Frederik Questier, profile picture
Uploaded byFrederik Questier
374 views

Computer & Data Security

Here are some ways I would optimize the backup strategy: - Only back up data directories instead of entire hard disks to reduce backup size and time. - Stagger backups throughout the night instead of all at once to avoid overloading the network. - Store backups offsite as well as on the NAS for disaster recovery in case the onsite storage is damaged. - Consider cloud backup services for additional offsite storage. - Encrypt backups for security and confidentiality. - Test restores periodically to validate backups are working properly. - Consider versioning backups to allow restoration of previous file versions. - Automate verification of backups to catch any failures or corrupt backups. - Review

Embed presentation

Downloaded 15 times
1 / 123
2 / 123
3 / 123
4 / 123
5 / 123
6 / 123
7 / 123
8 / 123
9 / 123
10 / 123
11 / 123
12 / 123
13 / 123
14 / 123
15 / 123
16 / 123
17 / 123
18 / 123
19 / 123
20 / 123
21 / 123
22 / 123
23 / 123
24 / 123
25 / 123
26 / 123
27 / 123
28 / 123
29 / 123
30 / 123
31 / 123
32 / 123
33 / 123
34 / 123
35 / 123
36 / 123
37 / 123
38 / 123
39 / 123
40 / 123
41 / 123
42 / 123
43 / 123
44 / 123
45 / 123
46 / 123
47 / 123
48 / 123
49 / 123
50 / 123
51 / 123
52 / 123
53 / 123
54 / 123
55 / 123
56 / 123
57 / 123
58 / 123
59 / 123
60 / 123
61 / 123
62 / 123
63 / 123
64 / 123
65 / 123
66 / 123
67 / 123
68 / 123
69 / 123
70 / 123
71 / 123
72 / 123
73 / 123
74 / 123
75 / 123
76 / 123
77 / 123
78 / 123
79 / 123
80 / 123
81 / 123
82 / 123
83 / 123
84 / 123
85 / 123
86 / 123
87 / 123
88 / 123
89 / 123
90 / 123
91 / 123
92 / 123
93 / 123
94 / 123
95 / 123
96 / 123
97 / 123
98 / 123
99 / 123
100 / 123
101 / 123
102 / 123
103 / 123
104 / 123
105 / 123
106 / 123
107 / 123
108 / 123
109 / 123
110 / 123
111 / 123
112 / 123
113 / 123
114 / 123
115 / 123
116 / 123
117 / 123
118 / 123
119 / 123
120 / 123
121 / 123
122 / 123
123 / 123
Computer & Data Security Prof. dr. Frederik Questier - Vrije Universiteit Brussel Presented at: Arba Minch University, Ethiopia, 03/2019
Main objectives of computer security ➢ Confidentiality ➢ of data (secrecy) ➢ of persons (privacy) ➢ access only by authorized parties ➢ Integrity ➢ data only correctly modified or deleted by authorized parties ➢ Availability ➢ correctly accessible in a timely manner ➢ the failure to meet this goal is called a denial of service
Assignment Risk analysis Congratulations! You are elected member of the newly established computer and data security team in the university. Make a list of all possible risks that can have an impact on the security and stability of your internal and external IT services.
What can go wrong? Nature ➢ lightning strike ➢ fire ➢ flood ➢ heat wave – cold wave ➢ storm weather, hurricane ➢ earthquake ➢ tsunami ➢ volcano eruption ➢ electro magnetic pulse from the sun ➢ disease of key employees
What can go wrong? Infrastructure or services problems ➢ Failure of ➢ software (bugs; license expired, ...) ➢ hardware ➢ electricity ➢ power outage or power surge ➢ network (cable cut – saturation) ➢ airconditioning ➢ water pipes –> leak ➢ system upgrades ➢ service providers (e.g. cloud) ➢ Overload of CPU, memory, storage, network (spam)
What can go wrong? Human errors ➢ Weak security ➢ Loss of laptops, smartphones, USB-sticks, … ➢ No encryption ➢ Passwords leaks or cracks ➢ Computer console left unlocked ➢ Misunderstanding computer interface or other mistakes ➢ Deleting data ➢ Corrupting data ➢ Confiscation of machines
What can go wrong? Evil actions by people ➢ break in (hackers - crackers) ➢ social engineering ➢ phishing ➢ (identity) theft ➢ vandalism ➢ unhappy employees ➢ sabotage (time bomb), leaks ➢ cyber attack, e.g. (Distributed) Denial of Service ➢ terrorism ➢ war ➢ nuclear bomb
What can go wrong? Malware (malicious software) ➢ Botnet ➢ Rootkit ➢ Back door ➢ Spyware ➢ keylogger ➢ network sniffer ➢ Dialer ➢ Ransomware
Business continuity planning = how to stay in business in the event of disaster? ➢ Disaster recovery ● Preventive measures ● Detective measures ● Corrective measures
Threat modeling 1) What do you want to protect? 2) Who/what do you want to protect it from? 3) How likely is it that you will need to protect it? 4) How bad are the consequences if you fail? 5) How much trouble are you willing to go through in order to try to prevent those?
Tools for computer security
Tools for confidentiality ➢ Authorization - access policies - access control ➢ Authentication – identification ➢ Passwords ➢ … ➢ Encryption ➢ Virtual private networking ➢ Auditing – logging ➢ ...
Tools for integrity ➢ Backups ➢ Checksums ➢ ...
Tools for availability ➢ Disaster recovery planning ➢ Physical protections ➢ Anti-theft ➢ Uninterruptible Power Supply ➢ Redundancies ➢ Intrusion-detection systems ➢ Antivirus software ➢ Firewall ➢ ...
TOOLS FOR CONFIDENTIALITY
Passwords ➢ Don't share them ➢ Not even with computer administrators ➢ Don't write them down ➢ Don't reuse them among different sites ➢ Change them often ➢ Select wise: ➢ Easy to remember ➢ Hard to guess (resistant to dictionary attacks) ➢ Password length ➢ Large set of characters (caps, lower case, numbers, symbols)
Some notorious password leaks ➢ 2016: 500M Yahoo passwords ➢ 2015: 30M Ashley Madison MD5 passwords etc ➢ 2014: 5M Gmail passwords ➢ 2013: 38M Adobe passwords (and source code) ➢ 2013: 250K Twitter passwords ➢ 2012: 12M Apple User IDs stolen by FBI, 1M leaked ➢ 2012: 6M LinkedIn passwords ➢ 2012: 450K plain text Yahoo passwords ➢ 2012: 1.5M plain text Youporn passwords ➢ 2009: 10K MS Hotmail, MSN and Live passwords
Johannes Weber, http://blog.webernetz.net/2013/07/30/password-strengthentropy-characters-vs-words/
Passphrases are more secure than passwords
Biometric identification ➢ Finger print ➢ Voice print ➢ Iris scan ➢ Retinal scan ➢ Convenient ➢ Relative safe ➢ But...
Danger of biometric identification?
Danger of biometric identification? ➢ You can't change your biometric password once it got leaked ➢ You can't legally refuse to give it, unlike a password (US fifth amendment) ➢ Something like a fingerprint might be unusable as a password, because you leave copies of your fingerprints on everything you touch. ➢ Fingerprint is more like a login than like a password.
Lock your screen when you leave
Security issues in communication PrivacyPrivacy IntegrityIntegrity AuthenticationAuthentication Non-repudiationNon-repudiation Interception Spoofing Modification Proof of parties involved
Cryptography = secret writing
Cipher algorithm for performing encryption or decryption ➢ Example: Caesar cipher
Great if we can exchange our messages encrypted! But how can we safely exchange our keys?
Symmetric encryption Sender and receiver must both know the same secret key How to exchange that key over distance??? Asymmetric encryption Sender only needs to know the public key of receiver!
Public key encryption The private key can unlock (decrypt) what is locked (encrypted) with the public key
Public key encryption Creation of keys
Man-in-the-middle attack ➢ How can Bob know that Alice's key is really Alice's key (and not Mallory's)?
Digital certificates Version # Serial # Signature Algorithm Issuer Name Validity Period Subject Name Subject Public Key Issuer Unique ID Subject Unique ID Extensions Digital Signature
HTTPS SSL exchange
➢ CAcert.org is a community-driven certificate authority that issues free public key certificates to the public (unlike other certificate authorities which are commercial and sell certificates). ➢ CAcert has over 200,000 verified users. ➢ These certificates can be used to digitally sign and encrypt email, authenticate and authorize users connecting to websites and secure data transmission over the Internet.
Web of trust Keysigning parties
Belgian eID contains personal authentication certificate signature certificate Two factor auth: possession of eID and knowledge of pin code
Private keys never leave eID! Signatures are computed in eID on hash of file-to-be-signed (SHA-1 = Secure Hash Algorithm)
Error detection - Checksum - cryptographic hash e.g. CRC32 (cyclic redundancy check) MD5 (message digest) SHA-3 (Secure Hash Algorithm)
Belgian electronic medical prescriptions are based on the e-ID ➢ Doctor is identified with e-ID ➢ Patient is identified with e-ID ➢ Doctor signs the prescription with e-ID ➢ Prescription is stored in national Recip-e database. ➢ Patient can consult prescriptions in patient portal with e-ID ➢ Pharmacist is identified with e-ID ➢ Pharmacist finds the prescription in the Recip-e database with barcode on the paper version of the prescription.
➢ Encrypted protocols ➢ HTTPS ➢ SFTP ➢ SSH ➢ TOR ➢ VPN ➢ WEP (Wired Equivalent Protocol. Weak!) ➢ WPA - WPA2 Wi-Fi Protected Access ➢ Non-encrypted protocols ➢ HTTP ➢ FTP ➢ TELNET ➢ BitTorrent
Telegram and Signal ➢ Free Open Source software ➢ End to end encryption ➢ Delete messages everywhere ➢ Self-destruct timer for messages ➢ VOIP ➢ User friendly ➢ For Android, iOS, …
Full disk encryption
Virtual drive in file container Encrypted file container.txt Mountable as virtual drive /media/encrypted-disk /Volumes/encrypted-disk E:
Android encryption
Virtual Private Networks extends a private (hospital) network across a public (internet) network encrypted to protect against network sniffing
Internet use through a VPN provider Sarah A. Downey, http://www.abine.com/blog/2012/petraeuss-emails-werent-private-and-neither-are-yours/
(Free) VPNs? ➢ VPNs good for ➢ protection against nearby spying and MITM attack ➢ avoiding geoblocking ➢ But you need to trust your VPN provider ➢ The free VPNs might have a business model based on spying on you. ➢ Don’t install their proprietary apps ➢ The good VPN providers support OpenVPN ➢ Best to install e.g. OpenVPN on your own server.
Firewall Private versus Demilitarized zone
Private browsing
Task: check http://donttrack.us/
= The Onion Router Free Open Source software for anonymity network
Edward Snowden: “Encryption works. Properly implemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it.”
➢ From the European Parliament investigation into the Echelon system (05/18/2001): “If security is to be taken seriously, only those operating systems should be used whose source code has been published and checked, since only then can it be determined with certainty what happens to the data.”
➢ Cryptographer, computer security expert Bruce Schneier: “Secrecy and security aren't the same, even though it may seem that way. Only bad security relies on secrecy; good security works even if all the details of it are public." “If researchers don’t go public, things don’t get fixed. Companies don't see it as a security problem; they see it as a PR problem.” “Demand open source code for anything related to security”
The Borland Interbase example ➢ 1992-1994: Borland inserted intentional back door into Interbase (closed source database server) allowing local or remote users root access to the machine ➢ 07/2000: Borland releases source code (→ Firebird) ➢ 12/2000: Back door is discovered
Your opinion?
“Our products just aren’t engineered for security.” Brian Valentine, Microsoft senior vice-president Windows Engineering, 2002
Be aware of phishing attacks
TOOLS FOR INTEGRITY
Backups How would you optimize this backup strategy? ➢ Every night at 4 am, all university computers get a wake up signal. ➢ The backup server takes over network a complete backup of every hard disk of every computer. ➢ The backups are stored on a NAS (Network Attached Storage) with 1000 hard disks. ➢ The backup server and the NAS are located in the data center of the university (floor level -1). ➢ To save storage space, backups older than a year are deleted.
Backup Example: centralized over network
Backups ➢ First time and sometimes: full backup ➢ Most often: only incremental backup ➢ Use a good data retention scheme ➢ e.g. 7 daily, 4 weekly, 12 monthly, all yearly backups ➢ + Use off-site data protection = vaulting ➢ e.g. remote backup (compression, encryption!) ➢ Use offline backups as protection against ransomware ➢ Reflect about your time for full restore ➢ Test the restore procedure! ➢ “80% of backups fail to restore”
(Cheap) versioning For important documents save daily new version as: thesis20190307.odt This avoids overwriting backups with corrupt data See also https://en.wikipedia.org/wiki/ISO_8601
Integrity checkers ➢ Tripwire ➢ Samhain
TOOLS FOR AVAILABILITY
Uninterruptible Power Supply UPS 1)Flywheel 2)Diesel generators 3)Batteries (UPS)
Your toilets are better locked than your electrical switches
DDoS Distributed Denial of Service
fault tolerance high availability redundancy fail over
RAID: Redundant Array of Independent Disks
Install software from trusted sources! (avoid if possible P2P or web downloads)
Apply software updates and upgrades!
If you don’t apply security fixes fast enough... ➢ Microsoft ➢ Patch Tuesday ➢ Exploit Wednesday
Principle of least privilege Avoid privilege escalation
Intrusion Detection Systems (IDS) ➢ Fail2ban ➢ Snort ➢ real-time traffic analysis and packet logging ➢ detect probes or attacks ➢ Samhain ➢ Complete integrity check ➢ uses cryptographic checksums of files to detect modifications, ➢ can find rogue SUID executables anywhere on disk ➢ Centralized monitoring ➢ native support for logging to a central server via encrypted and authenticated connections ➢ Tamper resistance ➢ database and configuration files can be signed ➢ log file entries and e-mail reports are signed ➢ support for stealth operation ➢ Honey pots ➢ ...
Subscribe to security mailing lists of the critical software you are using
Assignments ➢ Make a risk analysis and threat modeling of the computer and data systems at your organization. What are the weakest and most unsecure parts? ➢ Risk ... probability * potential impact = total risk level ➢ Which actions will you take to increase the security at your organization? ➢ Why are some operating systems more secure than others? ➢ Compare the security characteristics of the Linux operating system and Windows
Windows versus Linux security ➢ Windows origin ➢ QDOS (Quick and Dirty Operating System, 1980) ➢ To fit in small 8086 Personal Computer all existing concepts of security, network, multi-user, … where omitted. ➢ 86-DOS ➢ MSDOS ➢ Windows ➢ Linux (1991) ➢ Modeled according to UNIX, with security, network and multi-user concepts implemented from the beginning.
Windows versus Linux security ➢ Windows and its software ➢ Source code mostly secret ➢ Cannot be audited ➢ Microsoft’s self-inflicted curse of binary compatibility: ➢ Major design improvements are hard as Microsoft cannot modify & recompile proprietary software by others ➢ Linux and its software ➢ Free Open Source ➢ Source code can be audited, bugs and backdoors found ➢ Major design improvements are easier to implement
Windows versus Linux security ➢ Windows software ➢ Often (illegal copies) downloaded from web or P2P ➢ No checksum or signature ➢ Often malware. No way to detect it. ➢ Installer = executable ➢ Any malware gets executed with admin privileges ➢ Linux ➢ Software is installed through package manager ➢ Package maintainers of the many distributions often audit code and compile from source. ➢ Package maintainers sign the packages and provide checksums ➢ Package = compressed archive only unpacked by root
Windows versus Linux security Updates ➢ Windows update manager is only updating Windows (and other Microsoft software?) ➢ Linux update manager is updating all software installed through the package manager, which is typically near 100%.
Windows versus Linux security User attitudes towards updates & upgrades ➢ Windows users don’t like updates & upgrades ➢ Windows reboots for updates ➢ System cannot be used during installation of the updates ➢ Users have very little control over updates ➢ Updates often come with more anti-user features ➢ Microsoft forces GUI changes upon upgrades ➢ Users continue with outdated OS when they don’t like GUI of newer version ➢ Linux ➢ Software and kernel(!) updates can be installed without rebooting or unavailability of the system ➢ Users have total control over updates ➢ User can select the GUI indepentdently from upgrades
Windows versus Linux security Who gets updates ➢ Windows and its software ➢ Sometimes “pirate users” did not get updates ➢ Linux and its software ➢ Users are never labeled as “pirates” ➢ Users are not denied updates
Windows versus Linux security ➢ Windows ➢ Not modular ➢ Most versions can’t be run without GUI ➢ No strict separation between kernel and GUI, webbrowser, games, … ➢ Any bug in these can lead to crash or intrusion of the kernel ➢ Linux and its software ➢ Modular ➢ GUI is an option ➢ Strict separation between kernel and user space
Windows versus Linux security ➢ Windows ➢ Decides if a file is executable based on extension ➢ Read and execute permissions are not distinct ➢ “50+ File Extensions that are Potentially Dangerous on Windows” ➢ Windows hides extensions by default, but only the last one ➢ file.jpg.exe is visible as file.jpg ➢ Mail attachments can infect you with malware ➢ Linux ➢ Decides if a file is executable based on execution bit ➢ Read and execute permissions are distinct ➢ Nobody was stupid enough to write a Linux mail client that sets the execution permission on attachments.
Windows versus Linux security ➢ Windows ➢ Autorun software from CD and USB (until Windows 7) ➢ Linux ➢ Autorun is not default or asks user permission
Windows versus Linux security ➢ Windows ➢ Many users work day in day out with an admin account ➢ Linux ➢ Users get a big fat warning when they attempt to login in the GUI as root ➢ Users get very low privileges ➢ Different crucial applications run on different user accounts ➢ E.g. Apache web server runs as user www ➢ User www has only (write) access to its own files.
Windows versus Linux security ➢ Windows ➢ FAT and NTFS still don’t have the option to create a non- executable partition? ➢ Linux ➢ /tmp can be set as noexec ➢ This prevents that malware uploaded through e.g. webserver can be executed.
Windows versus Linux security ➢ Windows ➢ Monoculture ➢ Linux ➢ 300+ distributions ➢ 84+ window managers ➢ Many packaging systems ➢ Many mail clients ➢ The diversity slows down widespread malware infections as these will not work for all Linux systems.
Windows versus Linux security ➢ Windows filesystems ➢ Not much more than FAT and NTFS ➢ Linux ➢ Supports tens of filesystems ➢ Including some high availability oriented ones such as ZFS.
Windows versus Linux security Matheus effect ➢ Windows ➢ Many users don’t care about security ➢ Linux ➢ Users caring about security will rather use Linux ➢ These users secure their systems more ➢ Linux get more attention by security caring developers
Credits ➢ Password Strength, Creative Commons BY-NC http://xkcd.com/936/ ➢ Security, Creative Commons BY-NC http://xkcd.com/538/ ➢ Zimmermann Telegram, 1917, no known copyright restrictions ➢ Assymetric and symmetric encryption by Jeremy Stretch, http://packetlife.net/blog/2010/nov/23/symmetric-asymmetric-encryption-hashing/ ➢ Orange blue public key cryptography, Creative Commons CC0 by Bananenfalter ➢ HTTPS SSL Exchange by Robb Perry, http://coding.smashingmagazine.com/2012/05/17/backpack-algorithms-and-public-key-cryptography-made-easy/ ➢ Bitcoin logo, Public Domain by bitboy ➢ Bitcoin Transaction Visual, Creative Commons CC0 by Graingert ➢ Question mark CC-by by Stefan Baudy ➢ GNU Head Joseph W. Reiss Free Art License or the GNU GPLv2
This presentation was made with 100% Free Software No animals were harmed Questier.com Frederik AT Questier.com www.linkedin.com/in/fquestie www.diigo.com/user/frederikquestier www.slideshare.net/Frederik_Questier T hank you! Q uestions?

More Related Content

PPTX
Introduction of computer security
bySoundaryaB2
 
PPTX
Network security - Basic concepts
byKhoa Nguyen
 
PPTX
Impact to it security of incorrect configuration of firewall policies and thi...
byusman butt
 
PPTX
HONEYPOTS: Definition, working, advantages, disadvantages
byamit kumar
 
PDF
Hacking Closed Networks
byPriyanka Aash
 
DOC
Honeypot seminar report
byInder NeGi
 
PPTX
Cyber Security
byfrcarlson
 
PDF
IoT security is a nightmare. But what is the real risk?
byZoltan Balazs
 
Introduction of computer security
bySoundaryaB2
 
Network security - Basic concepts
byKhoa Nguyen
 
Impact to it security of incorrect configuration of firewall policies and thi...
byusman butt
 
HONEYPOTS: Definition, working, advantages, disadvantages
byamit kumar
 
Hacking Closed Networks
byPriyanka Aash
 
Honeypot seminar report
byInder NeGi
 
Cyber Security
byfrcarlson
 
IoT security is a nightmare. But what is the real risk?
byZoltan Balazs
 

What's hot

PPTX
Network Security
byPuneet Abichandani
 
PPT
Intrusion Detection And Prevention
byNicholas Davis
 
PPT
Network Security
byVIKAS SINGH BHADOURIA
 
PPTX
Weaponizing the Nokia N900 -- TakeDownCon, Dallas, 2011
byshawn_merdinger
 
PDF
Encryption
byDanielNanaAnyemeduHe
 
PPTX
Exploiting Redundancy Properties of Malicious Infrastructure for Incident Det...
byPositive Hack Days
 
PPT
Honeypot and Steganography
byPreeti Yadav
 
PPT
Honeypot-A Brief Overview
bySILPI ROSAN
 
PPT
Honey Pot
byiradarji
 
PDF
Why Risk Management Fails
byRichard Stiennon
 
PPT
A+ Update Endpoint Encryption
byOSU - East
 
PPTX
Session Slide
byMuralidharan Radhakrishnan
 
PPTX
Network security and System Admin
byMD SAHABUDDIN
 
PDF
Intrusion_Detection_By_loay_elbasyouni
byLoay Elbasyouni
 
PPT
Network Security fundamentals
byTariq kanher
 
PPTX
BYOD and Your Business
bycherienetclarity
 
PDF
Hacking
bySahilGothoskar
 
PDF
Mobile #Infosec hackathon for journalists(2)
byTanja Drca
 
PDF
Hacktivity 2016: The real risks of the IoT security-nightmare: Hacking IP cam...
byZoltan Balazs
 
PPTX
Cyber crime trends in 2013
byThe eCore Group
 
Network Security
byPuneet Abichandani
 
Intrusion Detection And Prevention
byNicholas Davis
 
Network Security
byVIKAS SINGH BHADOURIA
 
Weaponizing the Nokia N900 -- TakeDownCon, Dallas, 2011
byshawn_merdinger
 
Encryption
byDanielNanaAnyemeduHe
 
Exploiting Redundancy Properties of Malicious Infrastructure for Incident Det...
byPositive Hack Days
 
Honeypot and Steganography
byPreeti Yadav
 
Honeypot-A Brief Overview
bySILPI ROSAN
 
Honey Pot
byiradarji
 
Why Risk Management Fails
byRichard Stiennon
 
A+ Update Endpoint Encryption
byOSU - East
 
Session Slide
byMuralidharan Radhakrishnan
 
Network security and System Admin
byMD SAHABUDDIN
 
Intrusion_Detection_By_loay_elbasyouni
byLoay Elbasyouni
 
Network Security fundamentals
byTariq kanher
 
BYOD and Your Business
bycherienetclarity
 
Hacking
bySahilGothoskar
 
Mobile #Infosec hackathon for journalists(2)
byTanja Drca
 
Hacktivity 2016: The real risks of the IoT security-nightmare: Hacking IP cam...
byZoltan Balazs
 
Cyber crime trends in 2013
byThe eCore Group
 

Similar to Computer & Data Security

PDF
Computer Security
byFrederik Questier
 
PPT
Technical seminar on Security
bySTS
 
PPT
Computer Securityyyyyyyy - Chapter 1.ppt
bySolomonSB
 
PPTX
CRYPTOGRAPHY AND NETWORK SECURITY ppt by me.pptx
byNune SrinivasRao
 
PDF
Computer Security Principles and Practice 3rd Edition William Stallings
bykvxkcibqc7188
 
PDF
cryptograph and computer security lecture 1.pdf
byAWELHAJI2
 
PDF
Need for cyber security
byJetking
 
DOCX
FIDO AUTHENTICATIONDEFINITION· Acronym FIDO stands for Fast I
byChereCheek752
 
PDF
Health Information Privacy and Security
byNawanan Theera-Ampornpunt
 
PPT
Computer Systems Security
bydrkelleher
 
PPT
Computersystemssecurity 090529105555-phpapp01
byMiigaa Mine
 
PPT
Data+security+sp10
byismaelhaider
 
PPTX
INTERNETSECURITY with the different threats
byPrabinPathak5
 
PPTX
INFORMATION AND CYBER SECURITY
byNishant Pawar
 
PPT
Security
bymajstors
 
PPTX
Information Security
bysonykhan3
 
PPTX
ISBB_Chapter6.pptx
byAmanSoni665879
 
PPT
InfoSecConcepts.ppt
byMobileAntitheft
 
PPTX
security in is.pptx
byselvapriyabiher
 
PPTX
How to write secure code
byFlaskdata.io
 
Computer Security
byFrederik Questier
 
Technical seminar on Security
bySTS
 
Computer Securityyyyyyyy - Chapter 1.ppt
bySolomonSB
 
CRYPTOGRAPHY AND NETWORK SECURITY ppt by me.pptx
byNune SrinivasRao
 
Computer Security Principles and Practice 3rd Edition William Stallings
bykvxkcibqc7188
 
cryptograph and computer security lecture 1.pdf
byAWELHAJI2
 
Need for cyber security
byJetking
 
FIDO AUTHENTICATIONDEFINITION· Acronym FIDO stands for Fast I
byChereCheek752
 
Health Information Privacy and Security
byNawanan Theera-Ampornpunt
 
Computer Systems Security
bydrkelleher
 
Computersystemssecurity 090529105555-phpapp01
byMiigaa Mine
 
Data+security+sp10
byismaelhaider
 
INTERNETSECURITY with the different threats
byPrabinPathak5
 
INFORMATION AND CYBER SECURITY
byNishant Pawar
 
Security
bymajstors
 
Information Security
bysonykhan3
 
ISBB_Chapter6.pptx
byAmanSoni665879
 
InfoSecConcepts.ppt
byMobileAntitheft
 
security in is.pptx
byselvapriyabiher
 
How to write secure code
byFlaskdata.io
 

More from Frederik Questier

PDF
FLOSS development
byFrederik Questier
 
PDF
Authentication options for Open edX: focus on OAuth and OpenID
byFrederik Questier
 
PDF
E-learning design models - Primer for (educational) technologists
byFrederik Questier
 
PDF
Plagiarism prevention and detection
byFrederik Questier
 
PDF
Challenges for 21st century education and blended learning
byFrederik Questier
 
PDF
Open e-learning - MarMOOC experiences - Cuba
byFrederik Questier
 
PDF
New learning paradigms and technologies
byFrederik Questier
 
PDF
New learning paradigms and learning technologies
byFrederik Questier
 
PDF
Free Libre Open Source Software Development
byFrederik Questier
 
PDF
FLOSS & OER
byFrederik Questier
 
PDF
Open learning Experiences from the MarMOOC project
byFrederik Questier
 
PDF
Free & Open Source Software (2017 update)
byFrederik Questier
 
PDF
FLOSS strategies & policies
byFrederik Questier
 
PDF
Free Libre And Open Source Software Acceptance in The Cuban Higher Educationa...
byFrederik Questier
 
PDF
Open learning experiences from the MarMOOC project presented at BDU
byFrederik Questier
 
PDF
OER & Copyrights
byFrederik Questier
 
PDF
MOOCs & Openness
byFrederik Questier
 
PDF
Institutional strategies for educational innovation and e-learning
byFrederik Questier
 
PDF
Open learning Experiences from the MarMOOC project (presented at UHo)
byFrederik Questier
 
PDF
Students' Experiential Knowledge Production in the Teaching-Learning Process ...
byFrederik Questier
 
FLOSS development
byFrederik Questier
 
Authentication options for Open edX: focus on OAuth and OpenID
byFrederik Questier
 
E-learning design models - Primer for (educational) technologists
byFrederik Questier
 
Plagiarism prevention and detection
byFrederik Questier
 
Challenges for 21st century education and blended learning
byFrederik Questier
 
Open e-learning - MarMOOC experiences - Cuba
byFrederik Questier
 
New learning paradigms and technologies
byFrederik Questier
 
New learning paradigms and learning technologies
byFrederik Questier
 
Free Libre Open Source Software Development
byFrederik Questier
 
FLOSS & OER
byFrederik Questier
 
Open learning Experiences from the MarMOOC project
byFrederik Questier
 
Free & Open Source Software (2017 update)
byFrederik Questier
 
FLOSS strategies & policies
byFrederik Questier
 
Free Libre And Open Source Software Acceptance in The Cuban Higher Educationa...
byFrederik Questier
 
Open learning experiences from the MarMOOC project presented at BDU
byFrederik Questier
 
OER & Copyrights
byFrederik Questier
 
MOOCs & Openness
byFrederik Questier
 
Institutional strategies for educational innovation and e-learning
byFrederik Questier
 
Open learning Experiences from the MarMOOC project (presented at UHo)
byFrederik Questier
 
Students' Experiential Knowledge Production in the Teaching-Learning Process ...
byFrederik Questier
 

Recently uploaded

PDF
The Complete Crypto Airdrop Playbook: Strategies, Scams & Success Stories | 3...
by3verseTV
 
PPSX
AppSec Role Based Training OWASP Global AppSec USA 2025-11-06
byRobert Grupe, CSSLP CISSP PE PMP
 
PDF
Database Performance at Scale: The TL;DR
byScyllaDB
 
PPTX
GenAI GraphTalk - Kuala Lumpur - 4 Nov 2025
bygourisachdeva2
 
PDF
#MakeAIMatter for HR Professionals | AI Transformation Workshop by Tekdi Tech...
byParth Lawate
 
PDF
UiPath Veterans Day Acknowledgement and Benefits
byDianaGray10
 
PDF
Unveiling the Basics of Agentic AI - OSUG Mumbai
bythesubuiyer
 
PDF
Inclusive India_Samir_Dash_10 NOV_FINAL 2025.pdf
bySamir Dash
 
PDF
Manage Files Using CLI - RHCSA (RH124).pdf
byLinuxCert Guru
 
PDF
Dr. Robert Krug - Specializes In Predictive Modeling
byDr. Robert Krug
 
PDF
WebXR in Android and Linux with OpenXR
byIgalia
 
PPTX
Career Blueprint - Future Career Vision & Success Stories - 2025 - Part 1
byDianaGray10
 
PDF
Supercharge Your JVM with Project Leyden
byAna-Maria Mihalceanu
 
PDF
Upskill to Agentic Automation - Accelerating Your Job Search using AI
byDianaGray10
 
PDF
Wrapping up unowned UTF8 C strings: CStringView
byIgalia
 
PDF
Access Linux File System in RHEL - RHCSA (RH124).pdf
byLinuxCert Guru
 
PDF
Catalog Data - Keys to the Kingdom.pdf‎ ‎
byPrecisely
 
PDF
Create, View and Edit Text Files - RHCSA (RH124).pdf
byLinuxCert Guru
 
PDF
How to not make bugs (in JSC), and the future of 32-bits
byIgalia
 
PPTX
Bulwark Pokemon League Top 8 graphic archive
byGc Howard
 
The Complete Crypto Airdrop Playbook: Strategies, Scams & Success Stories | 3...
by3verseTV
 
AppSec Role Based Training OWASP Global AppSec USA 2025-11-06
byRobert Grupe, CSSLP CISSP PE PMP
 
Database Performance at Scale: The TL;DR
byScyllaDB
 
GenAI GraphTalk - Kuala Lumpur - 4 Nov 2025
bygourisachdeva2
 
#MakeAIMatter for HR Professionals | AI Transformation Workshop by Tekdi Tech...
byParth Lawate
 
UiPath Veterans Day Acknowledgement and Benefits
byDianaGray10
 
Unveiling the Basics of Agentic AI - OSUG Mumbai
bythesubuiyer
 
Inclusive India_Samir_Dash_10 NOV_FINAL 2025.pdf
bySamir Dash
 
Manage Files Using CLI - RHCSA (RH124).pdf
byLinuxCert Guru
 
Dr. Robert Krug - Specializes In Predictive Modeling
byDr. Robert Krug
 
WebXR in Android and Linux with OpenXR
byIgalia
 
Career Blueprint - Future Career Vision & Success Stories - 2025 - Part 1
byDianaGray10
 
Supercharge Your JVM with Project Leyden
byAna-Maria Mihalceanu
 
Upskill to Agentic Automation - Accelerating Your Job Search using AI
byDianaGray10
 
Wrapping up unowned UTF8 C strings: CStringView
byIgalia
 
Access Linux File System in RHEL - RHCSA (RH124).pdf
byLinuxCert Guru
 
Catalog Data - Keys to the Kingdom.pdf‎ ‎
byPrecisely
 
Create, View and Edit Text Files - RHCSA (RH124).pdf
byLinuxCert Guru
 
How to not make bugs (in JSC), and the future of 32-bits
byIgalia
 
Bulwark Pokemon League Top 8 graphic archive
byGc Howard
 

Computer & Data Security

  • 1.
    Computer & Data Security Prof.dr. Frederik Questier - Vrije Universiteit Brussel Presented at: Arba Minch University, Ethiopia, 03/2019
  • 3.
    Main objectives of computersecurity ➢ Confidentiality ➢ of data (secrecy) ➢ of persons (privacy) ➢ access only by authorized parties ➢ Integrity ➢ data only correctly modified or deleted by authorized parties ➢ Availability ➢ correctly accessible in a timely manner ➢ the failure to meet this goal is called a denial of service
  • 4.
    Assignment Risk analysis Congratulations! You areelected member of the newly established computer and data security team in the university. Make a list of all possible risks that can have an impact on the security and stability of your internal and external IT services.
  • 5.
    What can gowrong? Nature ➢ lightning strike ➢ fire ➢ flood ➢ heat wave – cold wave ➢ storm weather, hurricane ➢ earthquake ➢ tsunami ➢ volcano eruption ➢ electro magnetic pulse from the sun ➢ disease of key employees
  • 6.
    What can gowrong? Infrastructure or services problems ➢ Failure of ➢ software (bugs; license expired, ...) ➢ hardware ➢ electricity ➢ power outage or power surge ➢ network (cable cut – saturation) ➢ airconditioning ➢ water pipes –> leak ➢ system upgrades ➢ service providers (e.g. cloud) ➢ Overload of CPU, memory, storage, network (spam)
  • 7.
    What can gowrong? Human errors ➢ Weak security ➢ Loss of laptops, smartphones, USB-sticks, … ➢ No encryption ➢ Passwords leaks or cracks ➢ Computer console left unlocked ➢ Misunderstanding computer interface or other mistakes ➢ Deleting data ➢ Corrupting data ➢ Confiscation of machines
  • 8.
    What can gowrong? Evil actions by people ➢ break in (hackers - crackers) ➢ social engineering ➢ phishing ➢ (identity) theft ➢ vandalism ➢ unhappy employees ➢ sabotage (time bomb), leaks ➢ cyber attack, e.g. (Distributed) Denial of Service ➢ terrorism ➢ war ➢ nuclear bomb
  • 9.
    What can gowrong? Malware (malicious software) ➢ Botnet ➢ Rootkit ➢ Back door ➢ Spyware ➢ keylogger ➢ network sniffer ➢ Dialer ➢ Ransomware
  • 10.
    Business continuity planning =how to stay in business in the event of disaster? ➢ Disaster recovery ● Preventive measures ● Detective measures ● Corrective measures
  • 11.
    Threat modeling 1) Whatdo you want to protect? 2) Who/what do you want to protect it from? 3) How likely is it that you will need to protect it? 4) How bad are the consequences if you fail? 5) How much trouble are you willing to go through in order to try to prevent those?
  • 12.
  • 13.
    Tools for confidentiality ➢ Authorization- access policies - access control ➢ Authentication – identification ➢ Passwords ➢ … ➢ Encryption ➢ Virtual private networking ➢ Auditing – logging ➢ ...
  • 14.
  • 15.
    Tools for availability ➢ Disasterrecovery planning ➢ Physical protections ➢ Anti-theft ➢ Uninterruptible Power Supply ➢ Redundancies ➢ Intrusion-detection systems ➢ Antivirus software ➢ Firewall ➢ ...
  • 16.
  • 17.
    Passwords ➢ Don't share them ➢ Noteven with computer administrators ➢ Don't write them down ➢ Don't reuse them among different sites ➢ Change them often ➢ Select wise: ➢ Easy to remember ➢ Hard to guess (resistant to dictionary attacks) ➢ Password length ➢ Large set of characters (caps, lower case, numbers, symbols)
  • 18.
    Some notorious passwordleaks ➢ 2016: 500M Yahoo passwords ➢ 2015: 30M Ashley Madison MD5 passwords etc ➢ 2014: 5M Gmail passwords ➢ 2013: 38M Adobe passwords (and source code) ➢ 2013: 250K Twitter passwords ➢ 2012: 12M Apple User IDs stolen by FBI, 1M leaked ➢ 2012: 6M LinkedIn passwords ➢ 2012: 450K plain text Yahoo passwords ➢ 2012: 1.5M plain text Youporn passwords ➢ 2009: 10K MS Hotmail, MSN and Live passwords
  • 20.
  • 21.
  • 23.
    Biometric identification ➢ Finger print ➢ Voiceprint ➢ Iris scan ➢ Retinal scan ➢ Convenient ➢ Relative safe ➢ But...
  • 24.
  • 25.
    Danger of biometric identification? ➢ Youcan't change your biometric password once it got leaked ➢ You can't legally refuse to give it, unlike a password (US fifth amendment) ➢ Something like a fingerprint might be unusable as a password, because you leave copies of your fingerprints on everything you touch. ➢ Fingerprint is more like a login than like a password.
  • 26.
    Lock your screenwhen you leave
  • 27.
    Security issues incommunication PrivacyPrivacy IntegrityIntegrity AuthenticationAuthentication Non-repudiationNon-repudiation Interception Spoofing Modification Proof of parties involved
  • 29.
  • 31.
    Cipher algorithm for performingencryption or decryption ➢ Example: Caesar cipher
  • 36.
    Great if wecan exchange our messages encrypted! But how can we safely exchange our keys?
  • 37.
    Symmetric encryption Sender andreceiver must both know the same secret key How to exchange that key over distance??? Asymmetric encryption Sender only needs to know the public key of receiver!
  • 38.
    Public key encryption Theprivate key can unlock (decrypt) what is locked (encrypted) with the public key
  • 39.
  • 44.
    Man-in-the-middle attack ➢ How canBob know that Alice's key is really Alice's key (and not Mallory's)?
  • 45.
    Digital certificates Version # Serial# Signature Algorithm Issuer Name Validity Period Subject Name Subject Public Key Issuer Unique ID Subject Unique ID Extensions Digital Signature
  • 46.
  • 47.
    ➢ CAcert.org is acommunity-driven certificate authority that issues free public key certificates to the public (unlike other certificate authorities which are commercial and sell certificates). ➢ CAcert has over 200,000 verified users. ➢ These certificates can be used to digitally sign and encrypt email, authenticate and authorize users connecting to websites and secure data transmission over the Internet.
  • 48.
  • 49.
    Belgian eID containspersonal authentication certificate signature certificate Two factor auth: possession of eID and knowledge of pin code
  • 50.
    Private keys neverleave eID! Signatures are computed in eID on hash of file-to-be-signed (SHA-1 = Secure Hash Algorithm)
  • 51.
    Error detection -Checksum - cryptographic hash e.g. CRC32 (cyclic redundancy check) MD5 (message digest) SHA-3 (Secure Hash Algorithm)
  • 52.
    Belgian electronic medicalprescriptions are based on the e-ID ➢ Doctor is identified with e-ID ➢ Patient is identified with e-ID ➢ Doctor signs the prescription with e-ID ➢ Prescription is stored in national Recip-e database. ➢ Patient can consult prescriptions in patient portal with e-ID ➢ Pharmacist is identified with e-ID ➢ Pharmacist finds the prescription in the Recip-e database with barcode on the paper version of the prescription.
  • 53.
    ➢ Encrypted protocols ➢ HTTPS ➢ SFTP ➢ SSH ➢ TOR ➢ VPN ➢ WEP (Wired EquivalentProtocol. Weak!) ➢ WPA - WPA2 Wi-Fi Protected Access ➢ Non-encrypted protocols ➢ HTTP ➢ FTP ➢ TELNET ➢ BitTorrent
  • 54.
    Telegram and Signal ➢ FreeOpen Source software ➢ End to end encryption ➢ Delete messages everywhere ➢ Self-destruct timer for messages ➢ VOIP ➢ User friendly ➢ For Android, iOS, …
  • 55.
  • 60.
    Virtual drive infile container Encrypted file container.txt Mountable as virtual drive /media/encrypted-disk /Volumes/encrypted-disk E:
  • 64.
  • 65.
    Virtual Private Networks extendsa private (hospital) network across a public (internet) network encrypted to protect against network sniffing
  • 66.
    Internet use througha VPN provider Sarah A. Downey, http://www.abine.com/blog/2012/petraeuss-emails-werent-private-and-neither-are-yours/
  • 67.
    (Free) VPNs? ➢ VPNs goodfor ➢ protection against nearby spying and MITM attack ➢ avoiding geoblocking ➢ But you need to trust your VPN provider ➢ The free VPNs might have a business model based on spying on you. ➢ Don’t install their proprietary apps ➢ The good VPN providers support OpenVPN ➢ Best to install e.g. OpenVPN on your own server.
  • 68.
  • 70.
  • 71.
  • 72.
    = The OnionRouter Free Open Source software for anonymity network
  • 73.
    Edward Snowden: “Encryption works. Properlyimplemented strong crypto systems are one of the few things that you can rely on. Unfortunately, endpoint security is so terrifically weak that NSA can frequently find ways around it.”
  • 75.
    ➢ From the EuropeanParliament investigation into the Echelon system (05/18/2001): “If security is to be taken seriously, only those operating systems should be used whose source code has been published and checked, since only then can it be determined with certainty what happens to the data.”
  • 76.
    ➢ Cryptographer, computer securityexpert Bruce Schneier: “Secrecy and security aren't the same, even though it may seem that way. Only bad security relies on secrecy; good security works even if all the details of it are public." “If researchers don’t go public, things don’t get fixed. Companies don't see it as a security problem; they see it as a PR problem.” “Demand open source code for anything related to security”
  • 77.
    The Borland Interbaseexample ➢ 1992-1994: Borland inserted intentional back door into Interbase (closed source database server) allowing local or remote users root access to the machine ➢ 07/2000: Borland releases source code (→ Firebird) ➢ 12/2000: Back door is discovered
  • 78.
  • 81.
    “Our products justaren’t engineered for security.” Brian Valentine, Microsoft senior vice-president Windows Engineering, 2002
  • 84.
    Be aware ofphishing attacks
  • 85.
  • 86.
    Backups How would youoptimize this backup strategy? ➢ Every night at 4 am, all university computers get a wake up signal. ➢ The backup server takes over network a complete backup of every hard disk of every computer. ➢ The backups are stored on a NAS (Network Attached Storage) with 1000 hard disks. ➢ The backup server and the NAS are located in the data center of the university (floor level -1). ➢ To save storage space, backups older than a year are deleted.
  • 87.
  • 88.
    Backups ➢ First time andsometimes: full backup ➢ Most often: only incremental backup ➢ Use a good data retention scheme ➢ e.g. 7 daily, 4 weekly, 12 monthly, all yearly backups ➢ + Use off-site data protection = vaulting ➢ e.g. remote backup (compression, encryption!) ➢ Use offline backups as protection against ransomware ➢ Reflect about your time for full restore ➢ Test the restore procedure! ➢ “80% of backups fail to restore”
  • 90.
    (Cheap) versioning For importantdocuments save daily new version as: thesis20190307.odt This avoids overwriting backups with corrupt data See also https://en.wikipedia.org/wiki/ISO_8601
  • 91.
  • 92.
  • 93.
  • 94.
    Your toilets arebetter locked than your electrical switches
  • 95.
  • 97.
  • 98.
    RAID: Redundant Array ofIndependent Disks
  • 101.
    Install software fromtrusted sources! (avoid if possible P2P or web downloads)
  • 102.
  • 103.
    If you don’tapply security fixes fast enough... ➢ Microsoft ➢ Patch Tuesday ➢ Exploit Wednesday
  • 104.
    Principle of leastprivilege Avoid privilege escalation
  • 105.
    Intrusion Detection Systems(IDS) ➢ Fail2ban ➢ Snort ➢ real-time traffic analysis and packet logging ➢ detect probes or attacks ➢ Samhain ➢ Complete integrity check ➢ uses cryptographic checksums of files to detect modifications, ➢ can find rogue SUID executables anywhere on disk ➢ Centralized monitoring ➢ native support for logging to a central server via encrypted and authenticated connections ➢ Tamper resistance ➢ database and configuration files can be signed ➢ log file entries and e-mail reports are signed ➢ support for stealth operation ➢ Honey pots ➢ ...
  • 106.
    Subscribe to securitymailing lists of the critical software you are using
  • 107.
    Assignments ➢ Make a riskanalysis and threat modeling of the computer and data systems at your organization. What are the weakest and most unsecure parts? ➢ Risk ... probability * potential impact = total risk level ➢ Which actions will you take to increase the security at your organization? ➢ Why are some operating systems more secure than others? ➢ Compare the security characteristics of the Linux operating system and Windows
  • 108.
    Windows versus Linuxsecurity ➢ Windows origin ➢ QDOS (Quick and Dirty Operating System, 1980) ➢ To fit in small 8086 Personal Computer all existing concepts of security, network, multi-user, … where omitted. ➢ 86-DOS ➢ MSDOS ➢ Windows ➢ Linux (1991) ➢ Modeled according to UNIX, with security, network and multi-user concepts implemented from the beginning.
  • 109.
    Windows versus Linuxsecurity ➢ Windows and its software ➢ Source code mostly secret ➢ Cannot be audited ➢ Microsoft’s self-inflicted curse of binary compatibility: ➢ Major design improvements are hard as Microsoft cannot modify & recompile proprietary software by others ➢ Linux and its software ➢ Free Open Source ➢ Source code can be audited, bugs and backdoors found ➢ Major design improvements are easier to implement
  • 110.
    Windows versus Linuxsecurity ➢ Windows software ➢ Often (illegal copies) downloaded from web or P2P ➢ No checksum or signature ➢ Often malware. No way to detect it. ➢ Installer = executable ➢ Any malware gets executed with admin privileges ➢ Linux ➢ Software is installed through package manager ➢ Package maintainers of the many distributions often audit code and compile from source. ➢ Package maintainers sign the packages and provide checksums ➢ Package = compressed archive only unpacked by root
  • 111.
    Windows versus Linuxsecurity Updates ➢ Windows update manager is only updating Windows (and other Microsoft software?) ➢ Linux update manager is updating all software installed through the package manager, which is typically near 100%.
  • 112.
    Windows versus Linuxsecurity User attitudes towards updates & upgrades ➢ Windows users don’t like updates & upgrades ➢ Windows reboots for updates ➢ System cannot be used during installation of the updates ➢ Users have very little control over updates ➢ Updates often come with more anti-user features ➢ Microsoft forces GUI changes upon upgrades ➢ Users continue with outdated OS when they don’t like GUI of newer version ➢ Linux ➢ Software and kernel(!) updates can be installed without rebooting or unavailability of the system ➢ Users have total control over updates ➢ User can select the GUI indepentdently from upgrades
  • 113.
    Windows versus Linuxsecurity Who gets updates ➢ Windows and its software ➢ Sometimes “pirate users” did not get updates ➢ Linux and its software ➢ Users are never labeled as “pirates” ➢ Users are not denied updates
  • 114.
    Windows versus Linuxsecurity ➢ Windows ➢ Not modular ➢ Most versions can’t be run without GUI ➢ No strict separation between kernel and GUI, webbrowser, games, … ➢ Any bug in these can lead to crash or intrusion of the kernel ➢ Linux and its software ➢ Modular ➢ GUI is an option ➢ Strict separation between kernel and user space
  • 115.
    Windows versus Linuxsecurity ➢ Windows ➢ Decides if a file is executable based on extension ➢ Read and execute permissions are not distinct ➢ “50+ File Extensions that are Potentially Dangerous on Windows” ➢ Windows hides extensions by default, but only the last one ➢ file.jpg.exe is visible as file.jpg ➢ Mail attachments can infect you with malware ➢ Linux ➢ Decides if a file is executable based on execution bit ➢ Read and execute permissions are distinct ➢ Nobody was stupid enough to write a Linux mail client that sets the execution permission on attachments.
  • 116.
    Windows versus Linuxsecurity ➢ Windows ➢ Autorun software from CD and USB (until Windows 7) ➢ Linux ➢ Autorun is not default or asks user permission
  • 117.
    Windows versus Linuxsecurity ➢ Windows ➢ Many users work day in day out with an admin account ➢ Linux ➢ Users get a big fat warning when they attempt to login in the GUI as root ➢ Users get very low privileges ➢ Different crucial applications run on different user accounts ➢ E.g. Apache web server runs as user www ➢ User www has only (write) access to its own files.
  • 118.
    Windows versus Linuxsecurity ➢ Windows ➢ FAT and NTFS still don’t have the option to create a non- executable partition? ➢ Linux ➢ /tmp can be set as noexec ➢ This prevents that malware uploaded through e.g. webserver can be executed.
  • 119.
    Windows versus Linuxsecurity ➢ Windows ➢ Monoculture ➢ Linux ➢ 300+ distributions ➢ 84+ window managers ➢ Many packaging systems ➢ Many mail clients ➢ The diversity slows down widespread malware infections as these will not work for all Linux systems.
  • 120.
    Windows versus Linuxsecurity ➢ Windows filesystems ➢ Not much more than FAT and NTFS ➢ Linux ➢ Supports tens of filesystems ➢ Including some high availability oriented ones such as ZFS.
  • 121.
    Windows versus Linuxsecurity Matheus effect ➢ Windows ➢ Many users don’t care about security ➢ Linux ➢ Users caring about security will rather use Linux ➢ These users secure their systems more ➢ Linux get more attention by security caring developers
  • 122.
    Credits ➢ Password Strength, CreativeCommons BY-NC http://xkcd.com/936/ ➢ Security, Creative Commons BY-NC http://xkcd.com/538/ ➢ Zimmermann Telegram, 1917, no known copyright restrictions ➢ Assymetric and symmetric encryption by Jeremy Stretch, http://packetlife.net/blog/2010/nov/23/symmetric-asymmetric-encryption-hashing/ ➢ Orange blue public key cryptography, Creative Commons CC0 by Bananenfalter ➢ HTTPS SSL Exchange by Robb Perry, http://coding.smashingmagazine.com/2012/05/17/backpack-algorithms-and-public-key-cryptography-made-easy/ ➢ Bitcoin logo, Public Domain by bitboy ➢ Bitcoin Transaction Visual, Creative Commons CC0 by Graingert ➢ Question mark CC-by by Stefan Baudy ➢ GNU Head Joseph W. Reiss Free Art License or the GNU GPLv2
  • 123.
    This presentation wasmade with 100% Free Software No animals were harmed Questier.com Frederik AT Questier.com www.linkedin.com/in/fquestie www.diigo.com/user/frederikquestier www.slideshare.net/Frederik_Questier T hank you! Q uestions?