Chapter One

Introduction to Computer
Security
“The
most secure
computers are those
not connected
to the Internet and
shielded
from any interference”
Outline
1.Fundamentals of computer
security
 Overview: history, vulnerabilities,
countermeasures, physical security
2.Goal of computer security
3.Security mechanisms and
techniques
 Authentication, access control,
 Computer Security and
privacy
Computer
Computer security
security is is aa
branch
branch of
of Computer
Computer
Science,
Science, focusing
focusing on
on
creating
creating aa secure
secure
environment
environment for for the
the use
use
It
Itof is
is about
about
computers.
of computers. provisions
provisions and
and
policies
policies adopted
adopted to to protect
protect
information
information and
and property
property from
from
theft,
theft, corruption,
corruption, or or natural
natural
disaster
disaster while
while allowing
allowing thethe
information
information andand property
property toto
remain
remain accessible
accessible and
and
productive
productive to to its its intended
intended
users.
users.
 Cont…

Privacy:
Privacy: The
The right
right of
of the
the individual
individual toto
be
be protected
protected against
against intrusion
intrusion into
into his
his
personal
personal life
life or
or affairs,
affairs, or
or those
those of
of his
his
family,
family, by
by direct
direct physical
physical means
means or or by
by
publication
publication ofof information.
information.
Threat:
Threat: Any
Any person,
person, act,
act, or
or object
object that
that
poses
poses aa danger
danger to
to computer
computer
security/privacy.
security/privacy.
 Cont...
Network
Network security
security on
on the
the other
other hand
hand deals
deals with
with
provisions
provisions and
and policies
policies adopted
adopted toto prevent
prevent and
and
monitor
monitor unauthorized
unauthorized access,
access, misuse,
misuse, modification,
modification, or
or
denial
denial ofof the
the computer
computer network
network and
and network-
network-
accessible
accessible resources.
resources.

Not Sufficient!!

Internet
Internet
 Security Goals

To
To ensure
ensure :CIA
:CIA
Confidentiality
Confidentiality
Confidentiality
Safeguards
Safeguards information
information
from
from being
being accessed
accessed by by
individuals
individuals without
without the
the
proper
proper clearance,
clearance,
Integrity Availaibility access
access level,
level, and
and need
need
to
to know.
know.
Integrity:
Integrity: Results
Results from
from
the
the protection
protection of
of
unauthorized
unauthorized
modification
modification or
or
destruction
destruction of
of
information.
information.
 Computer Security / History
Until
Until 1960s
1960s computer
computer security
security was
was
limited
limited to to physical
physical protection
protection of
of
computers
computers
In
In the
the 60s
60s and
and 70s
70s

Evolutions
Evolutions

Computers
Computers became
became interactive
interactive

Multiuser/Multiprogramming
Multiuser/Multiprogramming was
was invented
invented

More
More and
and more
more data
data started
started to
to be
be stored
stored in
in
computer
computer databases
databases

Organizations
Organizations and and individuals
individuals started
started to
to worry
worry
about
about

What
What the
the other
other persons
persons using
using computers
computers are are
doing
doing to
to their
their data
data
 Cont…
In
In the
the 80s
80s and
and 90s
90s

Evolutions
Evolutions
Personal
Personal computers
computers werewere popularized
popularized
LANs
LANs and
and Internet
Internet invaded
invaded the
the world
world
Applications
Applications such
such asas E-commerce,
E-commerce, E- E-
government
government andand
E-health
E-health started
started to
to develop
develop
Viruses
Viruses become
become majors
majors threats
threats

Organizations
Organizations and
and individuals
individuals started
started to
to worry
worry
about
about
Who
Who has
has access
access to
to their
their computers
computers and and
data
data
Whether
Whether theythey can
can trust
trust aa mail,
mail, aa
website, etc.
 Cont…

Famous
Famous security
security problems
problems

Morris worm –– Internet
Morrisworm Internet Worm Worm
November
November 2, 2, 1988
1988 aa worm
worm attacked
attacked moremore than
than
60,000
60,000 computers
computers around
around the
the USA
USA
The
The worm
worm attacks
attacks computers,
computers, andand when
when itit has
has
installed
installed itself,
itself, it
it multiplies
multiplies itself,
itself, freezing
freezing the
the
computer
computer
It
It exploited
exploited UNIX
UNIX security
security holes
holes inin Sendmail
Sendmail andand
Finger
Finger
AA nationwide
nationwide effort
effort enabled
enabled to
to solve
solve the
the problem
problem
within
within 12
12 hours
hours

Robert
Robert Morris
Morris became
became the the first person to
first person to be be
indicted
indicted under
under the
the Computer Fraud and
Computer Fraud and
Abuse
Abuse Act.
Act.

He was
He was sentenced
sentenced to
to three
three years
years of
of probation,
probation,
 Cont…

Famous
Famous security
security problems
problems …
…
NASA shutdown

NASA shutdown

In 1990,
In 1990, an an Australian
Australian computer
computer
science
science student
student waswas charged
charged for for
shutting
shutting down
down NASA’s
NASA’s computer
computer system
system
for
for 24
24 hours
hours
Airline computers

Airline computers
In
In 1998,
1998, aa major major travel
travel agency
agency
discovered
discovered thatthat someone
someone penetrated
penetrated itsits
ticketing
ticketing system
system and
and has
has printed
printed airline
airline
tickets
tickets illegally
illegally
Bank theft

Bank theft

 Cont…
Famous
Famous security
security problems
problems …
…

In
In Ethiopia
Ethiopia

Employees of
Employees of aa company
company managed
managed to to change
change
their
their salaries
salaries by
by fraudulently
fraudulently modifying
modifying the the
company’s
company’s database
database
In
In 1990s
1990s Internet
Internet password
password theft
theft
Hundreds
Hundreds of of dial-up
dial-up passwords
passwords were
were stolen
stolen and
and
sold
sold to
to other
other users
users
Many
Many of of the
the owners
owners lost
lost tens
tens of
of thousands
thousands of of
Birr
Birr each
each
AA major
major company
company suspended
suspended the the use
use ofof aa
remote login software
remote login software by by technicians
technicians who who were
were
looking at the
lookingat the computer
computer of of the
the General
General Manager
Manager

In
In Africa:
Africa: Cote
Coted’Ivoire
d’Ivoire

 Computer Security
/Attacks/threat/Vulnerabilities

Security
Security Attacks
Attacks

Interruption:
Interruption: An
An attack
attack on
on

availability
availability

Interception:
Interception: An
An attack
attack on
on

confidentiality
confidentiality

Modification:
Modification: An
An attack
attack on
on
 Cont…

Source

Destination
Normal flow of information
Attack

Interruption Interception

Modification Fabrication
 Computer security/ Threats &
Vulnerabilities
Threat
A threat is anything that can disrupt the operation,
functioning, integrity, or availability of a network or
system.
Threats are potential causes of unwanted events that
may result in harm to the agency and its assets.
 A threat is a manifestation of vulnerability.
 Threats exploit vulnerabilities causing impact to
assets
There are four main classes of threats:
 Structured threats
 Implemented by a technically skilled person who
is trying to gain access to your network.
 Unstructured threats
 Created by an inexperienced /non-technical
person who is trying to gain access to your
 Cont…
 Internal threats
 Occurs when someone from inside your network
creates a security threat to your network.
 External threats
 Occurs when someone from outside your network
creates a security threat to your network.
Vulnerabilities
A vulnerability is an inherent weakness in the
design, configuration, implementation, or
management of a network or system that renders it
susceptible to a threat.
Vulnerabilities are what make networks susceptible
to information loss and downtime. Every network
and system has some kind of vulnerability.
A threat is blocked by control of a vulnerability.
 Cont…
Types
Types of
of Vulnerabilities/
Vulnerabilities/ Susceptible
Susceptible to
to attack
attack

Physical
Physical vulnerabilities
vulnerabilities (Ex.
(Ex. Buildings)
Buildings)

Natural
Natural vulnerabilities
vulnerabilities (Ex.
(Ex. Earthquake,
Earthquake, fire,
fire,

water…)
water…)

Hardware
Hardware and
and Software
Software vulnerabilities
vulnerabilities (Ex.
(Ex.

Failures)
Failures)

Media
Media vulnerabilities
vulnerabilities (Ex.
(Ex. Disks
Disks can
can be
be stolen)
stolen)
 Cont…
 Vulnerabilities are classified according to the
asset class they related to:
1. Hardware
 susceptibility to humidity
 susceptibility to dust
 susceptibility to soiling
 susceptibility to unprotected storage
2. Software
 insufficient testing
 lack of audit trail
 Cont…

3. Network
 Unprotected communication lines
 Insecure network architecture

4. Personnel
 inadequate recruiting process
 inadequate security awareness

5. Site
 area subject to flood, unreliable power
source
6. Organizational
 lack of regular audits, lack of continuity
 Cont…

The vulnerability is not the attack, but rather

exploiting the weak point/loops in order to gain
access.

Vulnerability is the intersection of three

elements:

1. A system susceptibility or flaw,

2. attacker access to the flaw, and

3. attacker capability to exploit the flaw

 Cont…
A vulnerability with one or more known instances
of working and fully-implemented attacks is
classified as an exploitable vulnerability, a
vulnerability for which an exploit exists.

Fig. Threat agents, attack vectors, weakness, controls, IT asset and

 Computer Security /Security policies

Security is a continuous process of protecting an object

from unauthorized access.
 It is as state of being or feeling protected from harm.

 That object in that state may be a person, an

organization such as a business, or property such as a
computer system or a file.

An object can be in a physical state of security or a

theoretical state of security.

In a physical state, a facility is secure if it is protected

by a barrier like a fence, has secure areas both inside and
outside, and can resist penetration by intruders.
 Cont...
This state of security can be guaranteed if the
following four protection mechanisms are in place:
Deterrence: is usually the first line of defense
against intruders /who may try to gain access.
 It works by creating an atmosphere intended to
frighten intruders.
This may involve warnings of severe
consequences if security is breached.
Prevention: is the process of trying to stop
intruders from gaining access to the resources of
the system.
Barriers include firewalls, demilitarized zones
(DMZs), and use of access items like keys, access
cards, biometrics, and others to allow only
 Cont...
Detection: occurs when the intruder has
succeeded or is in the process of gaining
access to the system.
 Signals from the detection process include
alerts to the existence of an intruder.
Sometimes these alerts can be real time or
stored for further analysis by the security
personnel.
Response: is an aftereffect mechanism that
tries to respond to the failure of the first three
mechanisms.
It works by trying to stop and/or prevent
future damage or access to a facility.
 Cont…
Policy is the essential foundation of an effective information
security program.
Policy maker sets the tone and emphasis on the importance
of information security.
Objectives
 Reduced risk
 Compliance with laws and regulations
 Assurance of operational continuity, information integrity,

Whyand confidentiality
Policy?

Policies are the least expensive means of control and often

the most difficult to implement
Basic rules for shaping a policy
 Policy should never conflict with law
 Policy must be able to stand up in court if challenged

Computer Security / Countermeasures

Computer
Computer security
security controls
controls

Authentication
Authentication (Password,
(Password, Cards,
Cards,
Biometrics)
Biometrics)
(What
(What we we know,
know,
have,
have, are!)
are!)

Encryption
Encryption

Auditing
Auditing

Administrative
Administrative procedures
procedures

Standards
Standards

Certifications
Certifications

Physical
Physical Security
Security
 Computer Security / Physical Security

Physical
Physical security
security is
is much
much more
more difficult
difficult to
to achieve
achieve
today
todaythan
thansome
somedecades
decadesago.
ago.

Safe area
Safe
Safe area
area often
often is
is aa locked
locked place
place where
where only
only
authorized
authorized personnel
personnel can
can have
have access
access
-Are
-Are the
the locks
locks reliable?
reliable?

The
The effectiveness
effectiveness of
of locks
locks depends
depends on
on the
the
design,
design, manufacture,
manufacture, installation
installation and
and
maintenance
maintenance of
of the
the keys!
keys!
Surveillance
Surveillance with
with guards
guards

The
The most
most common
common in in Ethiopia
Ethiopia

Not
Not always
always the
the most
most reliable
reliable since
since it
it adds
adds aa lot
lot
of
of human
human factor
factor
 Software Security

Majority
Majority ofof security
security incidents
incidents result
result
from
from defects
defects in
in software
software design
design oror
code
code
Attackers
Attackers exploit
exploit the
the security
security holes
holes
left
left out
out by
by software
software developers
developers
Post-deployment
Post-deployment security
security is
is more
more
popular
popular than
than pre-deployment
pre-deployment
because:
because:

 Easily
Easily understood
understood by
by administrators
administrators

 Difficult
Difficult to
to get
get security
security “assurance”
“assurance”
from
from vendor
vendor
 Vendors
 Vendors are
are obsessed
obsessed by
by “time-to-market”
“time-to-market”

 Difficult to know/tailor security requirements
 Cont…
Risk
Risk Management
Management

Software
Software security
security as
as risk
risk
management!
management!
Risk:
Risk: “The
“The possibility
possibility of
of suffering
suffering
harm
harm oror loss”
loss”
Management:
Management: “The “The act
act or
or art
art ofof
treating,
treating, directing,
directing, carrying
carrying on,
on, or
or
using
using for
for aa purpose”
purpose”
Risk
Risk Management
Management is is the
the process
process
concerned
concerned withwith

 identification,
identification, measurement,
measurement, control
control
 Cont…

Risk
Risk Management
Management …
…
Methods
Methods of
of risk
risk treatment:
treatment:

 Mitigate
Mitigate or
or suppress
suppress

 Accept
Accept
 Transfer
 Transfer (insurance)
(insurance)
 Ignore
 Ignore (poor
(poor –– often
often used)
used)
Types
Types of
of countermeasures
countermeasures

 Preventive
Preventive

 Detective
Detective

 Corrective
Corrective
In
In case
case of
of risk
risk acceptance
acceptance

 Request
Request documented
documented justification
justification

 Get formal approbation (sign-off) by senior
Get formal approbation (sign-off) by senior
management
management
 Have the decision reviewed after a year
 Cont…

Software
Software Risk
Risk Management
Management

Use
Use aa high
high quality
quality software
software
engineering
engineering methodology
methodology
Risk
Risk analysis
analysis should
should be
be performed
performed at
at
every
every stage
stage of
of the
the development
development

 Requirement
Requirement analysis
analysis

 Design
Design

 Coding
Coding

 Testing,
Testing, etc
etc
 Cont…

Selecting
Selecting Technologies
Technologies
Languages
Languages

 The
The choice
choice of of aa programming
programming
language
language hashas anan impact
impact onon how
how
secure
secure the
the software
software will
will be
be

 Security
Security problems
problems are
are common
common for
for
some
some languages
languages

 C,
C, C++
C++ =>
=> Buffer
Buffer overflow
overflow

 Java
Java =>
=> Exception
Exception handling,
handling, etc
etc

 High
High level
level languages
languages hide
hide what
what they
they
are
are doing
doing (ex.
(ex. Swapping
Swapping to
to disk)
disk)

 The
The programmer
programmer doesn’t
doesn’t know
know that
that
 Cont…
Selecting
Selecting Technologies…
Technologies…
Operating
Operating systems
systems

Typical
Typical Operating
Operating Systems
Systems
(Windows,
(Windows, Linux,
Linux, etc)
etc) have
have

 Authentication
Authentication of
of users
users

 Resource access
Resource access control
control (authorization
(authorization
&& limitation)
limitation)
Memory,
Memory, Files,
Files, etc.
etc.

 Integrity
Integrity of
of shared
shared resources
resources

Operating
Operating systems
systems have
have different
different
levels
levels of
of security
security
 Cont…

Selecting
Selecting Technologies…
Technologies…

Authentication
Authentication technologies
technologies

Password
Password

Host-Based
Host-Based (ex.
(ex. IP)
IP)

Physical
Physical token
token (ex.
(ex. Smartcard)
Smartcard)

Biometrics
Biometrics
 Cont…
Open
Open Source
Source or
or Closed
Closed Source
Source

Free
Free Software
Software

 Freedoms to
Freedoms to use,
use, copy,
copy, study,
study, modify
modify andand
redistribute
redistribute both
both modified
modified and
and unmodified
unmodified copies
copies of
of
software
software programs
programs
Open
Open Source
Source

 Similar
Similar in
in idea
idea to
to "free
"free software"
software" but
but slightly
slightly less
less
rigid
rigid
FOSS/FLOSS
FOSS/FLOSS

 Free/Libre/Open-Source
Free/Libre/Open-Source Software
Software is
is the
the name
name used
used
by
by those
those who
who wish
wish to
to be
be inclusive
inclusive
We
We use
use the
the common
common name
name Open
Open
source
source Software
Software (OSS)
(OSS)
 Cont…

Open
Open Source
Source or
or Closed
Closed Source
Source …
…

OSS
OSS provides
provides aa number
number of of benefits
benefits to
to
security,
security, because
because security
security by
by
obscurity
obscurity does
does not
not work!
work!
Hackers
Hackers maymay notnot always
always need
need the
the
code
code to
to find
find security
security vulnerabilities
vulnerabilities
Reverse
Reverse engineering
engineering isis possible
possible

 Disassemblers
Disassemblers

 Decompilers
Decompilers
 Cont…
Open
Open Source
Source Software
Software
OSS
OSS model
model gives
gives some
some economic
economic incentives
incentives
for
for others
others to
to review
review your
your code
code

 Users
Users of
of the
the software
software may
may want
want to
to check
check the
the
security
security of
of the
the software
software

 Some
Some users
users who
who want
want to
to make
make changes
changes to
to the
the
software
software will
will look
look at
at the
the software
software
However,
However, you
you cannot
cannot be
be sure
sure of of the
the security
security of
of
the
the software
software just
just because
because it
it is
is OSS
OSS

 Many
Many vulnerabilities
vulnerabilities are
are hard
hard toto detect
detect

 Some
Some software
software sources
sources are
are difficult
difficult to
to read
read

 Some software
Some software sources
sources don’t
don’t have
have many
many
readers
readers
Additional
Additional vulnerabilities!
vulnerabilities!

 Cont…
Open
OpenSoftware
SoftwareSecurity
SecurityGuiding
GuidingPrinciples
Principles

Secure
Secure thethe weakest
weakest link
link
Practice
Practice defense
defense in
in depth
depth
Follow
Follow the
the principle
principle of
of least
least privilege
privilege
Compartmentalize
Compartmentalize
Keep
Keep itit simple
simple
Promote
Promote privacy
privacy
Remember
Remember that that hiding
hiding secrets
secrets is
is hard
hard
Be
Be reluctant
reluctant toto trust
trust
Use
Use your
your community
community resources
resources
 Cont…
Auditing
Auditing Software
Software
Auditing
Auditing software’s
software’s functionality
functionality is is aa complex
complex
activity
activity
Auditing
Auditing software’s
software’s security
security isis even
even more
more complex
complex
Most
Most software
software development
development companies
companies consider
consider
security
security ofof their
their software
software onlyonly once
once oror twice
twice
during
during the
the development
development cyclecycle
Software
Software teams
teams prefer
prefer toto use
use their
their time
time mainly
mainly on on
developing
developing new
new functionalities
functionalities thatthat can
can be
be seen
seen
Ideally
Ideally every
every software
software project
project should
should have
have an an
independent
independent security
security person
person oror team
team
AA good
good time
time for
for an
an initial
initial security
security analysis
analysis isis after
after
the
the preliminary
preliminary design
design

 You
You can
can avoid
avoid security
security risks
risks in
in the
the architecture
architecture of
of your
your
software
software with
with limited
limitedcost
cost
END OF CHAPTER !