Chapter One - Computer and Information Security

Select College
Computer and Information Security
By.Molalign Tilahun(BSC in Computer Science, MSC in

Project Management and MSC in Information Technology)
Department of Computer Science College of
Computing and Informatics Select College
By.Molalign Tilahun 1
Chapter One
Fundamentals of computer
security & privacy
1. What is security?
• Security
 is freedom from, or resilience
against, potential harm caused
by others.
 is the state of being free from
danger or threat
 is safety, as well as the measures
taken to be safe or protected.
What is Security (cont …)
• Security is a continuous process of protecting an object
(person, an organization such as a business, or property such as
a computer system or a file) from attack.
• For a computer system,
– its security involves the security of all its resources such as its
physical hardware components such as readers, printers, the CPU, the
monitors, and others.
– In addition to its physical resources, it also stores non-physical
resources such as data and information that need to be protected.
• For a distributed computer system such as a network,
– the protection covers physical and non-physical resources that make
up the network including communication channels and connectors
like modems, bridges, switches, and servers, as well as the files stored
on those servers.
• In each one of these cases, therefore, security means preventing
unauthorized access, use, alteration, and theft or physical damage
to these resources By.Molalign Tilahun 4
Why security? (cont …)
 Protect vital information while still allowing access to those who need it
 Example : Trade secrets, medical records, etc.
 Provide authentication and access control for resources
 Guarantee availability of resources
 Example: the five 9’s (99.999% reliability)
• Unless it’s properly secured, any network is vulnerable to malicious use
and accidental damage.
• Hackers, disgruntled employees, or poor security practices within the
organization can leave private data exposed, including trade secrets and
customers’ private details.
• Losing confidential research, for example, can potentially cost an
organization millions of dollars by taking away competitive advantages it
paid to gain.
2 .Security Objectives
• Security as defined thus involves the following
three elements:
– Confidentiality,
– Integrity, and
– Availability
• The main objective for having a secured system is
to maintain the CIA of a resource in a certain
system.
• These three letters stand for confidentiality,
integrity, and availability, otherwise known as
the CIA triad.
• Together, these three principles form the
cornerstone of any organization's security
infrastructure; in fact, they (should) function as
goalsBy.Molalign Tilahun
and objectives 6
for every security program.
Security Objectives - CIA triad
• These three concepts form what is often referred to as the
CIA triad .
• The three concepts embody the fundamental security objectives
for both data and for information and computing services. For
example, the National Institute of Standards and Technology
(NIST) standard Federal Information Processing Standards
Publication Series (FIPS) 199 (Standards for Security
Categorization of Federal Information and Information Systems )
lists confidentiality, integrity, and availability as the three security
objectives for information and for information systems.
• FIPS 199 provides a useful characterization of these three
objectives in terms of requirements and the definition of a loss of
security in each category:
https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.199.pdf
CIA triad
• Confidentiality
– Preserving authorized restrictions on information access and
disclosure, including means for protecting personal privacy and
proprietary information.
– A loss of confidentiality is the unauthorized disclosure of
information.
• Integrity
– Guarding against improper information modification or destruction,
including ensuring information nonrepudiation and authenticity.
– A loss of integrity is the unauthorized modification or destruction of
information.
• Availability
– Ensuring timely and reliable access to and use of information.
– A loss of availability is the disruption of access to or use of
By.Molalign
information or an information Tilahun
system. 8
Security Requirements
1. Authenticity
– Verifying that users are who they say, they are and that each
input arriving at the system came from a trusted source
2. Accountability
– Being able to trace the responsible party/process/entity in case
of a security incident or action.
3. Non-repudiation:
– ensures that the sender has strong evidence that the receiver has
received the message, and the receiver has strong evidence of
the sender identity.
– The sender cannot deny that it has sent the message and the
receiver cannot deny that it has received the message
3. Security Trends
• In 1994, the Internet Architecture Board (IAB) issued a report
entitled "Security in the Internet Architecture" (RFC 1636).
https://www.rfc-editor.org/rfc/pdfrfc/rfc1636.txt.pdf
• The report stated the general consensus that the Internet needs
more and better security, and it identified key areas for security
mechanisms.
• Among these were the need to secure the network infrastructure
from unauthorized monitoring and control of network traffic and
the need to secure end-user-to-end-user traffic using authentication
and encryption mechanisms.
• These concerns are fully justified. As confirmation, consider the
trends reported by the Computer Emergency Response Team
(CERT) Coordination Center (CERT/CC).
https://sei.cmu.edu/about/divisions/cert/index.cfm
Security Trends (cont …)
• Figure (a) shows the trend in Internet-related vulnerabilities reported to
CERT over a 10-year period. These include security weaknesses in the
operating systems of attached computers (e.g., Windows, Linux) as well
as vulnerabilities in Internet routers and other network devices.
• Figure (b) shows the number of security related incidents reported to
CERT. These include denial of service attacks; IP spoofing, in which
intruders create packets with false IP addresses and exploit applications
that use authentication based on IP; and various forms of eavesdropping
and packet sniffing, in which attackers read transmitted information,
including logon information and database contents.
• Over time, the attacks on the Internet and Internet-attached systems have grown more
sophisticated while the amount of skill and knowledge required to mount an attack has declined.
Attacks have become more automated and can cause greater amounts of damage.
• This increase in attacks coincides with an increased use of the Internet
and with increases in the complexity of protocols, applications, and the
Internet itself.
• Critical infrastructures increasingly rely on the Internet for operations.
Individual users rely on the security of the Internet, email, the Web, and
Web-based applications to a greater extent than ever.
• Thus, a wide range of technologies and tools are needed to counter the
growing threat.
• At a basic level, cryptographic algorithms for confidentiality and
authentication assume greater importance.
• As well, designers need to focus on Internet-based protocols and the
vulnerabilities of attached operating systems and applications.
The global average cost of cyber crime/attacks
2017 Cost of
Cyber Crime
Study by
Accenture*
Steeper increasing
trend in the recent
years
* https://www.accenture.com/t20170926T072837Z w /us-en/_acnmedia/PDF-61/Accenture-2017-
CostCyberCrimeStudy.pdf
Average cost of cyber crime for seven countries
(2017 Cost of Cyber Crime Study by Accenture*)
- Germany has highest percentage increase;

254 institutions - UK, US are around the mean in percentage increase
responded
By.Molalign Tilahun
CostCyberCrimeStudy.pdf 16
Breakdown by Sector
2017 Cost of
Cyber Crime
Study by
Accenture*
- Financial
Services
Sector has
the Highest
Cost due to
Cyber Crime
CostCyberCrimeStudy.pdf By.Molalign Tilahun 17
4. The OSI Security Architecture
• To assess effectively the security needs of an organization and to
evaluate and choose various security products and policies, the manager
responsible for security needs some systematic way of defining the
requirements for security and characterizing the approaches to satisfying
those requirements.
• This is difficult enough in a centralized data processing environment;
with the use of local and wide area networks, the problems are
compounded.
• The International Telecommunication Union (ITU) Telecommunication
Standardization Sector (ITU-T) recommendation X.800, Security
Architecture for OSI, defines such a systematic approach.
• The OSI security architecture is useful to managers as a way of
organizing the task of providing security.
• The OSI security architecture was developed in the context of the OSI
protocol architecture.
The OSI Security Architecture
• Furthermore, because this architecture was developed as an
international standard, computer and communications vendors have
developed security features for their products and services that relate
to this structured definition of services and mechanisms.
• The OSI security architecture focuses on security, security attacks,
mechanisms, and services. These can be defined briefly as follows:
– Security in general , and in particular system security, as a process
of preventing unauthorized access to the system resources.
– Such prevention of unauthorized access to system resources is
achieved through a number of security services that include
access control, authentication, confidentiality, integrity, and non-
repudiation.
– Security attack: any action that compromises the security of
information owned by an organization.
The OSI Security Architecture (cont …)
– Security mechanism: is a process (or a device
incorporating such a process) that is designed to
detect, prevent, or recover from a security attack.
– Security service: A processing or communication
service that enhances the security of the data
processing systems and the information transfers of an
organization.
– The services are intended to counter security attacks,
and they make use of one or more security
mechanisms to provide the service.
The OSI Security Architecture (cont …)
• The terms threat and attack are commonly used to mean more
or less the same thing.
• Threat :- a potential for violation of security, which exists
when there is a circumstance, capability, action, or event that
could breach security and cause harm. That is, a threat is a
possible danger that might exploit a vulnerability.
• Attack an assault on system security that derives from an
intelligent threat; that is, an intelligent act that is a deliberate
attempt (especially in the sense of a method or technique) to
evade security services and violate the security policy of a
system.
Vulnerability Assessment
• A vulnerability assessment is a systematic review of security
weaknesses in an information system.
• It evaluates if the system is susceptible to any known
vulnerabilities, assigns severity levels to those vulnerabilities, and
recommends remediation or mitigation, if and whenever needed.
• There are several types of vulnerability assessments. These include:
1. Host assessment – The assessment of critical servers, which
may be vulnerable to attacks if not adequately tested or not
generated from a tested machine image.
Vulnerability Assessment (cont …)
2. Network and wireless assessment – The assessment of
policies and practices to prevent unauthorized access to
private or public networks and network-accessible resources.
3. Database assessment – The assessment of databases or big
data systems for vulnerabilities and misconfigurations,
identifying rogue databases or insecure dev/test
environments, and classifying sensitive data across an
organization’s infrastructure.
4. Application scans – The identifying of security
vulnerabilities in web applications and their source code by
automated scans on the front-end or static/dynamic analysis
of source code.
4.1 Security Attack Types
 Networks are subject to attacks from malicious sources.
 Attacks on computer systems
 break-in to destroy information
 break-in to steal information
 blocking to operate properly
 malicious software
 wide spectrum of problems
 Source of attacks
 Insiders
 Outsiders
• Attack types
1. Active attacks the attacker intercepts the connection and modifies
the information.
2. Passive attack, the attacker intercepts the transit information with
the intention of reading and analyzing the information not for
altering it.
Security Attack Types Passive Attacks
a) Wiretapping
 is the monitoring of telephone and internet-based conversations by a
third party
 Passive wiretapping monitors or records the traffic, while active
wiretapping alters or otherwise affects it
b) Port scanner
 is an application designed to probe a server or host for open ports.
 Such an application may be used by administrators to verify security
policies of their networks and by attackers to identify network services
running on a host and exploit vulnerabilities.
 is a process that sends client requests to a range of server port
addresses on a host, with the goal of finding an active port; this is not
a nefarious process in and of itself.
 The majority of uses of a port scan are not attacks, but rather simple
probes to determine services available on a remote machine.
Security Attack Types Passive Attacks
c) Idle scan
 is a TCP port scan method that consists of sending spoofed packets
to a computer to find out what services are available.
 This is accomplished by impersonating another computer called a
"zombie" (that is not transmitting or receiving information) and
observing the behavior of the ''zombie'' system.
d) Encryption
 Encryption is the process of encoding information. This process
converts the original representation of the information, known as
plaintext, into an alternative form known as ciphertext.
e) Traffic analysis
 Traffic analysis is the process of intercepting and examining
messages in order to deduce information from patterns in
communication, which can be performed even when the messages
are encrypted.
Security Attack Types Active Attacks
a) Virus
– A computer virus is a malicious software program loaded onto a
user's computer without the user's knowledge and performs
malicious actions.
– It can self-replicate, inserting itself onto other programs or files,
infecting them in the process. Not all computer viruses are
destructive though.
b) Eavesdropping
– is the act of secretly or silently listening to the private conversation
or communications of others without their consent.
– is widely regarded as unethical, and in many jurisdictions is illegal.
– Eavesdropping vectors include telephone lines, cellular networks,
email, and other methods of private instant messaging.
– VoIP communications software is also vulnerable to electronic
By.Molalign
eavesdropping via infections suchTilahun
as Trojans. 27
c) Data modification
– Data Modification occurs when a saved (or stored) value in a
computer is changed to a different value. So if data is manipulated
then stored in the same place it is modified.
– happens when attackers interrupt, capture, modify, steal or delete
important information in the system via network access or direct
access using executable codes
d) Denial of service Attack (DoS)
– is a cyber-attack in which the perpetrator seeks to make a machine
or network resource unavailable to its intended users by temporarily
or indefinitely disrupting services of a host connected to the internet
– is typically accomplished by flooding the targeted machine or
resource with superfluous requests in an attempt to overload systems
and prevent some or all legitimate requests from being fulfilled.
Denial Of service (cont …)
• In a distributed denial-of-service attack (DDoS attack), the
incoming traffic flooding the victim originates from many different
sources. This effectively makes it impossible to stop the attack simply by
blocking a single source.
• A DoS or DDoS attack is analogous to a group of people crowding the
entry door of a shop, making it hard for legitimate customers to enter,
thus disrupting trade.
• Criminal perpetrators of DoS attacks often target sites or services
hosted on high-profile webservers such as banks or credit card payment
gateways, revenge, blackmail, and activism can motivate these attacks.
e) DNS spoofing
 also referred to as DNS cache poisoning, is a form of computer
security hacking in which corrupt Domain Name System data is
introduced into the DNS resolver's cache, causing the name server to
return an incorrect result record, e.g. an IP address.
 This results in traffic being diverted to the attacker's computer (or any
other computer).
f) Man-in-the-middle attack (MITM)
 also known as a hijack attack is an attack where the attacker secretly
relays and possibly alters the communications between two parties
who believe that they are directly communicating with each other.
 One example of a MITM attack is active eavesdropping, in which
the attacker makes independent connections with the victims and
relays messages between them to make them believe they are talking
directly to each other over a private connection, when in fact the
entire conversation is controlled
By.Molalign by the attacker.
Tilahun 30
g) ARP spoofing, ARP cache poisoning, or ARP poison routing,
 is a technique by which an attacker sends (spoofed) Address
Resolution Protocol (ARP) messages onto a local area network.
Generally, the aim is to associate the attacker's MAC address with the
IP address of another host, such as the default gateway, causing any
traffic meant for that IP address to be sent to the attacker instead.
 ARP spoofing may allow an attacker to intercept data frames on a
network, modify the traffic, or stop all traffic. Often the attack is used
as an opening for other attacks, such as DoS, MITM, or other
attacks.
 The attack can only be used on networks that use ARP, and requires
attacker have direct access to the local network segment to be
attacked.
4.2. Security Services
• X.800 architecture defines a security service as a service provided
by a protocol layer of communicating open systems, which ensures
adequate security of the systems or of data transfers.
• Perhaps a clearer definition is found in RFC 2828, which provides
the following definition:
“a processing or communication service that is provided by a system to give a
specific kind of protection to system resources; security services implement
security policies and are implemented by security mechanisms”.
• A Request for Comments(RFC) is a publication from the Internet
Society and its associated bodies, most prominently the Internet
Engineering Task Force, the principal technical development and
standards-setting bodies for the Internet.
• X.800 divides these services into five categories and fourteen
specific services. We look at each category in turn.
Security services 1. Access Control
 This is a service the system uses, together with a user pre-provided
identification information such as a password, to determine who uses
what of its services.
 Let us look at some forms of access control based on hardware and
software.
 Hardware Access Control Systems
 Access terminal :- including fingerprint verification and real-time
anti-break-in sensors. Network technology has made it possible for
these units to be connected to a monitoring network or remain in a
standalone off-line mode.
 Visual event monitoring :- this is a combination of many
technologies into one very useful and rapidly growing form of access
control using a variety of real-time technologies including video and
audio signals, aerial photographs, and global positioning system
(GPS) technology to identify locations.
 Identification cards :- sometimes called proximity cards, these cards
have become very common these days as a means of access control
in buildings, financial institutions, and other restricted areas. The
cards come in a variety of forms including magnetic, bar coded,
contact chip, and a combination of these.
 Biometric identification :- This is perhaps the fastest growing form
of control access tool today. Some of the most popular forms
include fingerprint, iris, and voice recognition. However, fingerprint
recognition offers a higher level of security.
 Video surveillance :- This is a replacement of closed circuit
television (CCTV) of yester year, and it is gaining popularity as an
access control tool. With fast networking technologies and digital
cameras, images can now be taken and analyzed very quickly and
action taken in minutes.
b) Software Access Control Systems
• Software access control falls into two types:
1. Point of access monitoring
• In point of access (POA), personal activities can be monitored by a PC-
based application. The application can even be connected to a
network or to a designated machine or machines. The application
collects and stores access events and other events connected to
the system operation and downloads access rights to access
terminals.
2. Remote monitoring
• In remote mode, the terminals can be linked in a variety of ways
including the use of modems, telephone lines, and all forms of
wireless connections. Such terminals may, sometimes if needed,
have an automatic calling at pre-set times if desired or have an
attendant to report regularly.
Security services 2. Authentication
• Authentication is a service used to identify a user. User identity,
especially of remote users, is difficult because many users, especially
those intending to cause harm, may masquerade as the legitimate users
when they actually are not. This service provides a system with the
capability to verify that a user is the very one he or she claims to be
based on what the user is, knows, and has.
• Authentication is a process whereby the system gathers and builds up
information about the user to ensure that the user is genuine.
• In data communication,
– authentication is also used to verify the identity of the sender and the
integrity of the message.
• In computer systems,
– authentication protocols based on cryptography use either secret-key
or public-key schemes to create an encrypted message digest that is
appended to a documentBy.Molalign
as a digital signature.
Tilahun 36
• Digital signature
 is similar to a handwritten signature in printed documents.
 ensure that the person whose signature the system is authenticating is
indeed the true person, but digital signatures provide a greater degree
of security than handwritten signatures.
 once submitted can never be disowned by the signer of a document
claiming the signature was forged. This is called non-repudiation.
 A secure digital signature system consists of two parts:
1. a method of signing a document and
2. authentication that the signature was actually generated by
whoever it represents.
• Two specific authentication services are defined in X.800:
a) Peer entity authentication
– Provides for the confirmation of the identity of a peer entity in an
association.
– It is provided for use at the establishment of, or at times during the
data transfer phase of, a connection.
– It attempts to provide confidence that an entity is not performing
either a masquerade or an unauthorized replay of a previous
connection.
b) Data origin authentication
– Provides for the confirmation of the source of a data unit.
– It does not provide protection against the duplication or
modification of data units.
– This type of service supports applications like electronic mail where
By.Molalign Tilahun
there are no prior interactions between the communicating entiti3e388s.
Security services 3. Confidentiality
• The confidentiality service protects system data and information from
unauthorized disclosure.
• When data leave one extreme of a system such as a client's computer in
a network, it ventures out into a non-trusting environment.
• So the recipient of that data may not fully trust that no third party like a
cryptanalysis or a man-in-the middle has eavesdropped on the data.
• This service uses encryption algorithms to ensure that nothing of the
sort happened while the data was in the wild.
• Encryption protects the communications channel from sniffers.
• Sniffers are programs written for and installed on the
communication channels to eavesdrop on network traffic, examining
all traffic on selected network segments.
• Sniffers are easy to write and install and difficult to detect.
Security Services 3. Confidentiality
• The encryption process uses an encryption algorithm and key to transform
data at the source, called plaintext; turn it into an encrypted form called
ciphertext, usually unintelligible form; and finally recover it at the sink.
• The encryption algorithm can either be symmetric or asymmetric.
 Symmetric encryption or secret key encryption,
 uses a common key and the same cryptographic algorithm to scramble
and unscramble the message.
 Asymmetric encryption
 commonly known as public key encryption, uses two different keys, a
public key known by all and a private key known by only the sender and
the receiver.
 Both the sender and the receiver each has a pair of these keys, one public
and one private.
 To encrypt a message, a sender uses the receiver's public key which was
published. Upon receipt, the recipient of the message decrypts it with his
or her private key.
Security Services 4. Integrity
• The integrity service protects data against active threats such as those
that may alter it.
• Just like data confidentiality, data in transition between the sending and
receiving parties is susceptible to many threats from hackers,
eavesdroppers, and cryptanalysts whose goal is to intercept the data and
alter it based on their motives.
• This service, through encryption and hashing algorithms, ensures that
the integrity of the transient data is intact.
• A hash function takes an input message M and creates a code from it.
The code is commonly referred to as a hash or a message digest.
• A one-way hash function is used to create a signature of the message -
just like a human fingerprint.
• The hash function is, therefore, used to provide the message's integrity
and authenticity.
• The signature is then attached to the message before it is sent by the
sender to the recipient.
Security Services 5. Non-repudiation
• This is a security service that provides proof of origin and delivery of
service and/or information.
• In real life, it is possible that the sender may deny the ownership of the
exchanged digital data that originated from him or her.
• This service, through digital signature and encryption algorithms,
ensures that digital data may not be repudiated by providing proof of
origin difficult to deny.
• A digital signature is a cryptographic mechanism that is the electronic
equivalent of a written signature to authenticate a piece of data as to the
identity of the sender.
4.3. Security Mechanisms
Security Mechanisms (cont …)
Relationship between Security Services and Mechanisms
6. Security Models
• A message is to be transferred from one party to another across some
sort of internet.
• The two parties, who are the principals in this transaction, must cooperate for
the exchange to takeplace.
• A logical information channel is established by defining a route through
the internet from source to destination and by the cooperative use of
communication protocols (e.g., TCP/IP) by the two principals.
Security Models (cont …)
• Security aspects come into play when it is necessary or desirable to
protect the information transmission from an opponent who may
present a threat to confidentiality, authenticity, and so on.
• All the techniques for providing security have two components:
1. A security-related transformation on the information to
be sent.
• Examples include the encryption of the message, which
scrambles the message so that it is unreadable by the opponent,
and the addition of a code based on the contents of the
message, which can be used to verify the identity of the sender
2. Some secret information shared by the two principals
and, it is hoped, unknown to the opponent.
• An example is an encryption key used in conjunction with the
transformation to scramble the message before transmission
and unscramble it on reception.
Security Models (cont …)
• A trusted third party may be needed to achieve secure transmission.
– For example, a third party may be responsible for distributing the secret
information to the two principals while keeping it from any opponent. Or a third
party may be needed to arbitrate disputes between the two principals concerning
the authenticity of a message transmission.
• This general model shows that there are four basic tasks in designing a
particular security service:
1. Design an algorithm for performing the security-related
transformation. The algorithm should be such that an opponent
cannot defeat its purpose.
2. Generate the secret information to be used with the algorithm.
3. Develop methods for the distribution and sharing of the secret
information.
4. Specify a protocol to be used by the two principals that makes use
of the security algorithm and the secret information to achieve a
particular security service.
End of Chapter - One
Thanks

Chapter One - Computer and Information Security

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Chapter One - Computer and Information Security

Uploaded by

Copyright:

Available Formats

Select College

Computer and Information Security

By.Molalign Tilahun(BSC in Computer Science, MSC in

- Germany has highest percentage increase;

You might also like