Chapter 3 security principals

Chapter 3 security principals

• 1.
  INFORMATION SYSTEM SECURITY Jupriyadi, S.Kom.M.T. [email protected] Bandarlampung, Juli 2021 Chapter 3
• 2.
  Security Principals Authentication Authorization orAccess Control Privacy / Confidentiality Integrity Availability Non-repudiation Auditing
• 3.
  Authentication Stating that thedata or information used or provided by the user is the person's original Countermeasure: Using Digital signature
• 4.
  Authentication  Authentication isused by a server when the server needs to know exactly who is accessing their information or site.  Authentication is used by a client when the client needs to know that the server is system it claims to be.  In authentication, the user or computer has to prove its identity to the server or client.  Usually, authentication by a server entails the use of a user name and password. Other ways to authenticate can be through cards, retina scans, voice recognition, and fingerprints.  Authentication by a client usually involves the server giving a certificate to the client in which a trusted third party.  Authentication does not determine what tasks the individual can do or what files the individual can see. Authentication merely identifies and verifies who the person or system is.
• 5.
  Three Schemes Authentication •Password Something you know • ID Card Something you have • Finger Prints Something you are
• 6.
  Authorization or Access Control Settingwho can do what, or from where to where. Can use the mechanisms of user / password or other mechanism Example: ACL on Proxy Server
• 7.
  Authorization or Access Control Authorization is a process by which a server determines if the client has permission to use a resource or access a file.  Authorization is usually coupled with authentication so that the server has some concept of who the client is that is requesting access.  The type of authentication required for authorization may vary; passwords may be required in some cases but not in others.  In some cases, there is no authorization; any user may be use a resource or access a file simply by asking for it. Most of the web pages on the Internet require no authentication or authorization.
• 8.
  Privacy/Confidentiality Security of personaldata, messages or other sensitive information Countermeasure: Using encryption
• 9.
  Integrity Information or messagesthat are kept unchanged or changed.
• 10.
  Availability The availability ofinformation security services. Countermeasure : Firewall and router filtering, backup and redundancy, IDS and IPS
• 11.
  Non-repudiation Keeping that ifit is done online transactions or activities, it can not be disclaimed
• 12.
  Auditing The existence ofthe file records data communications that occur on the network for auditing purposes such as identifying attacks on the network or server Implementation : Using System Logging
• 13.
  Basic Terminology  Threats natural threats  unintentional threats  intentional threats  Vulnerabilities  weakness in the design  Configuration  implementation  Risk  Attacks
• 14.
  What's Next ?