EFFECTS AND CONTRIBUTIONS OF COMPUTER since then until now in modern > LAUNCH DENIAL-OF-SERVICE ATTACKS RENDERING THE

HE MACHINE
society TEMPORARILY UNUSABLE

EDUCATION COMPUTER SECURITY ISSUES

Ø CHILDREN ARE OUTPACING ADULTS ON THE TECHNOLOGY TRACK. Ø BROWSER-SIDE RISKS INCLUDING:

Ø EDUCATION PLAYS A MAJOR ROLE IN GUIDING THE CHILDREN TO MAKE
USE OF THE BEST OF THE COMPUTER TECHNOLOGY.
Ø CURRENT EDUCATION SYSTEMS MUST UNDERGO SIGNIFICANT REFORM
TO SERVE THE NEEDS OF THE YOUNGER GENERATIONS.
Ø COMPUTERS AND THE INTERNET CAN HELP IN MAKING LESSONS
CUSTOMIZED AND STUDENT-CENTERED
CAREERS AND PROFESSIONAL OUTLOOK
Ø CHANGE THAT INVOLVES NEW AND COMPLEX TECHNOLOGIES ARE
STRESSFUL TO OLDER AND LESS EDUCATED WORKERS.
> ACTIVE CONTENT THAT CRASHES THE BROWSER, DAMAGES THE USER’S
SYSTEM, BREACHES THE USER’S PRIVACY, OR MERELY CREATES AN
ANNOYANCE
> THE MISUSE OF PERSONAL INFORMATION KNOWINGLY OR UNKNOWINGLY
PROVIDED BY THE END-USER
> INTERCEPTION OF NETWORK DATA SENT FROM BROWSER TO SERVER OR
VICE VERSA VIA NETWORK EAVESDROPPING
ASPECTS OF COMPUTER SECURITY
> PHYSICAL SECURITY

Ø COMPUTER LITERACY IS AN ADVANTAGE ON MOST JOBS NOWADAYS. Ø > VIRUSES

MANAGEMENT SUPPORTS THE USE OF TECHNOLOGY TO IMPROVE
PRODUCTIVITY WHICH IN MANY INSTANCES MEAN THE ELIMINATION OF > MALICIOUS LOGIC
JOBS.
> HACKING
SECURITY -COMPUTER CRIMES
> INTERNAL MISUSE
> COULD REASONABLY INCLUDE A WIDE VARIETY OF CRIMINAL OFFENSES,
ACTIVITIES, OR ISSUES > SPOOFING

> CAN BE SEPARATED INTO TWO (2) CATEGORIES: ETHICS

• CRIMES FACILITATED BY A COMPUTER
• CRIMES WHERE THE COMPUTER IS THE TARGET
> THE RULES AND STANDARDS GOVERNING THE CONDUCT OF AN
INDIVIDUAL WITH OTHERS
• COPYRIGHT - A FORM OF PROTECTION PROVIDED BY LAW TO AUTHORS OF
ORIGINAL WORKS, OTHERWISE KNOWN AS THEIR INTELLECTUAL PROPERTY

COMPUTER SECURITY ISSUES • A COPYRIGHT OWNER HAS THE SOLE RIGHT TO: – REPRODUCE THE
MATERIAL – PREPARE DERIVATIVE WORKS BASED ON THE MATERIAL –
Ø BUGS OR MISCONFIGURATION PROBLEMS THAT ALLOW UNAUTHORIZED DISTRIBUTE THE COPIES OF THE MATERIAL TO THE PUBLIC – PERFORM THE
REMOTE USERS TO: WORK PUBLICLY (IF APPLICABLE) – DISPLAY THE WORK PUBLICLY

> STEAL CONFIDENTIAL DOCUMENTS > EXECUTE COMMANDS ON THE HOST • PRIVACY
MACHINE, ALLOWING THEM TO MODIFY THE SYSTEM
• CENSORSHIP
> GAIN INFORMATION ABOUT THE HOST MACHINE, ALLOWING THEM TO
BREAK INTO THE SYSTEM SECURITY INCIDENTS
Ø THERE ARE MANY DIFFERENT WAYS TO ATTACK COMPUTERS AND
NETWORKS TO TAKE ADVANTAGE OF WHAT HAS MADE SHOPPING, BANKING,
INVESTMENT, AND LEISURE PURSUITS A SIMPLE MATTER OF “DRAGGING
AND CLICKING” FOR MANY PEOPLE.
Ø DIFFERENT TYPES OF ELECTRONIC CRIME FALL INTO TWO MAIN
CATEGORIES:
> CRIMES IN WHICH THE COMPUTER WAS THE TARGET OF THE ATTACK
> INCIDENTS IN WHICH THE COMPUTER WAS A MEANS OF PERPETRATING A
CRIMINAL ACT
SECURITY INCIDENTS
> THE MORRIS WORM (NOVEMBER, 1988), CITIBANK AND VLADIMIR LEVIN
(JUNE-OCTOBER, 1994), KEVIN MITNICK (FEBRUARY, 1995), OMEGA
ENGINEERING AND TIMOTHY LLOYD (JULY, 1996), JESTER AND THE
WORCESTER AIRPORT (MARCH, 1997), SOLAR SUNRISE (FEBRUARY, 1998),
THE MELISSA VIRUS (MARCH, 1999), THE LOVE LETTER WORM (MAY, 2000),
THE CODE-RED WORM (2001), ADIL YAHYA ZAKARIA SHAKOUR (AUGUST,
2001-MAY, 2002), THE SLAMMER WORM (2003)
THREATS TO SECURITY
> VIRUSES AND WORMS > INTRUDERS > INSIDERS > CRIMINAL
ORGANIZATIONS > TERRORISTS AND INFORMATION WARFARE
SECURITY BASICS
Ø IN SOME SENSE, SECURITY IS CONCERNED WITH PREVENTING UNDESIRED
BEHAVIOR.
> AN ENEMY/OPPONENT/HACKER/ADVERSARY MAY BE ACTIVELY AND
MALICIOUSLY TRYING TO CIRCUMVENT ANY PROTECTIVE MEASURES YOU
PUT IN PLACE.
Ø COMPUTER VS. NETWORK SECURITY
> COMPUTER SECURITY FOCUSES ON SECURITY ASPECTS OF SYSTEMS IN
ISOLATION. (E.G. VIRUSES, SECURE DATA STORAGE, OS SECURITY)
> NETWORK SECURITY FOCUSES ON SECURITY OF DATA AS IT IS
TRANSMITTED BETWEEN NETWORKED SYSTEMS. (E.G. AUTHENTICATION
PROTOCOLS, ENCRYPTION OF TRANSMITTED DATA, FIREWALLS)
THE CIA OF SECURITY
Ø CONFIDENTIALITY — ENSURE THAT ONLY THOSE INDIVIDUALS WHO HAVE
THE AUTHORITY TO VIEW A PIECE OF INFORMATION MAY DO SO.
Ø INTEGRITY — RELATED TO CONCEPT BUT DEALS WITH THE GENERATION
AND MODIFICATION OF DATA.
Ø AVAILABILITY — ENSURE THAT THE DATA, OR THE SYSTEM ITSELF, IS
AVAILABLE FOR USE WHEN THE AUTHORIZED USER WANTS IT.
> AUTHENTICATION — DEALS WITH THE DESIRE TO ENSURE THAT AN
INDIVIDUAL IS WHO THEY CLAIM TO BE.
> NONREPUDIATION — DEALS WITH THE ABILITY TO VERIFY THAT A
MESSAGE HAS BEEN SENT AND RECEIVED AND THAT THE SENDER CAN BE
IDENTIFIED AND VERIFIED.
SECURITY PRINCIPLES
Ø THREE WAYS AN ORGANIZATION CAN CHOOSE TO ADDRESS THE
PROTECTION OF ITS NETWORKS:
> IGNORE SECURITY ISSUES
> PROVIDE HOST SECURITY
> APPROACH SECURITY AT A NETWORK LEVEL
Ø HOST SECURITY
> TAKES A GRANULAR VIEW OF SECURITY BY FOCUSING ON PROTECTING
EACH COMPUTER AND DEVICE INDIVIDUALLY INSTEAD OF ADDRESSING
PROTECTION OF THE NETWORK AS A WHOLE
Ø NETWORK SECURITY
> EMPHASIS IS PLACED ON CONTROLLING ACCESS TO INTERNAL
COMPUTERS FROM EXTERNAL ENTITIES
LEAST PRIVILEGE
Ø LEAST PRIVILEGE MEANS THAT A SUBJECT (WHICH MAY BE A USER,
APPLICATION, OR PROCESS) SHOULD HAVE ONLY THE NECESSARY RIGHTS
AND PRIVILEGES TO PERFORM ITS TASK WITH NO ADDITIONAL
PERMISSIONS.
Ø THE CONCEPT OF LEAST PRIVILEGE APPLIES TO MORE NETWORK
SECURITY ISSUES THAN JUST PROVIDING USERS WITH SPECIFIC RIGHTS
AND PERMISSIONS.
Ø ANOTHER ISSUE IN LEAST PRIVILEGE CONCEPT IS THE SECURITY
CONTEXT IN WHICH AN APPLICATION RUNS. ALL APPLICATIONS, SCRIPTS,
AND BATCH FILES RUN IN THE SECURITY CONTEXT OF A SPECIFIC USER ON
AN OPERATING SYSTEM
DIVERSITY OF DEFENSE

Ø DIVERSITY OF DEFENSE IS A CONCEPT THAT COMPLEMENTS THE IDEA OF

VARIOUS LAYERS OF SECURITY. IT INVOLVES MAKING DIFFERENT LAYERS
OF SECURITY DISSIMILAR SO THAT EVEN IF ATTACKERS KNOW HOW TO GET
THROUGH A SYSTEM MAKING UP ONE LAYER, THEY MAY NOT KNOW HOW TO
GET THROUGH A DIFFERENT TYPE OF LAYER THAT EMPLOYS A DIFFERENT
SYSTEM FOR SECURITY.

ACCESS CONTROL

Ø DISCRETIONARY ACCESS CONTROL

> AN ACCESS CONTROL MECHANISM IN WHICH THE OWNER OF AN OBJECT

(SUCH AS A FILE) CAN DECIDE WHICH OTHER SUBJECTS (SUCH AS OTHER
USERS) MAY HAVE ACCESS TO THE OBJECT, AND WHAT ACCESS (READ,
WRITE, EXECUTE) THESE SUBJECTS MAY HAVE Ø MANDATORY ACCESS
CONTROL

> AN ACCESS CONTROL MECHANISM IN WHICH THE SECURITY MECHANISM

CONTROLS ACCESS TO ALL OBJECTS (FILES), AND INDIVIDUAL SUBJECTS
(PROCESSES OR USERS) CANNOT CHANGE THAT ACCESS Ø ROLE-BASED
ACCESS CONTROL

> AN ACCESS CONTROL MECHANISM IN WHICH, INSTEAD OF THE USERS

BEING ASSIGNED SPECIFIC ACCESS PERMISSIONS FOR THE OBJECTS
ASSOCIATED WITH THE COMPUTER SYSTEM OR NETWORK, A SET OF ROLES
THAT THE USER MAY PERFORM WILL BE ASSIGNED TO EACH USER