Scribd
Upload
4 views21 pages

Computer Security

Computer security

Uploaded by

leonardomakona05
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
4 views21 pages

Computer Security

Computer security

Uploaded by

leonardomakona05
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 21

COMPUTER SECURITY

Computer security
T. Mutero

1
What security is about in
general?
• Security is about protection of assets
• D. Gollmann, Computer Security, Wiley

• Prevention
• take measures that prevent your assets from being
damaged (or stolen)

• Detection
• take measures so that you can detect when, how,
and by whom an asset has been damaged

• Reaction
• take measures so that you can recover your assets

2
Real world example
• Prevention
• locks at doors, window bars, secure the walls
around the property, hire a guard

• Detection
• missing items, burglar alarms, closed circuit
TV

• Reaction
• attack on burglar (not recommended ), call
the police, replace stolen items, make an
insurance claim
3
Internet shopping
example
• Prevention
• encrypt your order and card number, enforce
merchants to do some extra checks, using PIN even
for Internet transactions, don’t send card number via
Internet

• Detection
• an unauthorized transaction appears on your credit
card statement

• Reaction
• complain, dispute, ask for a new card number, sue (if
you can find of course )
• Or, pay and forget (a glass of cold water) 

4
Physical versus Logical security

• Traditional Information Security (physical


security
• keep the cabinets locked
• put them in a secure room
• human guards
• electronic surveillance systems
• in general: physical and administrative
mechanisms

• Modern World (logical security)


• Data are in computers
• Computers are interconnected
5
Types of attacks on Data

• Source of attacks
• Insiders
• Outsiders

• against hackers (intrusion)


• against viruses
• against denial of service attacks
• etc. (all types of malicious behavior)

6
The Security
Requirements Triad

Computer Security
The protection afforded to an automated
information system in order to attain the
applicable objectives of preserving the
integrity, availability and confidentiality of
information system resources (includes
hardware, software, firmware,
information/data, and telecommunications)

http://csrc.nist.gov/publications/fips/fips199/F
IPS-PUB-199-final.pdf
Security Requirements

• Confidentiality
– Preserving authorized restrictions on information
access and disclosure, including means for protecting
personal privacy and proprietary information.

• Integrity
– Guarding against information modifications or
destruction, including ensuring information non-
repudiation and authenticity.

• Availability
– Ensuring timely and reliable access to and use of
information
Security Attacks,
Mechanisms & Services

• Security Attack
– Any action that compromises the security of
information

• Security Mechanism
– A process / device that is designed to detect,
prevent or recover from a security attack.

• Security Service
– A service intended to counter security attacks,
typically by implementing one or more
mechanisms.
Threats & Attacks

… but threat and attack used nearly interchangeably


Security Threats /
Attacks

… …
Security Threats /
Attacks
Passive Attacks
Active Attacks (1)
Active Attacks (2)
Security Services
• Authentication
(X.800)
• The assurance that the communicating entity is the one it claims to be

• Access Control
• The prevention of unauthorized use of a resource
• who can have access to a resource,
• under what conditions access can occur,
• what those accessing the resource are allowed to do

• Data Confidentiality
• The protection of data from unauthorized disclosure

• Data Integrity
• The assurance that data received are exactly as sent by an authorized
entity (i.e., contains no modification, insertion, deletion or replay).
• Non-Repudiation
• Provides protection against denial by one of the entities involved in a
communication of having participated in all/part of the communication.
3 A’s of Computer
security
• Authentication

• Authorization

• Auditing/accounting

17
Security Services
• replicate functions of physical documents
• e.g.
• have signatures, dates
• need protection from disclosure, tampering, or
destruction
• notarize
• record

18
What is Malware

• The broad category of software that comes


to kill, steal or destroy your computer.
• As software designed to interfere with
a computer's normal functioning,
malware is a blanket term for viruses,
trojans, and other destructive computer
programs threat actors use to infect
systems and networks in order to gain
access to sensitive information.

19
What is Malware cont..

20
END OF MODULE NOTES

21

You might also like