Introduction to Computer Security

Introduction to Computer Security

Introduction to Computer Security

• Books:1. An Inroduction to Computer Security: The

NIST Handbook2. Johannes Buchmann: Introduction to

Cryptography3. Douglas Stinson: Cryptography Theory and

Practice

I. Outline of the semester

• Term of computer security• Elements of computer security• Three major security controls: Management

controls, Operational controls, Technical controls• Cryptography – encryption (symmetric,

asymmetric), hash functions, digital signatures, message authentication codes, identification, key exchange etc.

II. Computer Security

• The protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability and confidentiality of information system resources (includes hardware, software, information/data)

II. Computer Security

• Integrity:

data integrity: Requirement that information and programs are changed only in a specified and authorized manner

system integrity: Requirement that a system performs its intended function free from unauthorized manipulation

II. Computer Security

• Availability: Requirement intended to assure that systems work promptly and service is not denied to authorized users.

• Confidentiality:Requirement that private or confidential information not be disclosed to unauthorized individuals.

II. Elements of Computer Security1. Computer security supports the mission of the organization2. Computer security is an integral element of sound

management3. Computer security should be cost-effective4. Computer security responsibilities should be made explicit5. System owners have computer security responsibilities

outside their own organizations6. Computer security requires a comprehensive and integrated

approach7. Computer security should be periodically reassessed8. Computer security is constrained by societal factors

II. Computer security supports the mission of the organization

• Computer security helps the organization’s mission by protecting its physical and financial resources, reputation, legal position, employees, and other tangible and intangible assets.

• No complete security protecting important assets• usually security is secondary (making profit, providing good

service etc. is primary) • Management should understand their mission and how their

information system supports it. security requirements are defined

• Interorganizational systems e.g.: good security of buyers system also benefits the seller

II. Computer security is an integral element of sound management

• Information and computer systems are often critical assets that support the mission of an organization. Protecting them can be as critical as protecting other organizational resources (e.g. money, physical assets, employees)

• Managers should decide about the level of risk they are willing to accept.

II. Computer security should be cost-effective

• Ensure that the cost of controls does not exceed expected benefits.

• Direct costs: purchasing, installing and administering security systems

• Indirect costs: Security systems can sometimes affect system performance, employee morale or retraining requirements.

II. Computer security responsibilities should be made explicit

• Document that states organization policy and make explicit computer security responsibilities

• Responsibilities may be internal to an organization or may extend across organizational boundaries.

II. Computer security requires a comprehensive and integrated approach

• Interdependencies of security controls – Managerial, operational and technical controls work together interdependanciese.g.: training on how to use a secure system

• Other interdependencies – system management, legal issues, quality assurance

II. Computer security should be periodically reassessed

• Computers and the environments they operate in are dynamic security requirements are ever-changing

• Changes in the system or the environment can create new vulnerabilities necessary to reassess periodically

II. Computer security is constrained by societal factors

• Security may be limited by social issuese.g. security vs. privacy (identification, tracking actions)

III. Roles and Responsibilities

• Whose responsibility is it?

• Senior management• Computer Security Management• Program and Functional Managers/Application

owners• Technology providers• Supporting organizations• Users

III. Senior management

• Senior management – ultimate responsibility

They establish the organization’s computer security program to support the mission of the organization.

They are responsible for setting a good example for their employees

III. Computer Security Management

• Directs the organization’s day-to-day management of its computer security program

• Responsible for coordinating all security-related interactions among organizational elements.

III. Program and Functional Managers/Application owners

• Responsible for a program or function including the supporting computer system.

• These officials are usually assisted by technical staff.

III. Technology providers• Managers and technicians who design and operate

computer systems.• They are responsible for implementing technical

security on computer systems.• Responsible for being familiar with security technology

that relates to their system.• Responsible for analyzing technical vulnerabilities.• Telecommunications – providing communication

services (fax, voice, etc.)• Help desk – recognize security incidents and refer the

caller to the appropriate person or organization for a response

III. Supporting organizations• Audit – Auditors are responsible for examining

systems whether the system is meeting stated security requirements.

• Quality assurance – Responsible for improving the products and services, how computer security can be used to improve the quality.

• Training office – Responsible for training users, operators, managers in computer security.

• Risk Management – Responsible for studying all types of risks including computer security-related risks.

III. Users

• Users of informationIndividuals who use information provided by the computer system. They may read computer-prepared reports etc.

• Users of systemsIndividuals who directly use computer systems, responsible for following security procedures, reporting security problems, attending security training.

IV. Threats

• Threats range from errors harming database integrity to fires destroying entire computer centers

• Threats from the actions of trusted employees, outside hackers, careless data entry clerks etc.

• Attack confidentiality, integrity of data or availability of a system

IV. Threats

• Knowledge of threat environment is necessary for system manager to implement the most cost-effective security measures.

• It might be more cost-effective to simply tolerate the expected losses risk analysis

IV. Errors and omissions

• Threat to data and system integrity• Made by users who create and edit data

training can help• Large percentage of threats• Contribute directly or indirectly to security

problems

IV. Errors and omissions

• Directly: data entry error or programming error that crashes a system

• Indirectly: errors create vulnerabilities• Errors in programming are called bugs• Installation and maintenance errors security

vulnerabilities

IV. Fraud and theft

• Automating traditional methods of fraud and theft

• E.g.: financial systems are at risk, systems that control access to any resource (inventory systems etc.)

• Insiders (former employees also) are in a better position, outsiders

• Hardware and software are vulnerable to theft

IV. Employee sabotage

• Employees know what actions might cause the most damage

• Employee sabotage is believed to be much smaller than the instances of theft, but the cost of such incidents can be quite high.

IV. Loss of physical and Infrastructure support

• Includes power failures, loss of communication, water leaks, lack of transportation service, fire, flood etc.

• Loss of infrastructure often results in unexpected ways

IV. Malicious hackers/crackers

• A hacker breaks into computers and computer networks, either for profit or motivated by the challenge.

• Black hat (crackers) hackers: for malicious reasons such as vandalism, credit card fraud, identity theft, piracy, or other types of illegal activity

• White hat hackers: for non-malicious reasons, for instance testing their own security system

• Grey hat hackers: combination of a Black Hat and a White Hat Hacker (repair the system for a small fee)

IV. Malicious hackers/crackers

• Losses due to hacker attacks are significantly smaller than losses due to insider theft and sabotage, the hacker problem is widespread and serious.

• Receive more attention: hacker threat is a more recently encountered threat, organizations do not know the purpose of a hacker (browse, steal, damage, etc.) no limitations, hackers’ identity is unknown (case of painter and burglar)

IV. Industrial espionage

• Gathering proprietary data from private companies or the government for the purpose of aiding another company.

• Goal is to improve their competitive advantage .• Since information is processed and stored on

computer systems, computer security can help. (employees may sell information)

• E.g.: pricing information, product development, customer lists, sales data, cost data, strategic plans

IV. Malicious code

• Virus: A code segment that replicates by attaching copies of itself to existing executables. The new copy of the virus is executed when a user executes the new host program.

• Trojan horse: A program that performs a desired task, but that also includes unexpected functions. They steals information, harm the system and do not replicate themselves.

IV. Malicious code

• Worm: A self-replicating program that is self-contained and does not require a host program. The program creates a copy of itself and causes it to execute, no user intervention is required. Sometimes just consume bandwith.

IV. Threats to personal privacy

• Electronic information about individuals by governments, credit bureaus, private companies, etc. have created a threat to individual privacy.

• Often referred to „Big Brother”.• Federal and state employees have sold

personal information collected by the government. (1992, USA)

V. Major Controls• Management Controls:

Focus on controls that can be characterized as managerial. e.g.: management of computer security program, management of

risk within the organization, management of assurance etc.

• Operational Controls: Focus on controls that are implemented and executed by people

e.g.: training, education, user administration, software support, documentation etc.Often require technical or specialized expertise and rely upon management activities as well as technical controls

V. Major Controls

• Technical Controls:Focus on security controls that the computer system executes.

e.g.: identification, access control, other cryptographic technologies

V. Management controls – Computer security policy

• Policy is senior management’s directives to create a computer security program, establish its goals, and assign responsibilities.

• Computer security policy is defined as the documentation of computer security decisions.

• Computer security policy protects both technical and information resources as well as guiding employee behavior.

V. Management controls – Computer security policy

• Program policy is used to create an organization’s computer security program.

• Issue-specific policies address specific issues of concern to organization.

• System-specific policies focus on decisions taken by mangement to protect a particular system.

V. Management controls – Computer security policy

• Management issues program policy to establish the organization’s computer security program and its basic structure.

• Components of the policy: purpose, scope responsibilities, compliance

• Purpose: why the program is being established, the goals of the program e.g.: integrity, availability, confidentiality, reduction in errors and data loss, maintaining confidential personal data

V. Management controls – Computer security policy

• Scope: which resources the computer security program covers including facilities, hardware, software, information and personnel.

• Responsibilities: management of a computer security program is assigned to an office. Responsibilities of officials and offices need to be addressed, including managers, applications owners, users etc.

V. Management controls – Computer security policy

Compliance: • General compliance to ensure meeting the

requirements to establish a program is needed. An office is assigned to responsibility for monitoring compliance.

• The use of specified penalties and disciplinary actions is necessary.

V. Management controls – Issue-specific policy

• Focuses on areas • Program policy does not require much

modification over time, whereas issue-specific policies require more frequent revision.

• e.g.: particular methodology for managing risk, new issues arise, internet access (which type of systems may be connected to the network, user authentication for Internet-connected systems)

V. Management controls – Issue-specific policy

Components:• Managers must define the issue with

conditions• Clearly state the organization’s position• Clarify where, how, when, to whom and to

what a particular policy applies.• Need to be clarified who is responsible for the

issue

V. Management controls – Issue-specific policy

Components:• Penalties may be explicitly stated and should

be consistent with organizational personnel policies and practices.

• Appropriate positions (individuals) are needed to contact for further information.

V. Management controls – System-specific policy

• System-specific policy is much more focused , than program and issue-specific policy. It addresses only one system.

• Often accompanied by implementing procedures and guidelines

• Two-level model: security objectives and operational security rules

V. Management controls – System-specific policy

• Security objectives should be defined concretly e.g.: Only individuals in the accounting and

personnel departments are authorized to provide or modify information used in payroll processing.

• Rules for operating a system are given, who can do what

e.g.: Personnel clerks may update fields for weekly attendance, charges to annual leave, employee addresses, and phone numbers.

V. Management controls – Risk management

• Risk is the possibility of something adverse happening.

• Risk management is the process of assessing risk, taking steps to reduce risk to an acceptable level and maintaining that level of risk.

• Computer security risk management addresses risks which arise from an organization’s use of information technology.

V. Management controls – Risk management

• E.g.: To maximize the return on their investments, businesses must often decide between aggressive (but high-risk) and slow-growth (but more secure) investment plans. These decisions require analysis of risk. Management decides

• There is always risk. (from trusted employees or fire etc.)

• Risk management is made up of three activities: risk assessment, risk mitigation and uncertainty analysis

V. Management controls – Risk management – Risk assessment

• Risk assessment: Process of analyzing and interpreting risk

Basic activities: • determining the assessment’s scope and

methodology• Collecting and analyzing data• Interpreting the risk analysis results

V. Management controls – Risk management – Risk assessment

Determining the assessment’s scope and methodology:

• Identify the system or part of the system that will be analyzed • Chose the analytical method including its level of detail and

formality• Different parts of a system may be analyzed in greater or

lesser detail• The more essential the system, the more thorough the risk

analysis should be• Defining the scope and boundary can help ensure a cost

effective assessment.

V. Management controls – Risk management – Risk assessment

Collecting and analyzing data:• Risk has many different components: assets,

threats, vulnerabilities, safeguards, consequence, likelihood

• Gathering data about the threatened area and synthesizing and analyzing the information.

• Screening: the process to limit information gathering and analysis, since we might collect much more information than can be analyzed.

V. Management controls – Risk management – Risk assessment

Collecting and analyzing data:• Asset valuation: Asset includes the information,

software, personnel, hardware and physical assets. The value of an asset consists of its intrinsic value and near-term impacts and long-term consequences of its compromise.

• Consequence assessment: estimates the degree of harm or loss that could occur. E.g.: disclosure, modification, denial of service, loss of reputation, loss of business, etc.

V. Management controls – Risk management – Risk assessment

Collecting and analyzing data:• Threat identification: Threat is an entity or event with

the potential to harm the system. Threats should be identified and analyzed to determine the likelihood of their occurrence and their potential to harm assets.

• Safeguard analysis: A safeguard is any action, device, procedure, technique, or other measure that reduces a system’s vulnerability to a threat. Safeguard analysis should include an examination of the effectiveness of the existing security measures.

V. Management controls – Risk management – Risk assessment

Collecting and analyzing data:• Vulnerability analysis: A vulnerability is a condition or

weakness in security procedures, technical controls, or other controls that can be exploited by a threat. Vulnerabilities are often analyzed in terms of missing safeguards.

• Likelihood assessment: Likelihood is an estimation of the frequency or chance of a threat happening. A likelihood assessment considers the presence, strengths of threats as well as the effectiveness of safeguards.

V. Management controls – Risk management – Risk assessment

Interpreting risk analysis results:• Risk analysis results are typically represented

quantitatively and/or qualitatively.• Quantitative measures: e.g. reduced expected

monetary losses• Qualitative measures: descriptive e.g. high,

low, or a scale of 1 to 10

V. Management controls – Risk management – Risk mitigation

Selecting safeguards• Method of selecting safeguards: what if analysis

to test what difference each makes with regard to cost, effectiveness and other factors

• E.g.: what if passwords are strengthened? Personnel may be required to change passwords more frequently. There are no direct monetary expenditure, but staff and administrative overhead is increased.

V. Management controls – Risk management – Uncertainty analysis

• Risk management often must rely on speculation, best guesses, incomplete data, and many unproven assumptions.

• Sources of uncertainty: lack of confidence or precision in the risk management model or lack of sufficient information to determine the exact value of the elements of the risk model

VI. Operational Control - Personnel issues Staffing process:• Position definition - in the process of defining a position, security

issues should be identified– Separation of duties (one initiates a request for a payment, another

authorizes that same payment)– Least privilege (access management)

• Determining position sensitivity - level of sensitivity is based upon such factors as the type and degree of harm (e.g., disclosure of private information, interruption of critical processing, computer fraud)

• Filling the position – which applicants meet the position requirements (screening process)

• Training and awareness - employees still have to be trained to do their job, which includes computer security responsibilities and duties

VI. Operational Control – Awareness, Training and Education

• improving awareness of the need to protect system resources

• developing skills and knowledge so computer users can perform their jobs more securely

• building in-depth knowledge, as needed, to design, implement, or operate security programs for organizations and systems

VI. Operational Control – Awareness, Training and Education

AWARENESS TRAINING EDUCATION

Attribute: "What" "How" "Why"

Level: Information Knowledge Insight

Objective: Recognition Skill Understanding

Teaching Method: Media(Videos, Posters,

Newsletters…)

Practical Instruction(Lecture, Case

study workshop…)

Theoretical Instruction(Seminar, reading…)

Test Measure: True/False, Multiple Choice

Problem Solving (apply learning)

Essay (interpret learning)

Impact Timeframe: Short-term Intermediate Long-term

VI. Operational Control – Computer Support and Operations

• This includes both system administration and tasks external to the system that support its operation (e.g., maintaining documentation). It does not include system planning or design.

• Support and operations are routine activities that enable computer systems to function correctly. (e.g. fixing software or hardware problems, maintaining software)

VI. Operational Control – Computer Support and Operations

• User Support:– through a Help Desk– which problems are security-related– they may not be aware of the "whole picture„

• Software Support:– controlling what software is used on a system ( must

not load any)– ensure the software has not been modified without

proper authorization (This can be done with a combination of logical and physical access controls.)

VI. Operational Control – Computer Support and Operations

• Configuration Management:– process of keeping track of changes to the system and, if

needed, approving them – the security goal is to know what changes occur, not to

prevent security from being changed• Backups:– Support and operations personnel and sometimes users

back up software and data– Frequency of backups will depend upon how often data

changes and how important those changes are.– Finally, backups should be stored securely

VI. Operational Control – Computer Support and Operations

Media Controls:– include a variety of measures to provide physical and

environmental protection and accountability for CDs, printouts and other media

– prevent the loss of confidentiality, integrity, or availability of information, including data or software, when stored outside the system

– Physical and environmental protection is used• Marking:

– Controlling media may require some form of physical labeling– e.g.: special handling instructions, to locate needed information

VI. Operational Control – Computer Support and Operations

• Logging:– to support accountability– Control numbers (or other tracking data), the times

and dates of transfers, names and signatures of individuals involved, and other relevant information

• Integrity Verification:– no modification– error detection and correction, cryptographic-based

technologies

VI. Operational Control – Computer Support and Operations

• Physical Access Protection:– Media can be stolen, destroyed, replaced with a look-alike

copy, or lost. – Physical access controls, which can limit these problems,

include locked doors, desks, file cabinets, or safes.• Environmental Protection:

– media should be protected against heat, liquids, dust etc.• Disposition

– The process of removing information from media is called sanitization.

– e.g.: overwriting, destruction by shredding or burning

VI. Operational Control – Computer Support and Operations

• Documentation :– Ensure continuity and consistency – new personnel sufficiently detailed instructions– E.g. : security plans, contingency plans, risk analyses, and

security policies and procedures• Maintenance:– System maintenance requires either physical or logical

access to the system– Support and operations staff, hardware or software vendors,

or third-party service providers may maintain a system

VI. Operational Control – Physical and environmental security

• refers to measures taken to protect systems, buildings, and related supporting infrastructure against threats associated with their physical environment

• three areas: – the building, other structure, or vehicle housing the system and network

components; determine the level of such physical threats as fire, roof leaks, or unauthorized access

– facility's general geographic operating location determines the characteristics of natural threats, which include earthquakes and flooding; man-made threats such as burglary or damaging nearby activities, including toxic chemical spills, explosions, fires, and electromagnetic interference

– system's operation usually depends on supporting facilities such as electric power, heating and air conditioning, and telecommunications.

VI. Operational Control – Physical and environmental security

• Interception of Data– Direct Observation - terminal and workstation

display screens– Interception of Data Transmissions - access to data

transmission lines– Electromagnetic Interception - Systems routinely

radiate electromagnetic energy that can be detected with special-purpose radio receivers. (TEMPEST attack)

Technical Control – Identification, Entity authentication

• Identification is the means by which a user provides a claimed identity to the system.

• Entity authentication is the means of establishing the validity of this claim.– something the individual knows (e.g.: password,

PIN)– something the individual possesses (e.g.: smart

card, token)– something the individual is (e.g.: biometric)