentally threaten buildings and their
contents.
Key Information Security Concepts
Vulnerability:

A weaknesses or fault in a system or protection


mechanism that opens it to attack or damage. Some
examples of vulnerabilities are a flaw in a software
package, an unprotected system port, and an unlocked
door. Some well-known vulnerabilities have been
examined, documented, and published; others remain
latent (or undiscovered).
Components of an Information
System
1. Software
2. Hardware
3. People
4. Procedure
5. Data
6. Networks
ATTACKER PROFILES
1. Hackers
2. Crackers
3. Script Kiddies
4. Spies
5. Employees
6. Cyberterrorists
How Attackers attack
1. Social Engineering
2. Scanning and Sniffing
3. Software Vulnerabilities
4. Malicious Code – Logic bomb and
Time Bomb
5. Spyware – keystroke Logger
6. Spoofing – DNS, IP, E-Mail, TCP SYN
How Attackers attack
1. PASSWORD Attack
1. Brute Force Attack trying passwords
related to the person’s name, job
title, hobbies or similar items
2. Dictionary Attack: Comparing
encrypted passwords with what it
would be like when the dictionary
word is also encrypted to check if
they are the same.
Safeguarding a System
1. Identifying, Analyzing and
Controlling Risks
2. Authentication, Access Control and
Accounting
3. Formalized Security Policy
4. Cryptography
5. Firewalls
•SOME LINUX / UNIX
SECURITY TIPS

You might also like