SlideShare a Scribd company logo
Chapter One
Introduction to Information Security
Introduction to Information Security
1
Information Security
2
Information security means protecting information and information
systems from unauthorized access, use, disclosure, disruption,
modification, perusal, inspection, recording or destruction.
Information security = confidentiality + integrity + availability +
authentication.
well-informed sense of assurance that the information risks and
controls are in balance.
The terms information security, computer security and information
assurance are frequently incorrectly used interchangeably.
Contd.
3
 Information security is concerned with the confidentiality, integrity
and availability of data regardless of the form the data may take:
electronic, print, or other forms.
 Computer security can focus on ensuring the availability and correct
operation of a computer system without concern for the information
stored or processed by the computer.
 Information security offers many areas for specialization including:
securing network(s) and allied infrastructure,
securing applications and databases, security testing, information
systems auditing, business continuity planning and digital forensics
Basic Security Terminology(concepts)
4
 Network security terms are the foundation for any discussion of
network security and are the elements used to measure the security
of a network.
 Some of these terms or concepts include:-
1. Identification:- is simply the process of identifying one's self to
another entity or determining the identity of the individual or entity
with whom you are communicating.
2. Authentication:- is the assurance that the communicating entity is
the one that it claims to be.
 Authentication serves as proof that you are who you say you are
or what you claim to be.
 Authentication is required when communicating over a network or
Contd.
5
 When communicating over a network you should ask yourself
two questions:
1) With whom am I communicating?
2) Why do I believe this person or entity is who he, she, or it
claims to be?
 When logging onto a network, three basic schemes are used
for authentication:
 Something you know
 Something you have
 Something you are
Contd.
6
3. Access Control(Authorization):- refers to the ability to control the
level of access that individuals or entities have to a network or
system and how much information they can receive.
 Your level of authorization basically determines what you're allowed
to do once you are authenticated and allowed access to a network,
system, or some other resource such as data or information.
 Access control is the determination of the level of authorization to a
system, network, or information (i.e., classified, secret, or top-
secret).
Contd.
7
4. Confidentiality:- can also be called privacy or secrecy and
refers to the protection of information from unauthorized
disclosure.
 Usually achieved either by restricting access to the
information or by encrypting the information so that it is not
meaningful to unauthorized individuals or entities.
5. Availability:- refers to whether the network, system,
hardware, and software are reliable and can recover quickly
and completely in the event of an interruption in service.
 Ideally, these elements should not be susceptible to denial
Contd.
8
6. Data Integrity:- refers to the assurance of data received are exactly as
sent by an authorized entity.
 Data integrity is achieved by preventing unauthorized or improper
changes to data, ensuring internal and external consistency, and
ensuring that other data attributes (such as timeliness and
completeness) are consistent with requirements.
7. Accountability:- refers to the ability to track or audit what an individual
or entity is doing on a network or system.
 Does the system maintain a record of functions performed, files
Contd.
9
8. Non-Repudiation:- refers to the ability to prevent individuals or
entities from denying (repudiating) that information, data, or files
were sent or received or that information or files were accessed
or altered, when in fact they were.
 is crucial to e-commerce.
Contd.
10
8. Non-Repudiation:- refers to the ability to prevent individuals or
entities from denying (repudiating) that information, data, or files
were sent or received or that information or files were accessed
or altered, when in fact they were.
 is crucial to e-commerce.
Computer Security
 While computer systems today have some of the best security systems ever,
they are more vulnerable than ever before.
 Computer and network security comes in many forms, including encryption
algorithms, access to facilities, digital signatures, and using fingerprints and
face scans as passwords.
 The OSI security architecture provides a systematic frame work for defining
security attacks, mechanisms and services.
The OSI security architecture focuses on security attacks, mechanisms and
services.
 Security attack:- Any action that compromises the security of information
owned by an organization.
 Security mechanism:- A process (or a device incorporating such a
process) that is designed to detect, prevent, or recover from a security
attack.
 Security service:- A processing or communication service that enhances
11
Contd.
 Computer Security:- generic name for the collection of tools
designed to protect data and to hackers from attacking the
organizational assets.
 “The protection afforded to an automated information system in order
to attain the applicable objectives of preserving the integrity,
availability, and confidentiality of information system resources
(includes hardware, software, firmware, information/data, and
12
Contd.
13
 Network Security:- measures to protect data during their
transmission over the network.
 Internet Security:- measures to protect data during their
transmission over a collection of interconnected networks(network of
networks)
Why Is Computer and Network Security Important?
14
1. To protect company assets:- One of the primary goals of computer and
network security is the protection of company assets (hardware, software
and/or information).
2. To gain a competitive advantage:- Developing and maintaining effective
security measures can provide an organization with a competitive
advantage over its competition
3. To comply with regulatory requirements and fiduciary
responsibilities:- organizations that rely on computers for their continuing
operation must develop policies and procedures that address
organizational security requirements.
 Such policies and procedures are necessary not only to protect
company assets but also to protect the organization from liability
15
Vulnerabilities(Attack Surface)
 are weak points or loopholes in security that an attacker can
exploit in order to gain access to the network or to resources
on the network.
 The vulnerability is not the attack, but rather the weak point
that is exploited.
 Vulnerability is the intersection of three elements:
1. A system susceptibility or flaw,
2. attacker access to the flaw, and
3. attacker capability to exploit the flaw
 To be vulnerable, an attacker must have at least one
applicable tool or technique that can connect to a system
weakness.
 A security risk may be classified as a vulnerability. But there
Contd.
16
 A vulnerability with one or more known instances of working
and fully-implemented attacks is classified as an exploitable
vulnerability, a vulnerability for which an exploit exists.
Fig Threat agents, attack vectors, weakness, controls, IT asset and
business impact
Vulnerability Classification
17
 Vulnerabilities are classified according to the asset class
they related to:
1. Hardware
 susceptibility to humidity
 susceptibility to dust
 susceptibility to soiling
 susceptibility to unprotected storage
2. Software
 insufficient testing
 lack of audit trail
Contd.
18
3. Network
 Unprotected communication lines
 Insecure network architecture
4. Personnel
 inadequate recruiting process
 inadequate security awareness
5. Site
 area subject to flood
 unreliable power source
6. Organizational
 lack of regular audits
 lack of continuity plans
Vulnerabilities in Common Network Access Procedures &
Protocols
19
 The primary protocol used in operating systems today is the TCP/IP
protocol stack.
 The wide use of this protocol helps to integrate different operating
system architectures such as Microsoft and UNIX.
 Many organizations make use of this interoperability and use
various TCP/IP utilities to run programs, transfer information, and
reveal information.
 Due to the nature of these utilities, various security risks and threats
exist.
 Users often use the same passwords for mixed environments.
 Sometimes, passwords are automatically synchronized.
 If hackers can crack the password on systems other than Microsoft
systems, they could also use that password to logon to a Microsoft
Telnet
20
 The Telnet protocol allows a user to log onto a system over the network
and use that system as though the user was sitting at a terminal that was
directly connected.
 The telnet command provides a user interface to a remote system.
 When using the Microsoft telnet client to log on to the Microsoft Windows
2000 Telnet service, it uses the NTLM(NT LAN Manager) protocol to log
the client on.
In a Windows network, NTLM is a suite of Microsoft security protocols
that provides authentication, integrity, and confidentiality to users
 Problems arise when integrating Microsoft systems and UNIX systems.
 When logging on to a system from a Microsoft telnet client to UNIX
TELNET daemon service or vice versa, the user name and password are
sent over the network in plain text.
File Transfer Protocol(FTP)
21
 It allows users to connect to remote systems and transfer files
back and forth.
 As part of establishing a connection to a remote computer, FTP
relies on a user name and password combination for
authentication.
 Use of FTP poses a security problem similar to use of the Telnet
protocol because passwords typed to FTP are transmitted over
the network in plain text, one character per packet. These
packets can be intercepted.
 Another problem area for FTP is anonymous FTP.
Anonymous FTP allows users who do not have an account on a
computer to transfer files to and from a specific directory.
Contd.
22
 To use anonymous FTP, a user passes a remote computer
name as an argument to FTP and then specifies "anonymous"
as a user name.
 Problems with anonymous FTP are:
There is often no record of who has requested what information.
The threat of denial-of-service attacks. That is, For deliberate or
accidental denial-of-service attacks, authorized users may be
denied access to a system if too many file transfers are initiated
simultaneously.
 It is important to securely set up the anonymous FTP account
on the server because everyone on the network will have
potential access.
Trivial File Transfer Protocol(TFTP)
23
 It is a file transfer program that is frequently used to allow
diskless hosts to boot over the network.
 Microsoft Windows 2000 implements a client utility to make
use of TFTP services on UNIX flavors.
 Because TFTP has no user authentication, it may be possible
for unwanted file transfer to occur.
 The use of TFTP to steal password files is a significant threat.
Commands Revealing User Information
24
 It is not uncommon to find interoperability between
Microsoft products and various flavors of UNIX.
 Commands that reveal user and system information
pose a threat because crackers can use that information
to break into a system.
 Some of these commands whose output makes a
system vulnerable to break-ins include:
 Finger
 Rexec
Finger
25
 The finger client utility on Windows NT and Windows 2000 can
be used to connect to a finger daemon service running on a
UNIX-based computer to display information about users.
 When the finger client utility is invoked with a name argument,
the password file is searched on a UNIX server.
 Every user with a first name, last name, or user name that
matches the name argument is returned.
 When the finger program is run with no arguments, information
for every user currently logged on to the system is displayed.
 User information can be displayed for remote computers as well
as for the local computer.
Contd.
26
 The output of finger typically includes logon name, full name,
home directory, last logon time, and in some cases when the
user received mail and/or read mail.
 Personal information, such as telephone numbers, is often
stored in the password file so that this information is available
to other users.
 Making personal information about users available poses a
security threat because a password cracker can make use of
this information.
 In addition, finger can reveal logon activity.
Rexec
27
 The rexec utility is provided as a client on Microsoft Windows NT
and Windows 2000.
 The rexec client utility allows remote execution on UNIX-based
systems running the rexecd service.
 A client transmits a message specifying the user name, the
password, and the name of a command to execute.
 The rexecd program is susceptible to abuse because it can be
used to probe a system for the names of valid accounts.
 In addition, passwords are transmitted unencrypted over the
network.
Protocol Design
28
 Communication protocols sometimes have weak points.
Attackers use these to gain information and eventually gain
access to systems. Some known issues are:
 TCP/IP:- The TCP/IP protocol stack has some weak points
that allows:
 IP address spoofing
 TCP connection request (SYN) attacks
 ATM:- Security can be compromised by what is referred to as
"manhole manipulation“, direct access to network cables and
connections in underground parking garages and elevator
shafts.
Weak Password
29
 Password selection will always be a contentious point as long as
users have to select one.
 Users usually select commonly used passwords because they are
easy to remember, like anything from birthday to the names of
loved ones. This creates a vulnerability.
 A password is the key to a computer, a key much sought-after by
hackers, as a means of getting a foothold into a system.
 A weak password may give a hacker access not only to a computer,
but to the entire network to which the computer is connected.
 Users should treat their passwords like the keys to their homes.
 Switches and routers are easily managed by an HTTP Web
interface or through a command line interface.
 Coupled to the use of weak passwords it allows anybody with some
technical knowledge to take control of the device.
Modem
30
 If a computer has a modem connected to the Internet, the user
needs to take appropriate precautions because modem
connections can be a significant vulnerability.
 Hackers commonly use a tool known as a "war dialer" to identify
the modems at a target organization.
 A war dialer is a computer program that automatically dials phone
numbers within a specified range of numbers.
 Most organizations have a block of sequential phone numbers.
 By dialing all numbers within the targeted range, the war dialer
identifies which numbers are for computer modems and determines
certain characteristics of those modems.
 The hacker then uses other tools to attack the modem to gain
access to the computer network.
 Anyone can download effective war dialers from the Internet at no
Network Security In Action
31
Client
Configuration
DNS Network Services FTP/Telnet SMTP/POP Web Server
IP & Port
Scanning
Web Server
Exploit
Email Exploit DoS Attack Trojan Attack
Sniffing
Traffic
KeyStroke
Logging
Password
Cracking
MITM Attack
Hardening
Host
AntiVirus
Applications
Using
Firewall
Using
GPG/PGP
Using SSH
Using
Certificate
Using IPSec
System Log
Analysis
Intrusion
Detection
System
HoneyPot
Spyware
Detection and
Removal
Backup and
Restore
Finding
Hidden Data
NETWORK
PREVENT
DETECTION
VULNERABILITAS
Contd.
32
External
attacker
A network security design protects assets from threats and
vulnerabilities in an organized manner
To design security, analyze risks to your assets and create responses
Corporate Assets
Internal
attacker
Incorrect
permissionsVirus

More Related Content

What's hot (20)

PPTX
System security
sommerville-videos
 
PPTX
Firewall, Trusted Systems,IP Security ,ESP Encryption and Authentication
Gopal Sakarkar
 
DOC
Network security Lab manual
Vivek Kumar Sinha
 
PPTX
Introduction to information security
jayashri kolekar
 
PDF
Chapter 2 program-security
Vamsee Krishna Kiran
 
PPTX
IoT - Attacks and Solutions
Ulf Mattsson
 
PDF
Intruders
Dr.Florence Dayana
 
PPT
Network Security
MAJU
 
PPTX
Computer security
Ayesha Arshad
 
PPTX
Chapter- I introduction
Dr.Florence Dayana
 
PPTX
What is Cryptography and Types of attacks in it
lavakumar Thatisetti
 
PPTX
RSA Algorithm
Srinadh Muvva
 
PPT
Types of attacks and threads
srivijaymanickam
 
PPT
Web security
Subhash Basistha
 
PDF
Email security presentation
SubhradeepMaji
 
PPTX
Lecture 10 intruders
rajakhurram
 
PDF
Inter-Process Communication in distributed systems
Aya Mahmoud
 
PPT
Polyalphabetic Substitution Cipher
SHUBHA CHATURVEDI
 
PPTX
Security Mechanisms
priya_trehan
 
PPTX
Types of attacks
Vivek Gandhi
 
System security
sommerville-videos
 
Firewall, Trusted Systems,IP Security ,ESP Encryption and Authentication
Gopal Sakarkar
 
Network security Lab manual
Vivek Kumar Sinha
 
Introduction to information security
jayashri kolekar
 
Chapter 2 program-security
Vamsee Krishna Kiran
 
IoT - Attacks and Solutions
Ulf Mattsson
 
Network Security
MAJU
 
Computer security
Ayesha Arshad
 
Chapter- I introduction
Dr.Florence Dayana
 
What is Cryptography and Types of attacks in it
lavakumar Thatisetti
 
RSA Algorithm
Srinadh Muvva
 
Types of attacks and threads
srivijaymanickam
 
Web security
Subhash Basistha
 
Email security presentation
SubhradeepMaji
 
Lecture 10 intruders
rajakhurram
 
Inter-Process Communication in distributed systems
Aya Mahmoud
 
Polyalphabetic Substitution Cipher
SHUBHA CHATURVEDI
 
Security Mechanisms
priya_trehan
 
Types of attacks
Vivek Gandhi
 

Similar to Computer Security Chapter 1 (20)

PPTX
Security Ch-1.pptx
KeenboonAsaffaa
 
PPTX
Information Security and Privacy-Unit-1.pptx
NiharikaDubey17
 
PPTX
security system by desu star chapter 1.pptx
desalewminale
 
DOCX
CCS354-NETWORK SECURITY-network-security notes
Kirubaburi R
 
PDF
Introduction to security
Mukesh Chinta
 
PPTX
security IDS
Gregory Hanis
 
PPTX
PPT0-Computer Security Concepts.pptx
PiBits
 
PDF
Network security chapter 1
osama elfar
 
PDF
Sec0001 .pdf
mah902110
 
PPTX
Unit 1 Network Fundamentals and Security .pptx
Guna Dhondwad
 
PPTX
System Security-Chapter 1
Vamsee Krishna Kiran
 
PPTX
Lecture1-InforSec-Computer and Internet security.pptx
markhorid1
 
PPT
Ia 124 1621324143 ia_124_lecture_01
ITNet
 
PDF
Cryptography and Network Security ppt . pdf
22cc005
 
DOCX
Security and Ethical Challenges Contributors Kim Wanders.docx
edgar6wallace88877
 
DOCX
Security and Ethical Challenges Contributors Kim Wanders.docx
fathwaitewalter
 
PDF
What is Linux SecuritySolutionLinux Security is a module in.pdf
federaleyecare
 
PDF
Computer Network Security study mate.pdf
Dorcask3
 
PPTX
CYBER LAW & ETHICS (PART OF THE JNTUH SYLLABUS
deepthikamidi
 
PDF
I0516064
IOSR Journals
 
Security Ch-1.pptx
KeenboonAsaffaa
 
Information Security and Privacy-Unit-1.pptx
NiharikaDubey17
 
security system by desu star chapter 1.pptx
desalewminale
 
CCS354-NETWORK SECURITY-network-security notes
Kirubaburi R
 
Introduction to security
Mukesh Chinta
 
security IDS
Gregory Hanis
 
PPT0-Computer Security Concepts.pptx
PiBits
 
Network security chapter 1
osama elfar
 
Sec0001 .pdf
mah902110
 
Unit 1 Network Fundamentals and Security .pptx
Guna Dhondwad
 
System Security-Chapter 1
Vamsee Krishna Kiran
 
Lecture1-InforSec-Computer and Internet security.pptx
markhorid1
 
Ia 124 1621324143 ia_124_lecture_01
ITNet
 
Cryptography and Network Security ppt . pdf
22cc005
 
Security and Ethical Challenges Contributors Kim Wanders.docx
edgar6wallace88877
 
Security and Ethical Challenges Contributors Kim Wanders.docx
fathwaitewalter
 
What is Linux SecuritySolutionLinux Security is a module in.pdf
federaleyecare
 
Computer Network Security study mate.pdf
Dorcask3
 
CYBER LAW & ETHICS (PART OF THE JNTUH SYLLABUS
deepthikamidi
 
I0516064
IOSR Journals
 
Ad

Recently uploaded (20)

PPTX
How to Close Subscription in Odoo 18 - Odoo Slides
Celine George
 
PPTX
K-Circle-Weekly-Quiz12121212-May2025.pptx
Pankaj Rodey
 
PDF
BÀI TẬP TEST BỔ TRỢ THEO TỪNG CHỦ ĐỀ CỦA TỪNG UNIT KÈM BÀI TẬP NGHE - TIẾNG A...
Nguyen Thanh Tu Collection
 
PPTX
Gupta Art & Architecture Temple and Sculptures.pptx
Virag Sontakke
 
PPT
DRUGS USED IN THERAPY OF SHOCK, Shock Therapy, Treatment or management of shock
Rajshri Ghogare
 
PPTX
Cybersecurity: How to Protect your Digital World from Hackers
vaidikpanda4
 
PDF
Antianginal agents, Definition, Classification, MOA.pdf
Prerana Jadhav
 
PPTX
Command Palatte in Odoo 18.1 Spreadsheet - Odoo Slides
Celine George
 
PPTX
The Future of Artificial Intelligence Opportunities and Risks Ahead
vaghelajayendra784
 
PPTX
Sonnet 130_ My Mistress’ Eyes Are Nothing Like the Sun By William Shakespear...
DhatriParmar
 
PPTX
Unlock the Power of Cursor AI: MuleSoft Integrations
Veera Pallapu
 
PPTX
INTESTINALPARASITES OR WORM INFESTATIONS.pptx
PRADEEP ABOTHU
 
PPTX
Applications of matrices In Real Life_20250724_091307_0000.pptx
gehlotkrish03
 
DOCX
pgdei-UNIT -V Neurological Disorders & developmental disabilities
JELLA VISHNU DURGA PRASAD
 
PDF
Tips for Writing the Research Title with Examples
Thelma Villaflores
 
PDF
Virat Kohli- the Pride of Indian cricket
kushpar147
 
PPTX
Artificial Intelligence in Gastroentrology: Advancements and Future Presprec...
AyanHossain
 
PPTX
Cleaning Validation Ppt Pharmaceutical validation
Ms. Ashatai Patil
 
PPTX
HEALTH CARE DELIVERY SYSTEM - UNIT 2 - GNM 3RD YEAR.pptx
Priyanshu Anand
 
PPTX
Top 10 AI Tools, Like ChatGPT. You Must Learn In 2025
Digilearnings
 
How to Close Subscription in Odoo 18 - Odoo Slides
Celine George
 
K-Circle-Weekly-Quiz12121212-May2025.pptx
Pankaj Rodey
 
BÀI TẬP TEST BỔ TRỢ THEO TỪNG CHỦ ĐỀ CỦA TỪNG UNIT KÈM BÀI TẬP NGHE - TIẾNG A...
Nguyen Thanh Tu Collection
 
Gupta Art & Architecture Temple and Sculptures.pptx
Virag Sontakke
 
DRUGS USED IN THERAPY OF SHOCK, Shock Therapy, Treatment or management of shock
Rajshri Ghogare
 
Cybersecurity: How to Protect your Digital World from Hackers
vaidikpanda4
 
Antianginal agents, Definition, Classification, MOA.pdf
Prerana Jadhav
 
Command Palatte in Odoo 18.1 Spreadsheet - Odoo Slides
Celine George
 
The Future of Artificial Intelligence Opportunities and Risks Ahead
vaghelajayendra784
 
Sonnet 130_ My Mistress’ Eyes Are Nothing Like the Sun By William Shakespear...
DhatriParmar
 
Unlock the Power of Cursor AI: MuleSoft Integrations
Veera Pallapu
 
INTESTINALPARASITES OR WORM INFESTATIONS.pptx
PRADEEP ABOTHU
 
Applications of matrices In Real Life_20250724_091307_0000.pptx
gehlotkrish03
 
pgdei-UNIT -V Neurological Disorders & developmental disabilities
JELLA VISHNU DURGA PRASAD
 
Tips for Writing the Research Title with Examples
Thelma Villaflores
 
Virat Kohli- the Pride of Indian cricket
kushpar147
 
Artificial Intelligence in Gastroentrology: Advancements and Future Presprec...
AyanHossain
 
Cleaning Validation Ppt Pharmaceutical validation
Ms. Ashatai Patil
 
HEALTH CARE DELIVERY SYSTEM - UNIT 2 - GNM 3RD YEAR.pptx
Priyanshu Anand
 
Top 10 AI Tools, Like ChatGPT. You Must Learn In 2025
Digilearnings
 
Ad

Computer Security Chapter 1

  • 1. Chapter One Introduction to Information Security Introduction to Information Security 1
  • 2. Information Security 2 Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, perusal, inspection, recording or destruction. Information security = confidentiality + integrity + availability + authentication. well-informed sense of assurance that the information risks and controls are in balance. The terms information security, computer security and information assurance are frequently incorrectly used interchangeably.
  • 3. Contd. 3  Information security is concerned with the confidentiality, integrity and availability of data regardless of the form the data may take: electronic, print, or other forms.  Computer security can focus on ensuring the availability and correct operation of a computer system without concern for the information stored or processed by the computer.  Information security offers many areas for specialization including: securing network(s) and allied infrastructure, securing applications and databases, security testing, information systems auditing, business continuity planning and digital forensics
  • 4. Basic Security Terminology(concepts) 4  Network security terms are the foundation for any discussion of network security and are the elements used to measure the security of a network.  Some of these terms or concepts include:- 1. Identification:- is simply the process of identifying one's self to another entity or determining the identity of the individual or entity with whom you are communicating. 2. Authentication:- is the assurance that the communicating entity is the one that it claims to be.  Authentication serves as proof that you are who you say you are or what you claim to be.  Authentication is required when communicating over a network or
  • 5. Contd. 5  When communicating over a network you should ask yourself two questions: 1) With whom am I communicating? 2) Why do I believe this person or entity is who he, she, or it claims to be?  When logging onto a network, three basic schemes are used for authentication:  Something you know  Something you have  Something you are
  • 6. Contd. 6 3. Access Control(Authorization):- refers to the ability to control the level of access that individuals or entities have to a network or system and how much information they can receive.  Your level of authorization basically determines what you're allowed to do once you are authenticated and allowed access to a network, system, or some other resource such as data or information.  Access control is the determination of the level of authorization to a system, network, or information (i.e., classified, secret, or top- secret).
  • 7. Contd. 7 4. Confidentiality:- can also be called privacy or secrecy and refers to the protection of information from unauthorized disclosure.  Usually achieved either by restricting access to the information or by encrypting the information so that it is not meaningful to unauthorized individuals or entities. 5. Availability:- refers to whether the network, system, hardware, and software are reliable and can recover quickly and completely in the event of an interruption in service.  Ideally, these elements should not be susceptible to denial
  • 8. Contd. 8 6. Data Integrity:- refers to the assurance of data received are exactly as sent by an authorized entity.  Data integrity is achieved by preventing unauthorized or improper changes to data, ensuring internal and external consistency, and ensuring that other data attributes (such as timeliness and completeness) are consistent with requirements. 7. Accountability:- refers to the ability to track or audit what an individual or entity is doing on a network or system.  Does the system maintain a record of functions performed, files
  • 9. Contd. 9 8. Non-Repudiation:- refers to the ability to prevent individuals or entities from denying (repudiating) that information, data, or files were sent or received or that information or files were accessed or altered, when in fact they were.  is crucial to e-commerce.
  • 10. Contd. 10 8. Non-Repudiation:- refers to the ability to prevent individuals or entities from denying (repudiating) that information, data, or files were sent or received or that information or files were accessed or altered, when in fact they were.  is crucial to e-commerce.
  • 11. Computer Security  While computer systems today have some of the best security systems ever, they are more vulnerable than ever before.  Computer and network security comes in many forms, including encryption algorithms, access to facilities, digital signatures, and using fingerprints and face scans as passwords.  The OSI security architecture provides a systematic frame work for defining security attacks, mechanisms and services. The OSI security architecture focuses on security attacks, mechanisms and services.  Security attack:- Any action that compromises the security of information owned by an organization.  Security mechanism:- A process (or a device incorporating such a process) that is designed to detect, prevent, or recover from a security attack.  Security service:- A processing or communication service that enhances 11
  • 12. Contd.  Computer Security:- generic name for the collection of tools designed to protect data and to hackers from attacking the organizational assets.  “The protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability, and confidentiality of information system resources (includes hardware, software, firmware, information/data, and 12
  • 13. Contd. 13  Network Security:- measures to protect data during their transmission over the network.  Internet Security:- measures to protect data during their transmission over a collection of interconnected networks(network of networks)
  • 14. Why Is Computer and Network Security Important? 14 1. To protect company assets:- One of the primary goals of computer and network security is the protection of company assets (hardware, software and/or information). 2. To gain a competitive advantage:- Developing and maintaining effective security measures can provide an organization with a competitive advantage over its competition 3. To comply with regulatory requirements and fiduciary responsibilities:- organizations that rely on computers for their continuing operation must develop policies and procedures that address organizational security requirements.  Such policies and procedures are necessary not only to protect company assets but also to protect the organization from liability
  • 15. 15 Vulnerabilities(Attack Surface)  are weak points or loopholes in security that an attacker can exploit in order to gain access to the network or to resources on the network.  The vulnerability is not the attack, but rather the weak point that is exploited.  Vulnerability is the intersection of three elements: 1. A system susceptibility or flaw, 2. attacker access to the flaw, and 3. attacker capability to exploit the flaw  To be vulnerable, an attacker must have at least one applicable tool or technique that can connect to a system weakness.  A security risk may be classified as a vulnerability. But there
  • 16. Contd. 16  A vulnerability with one or more known instances of working and fully-implemented attacks is classified as an exploitable vulnerability, a vulnerability for which an exploit exists. Fig Threat agents, attack vectors, weakness, controls, IT asset and business impact
  • 17. Vulnerability Classification 17  Vulnerabilities are classified according to the asset class they related to: 1. Hardware  susceptibility to humidity  susceptibility to dust  susceptibility to soiling  susceptibility to unprotected storage 2. Software  insufficient testing  lack of audit trail
  • 18. Contd. 18 3. Network  Unprotected communication lines  Insecure network architecture 4. Personnel  inadequate recruiting process  inadequate security awareness 5. Site  area subject to flood  unreliable power source 6. Organizational  lack of regular audits  lack of continuity plans
  • 19. Vulnerabilities in Common Network Access Procedures & Protocols 19  The primary protocol used in operating systems today is the TCP/IP protocol stack.  The wide use of this protocol helps to integrate different operating system architectures such as Microsoft and UNIX.  Many organizations make use of this interoperability and use various TCP/IP utilities to run programs, transfer information, and reveal information.  Due to the nature of these utilities, various security risks and threats exist.  Users often use the same passwords for mixed environments.  Sometimes, passwords are automatically synchronized.  If hackers can crack the password on systems other than Microsoft systems, they could also use that password to logon to a Microsoft
  • 20. Telnet 20  The Telnet protocol allows a user to log onto a system over the network and use that system as though the user was sitting at a terminal that was directly connected.  The telnet command provides a user interface to a remote system.  When using the Microsoft telnet client to log on to the Microsoft Windows 2000 Telnet service, it uses the NTLM(NT LAN Manager) protocol to log the client on. In a Windows network, NTLM is a suite of Microsoft security protocols that provides authentication, integrity, and confidentiality to users  Problems arise when integrating Microsoft systems and UNIX systems.  When logging on to a system from a Microsoft telnet client to UNIX TELNET daemon service or vice versa, the user name and password are sent over the network in plain text.
  • 21. File Transfer Protocol(FTP) 21  It allows users to connect to remote systems and transfer files back and forth.  As part of establishing a connection to a remote computer, FTP relies on a user name and password combination for authentication.  Use of FTP poses a security problem similar to use of the Telnet protocol because passwords typed to FTP are transmitted over the network in plain text, one character per packet. These packets can be intercepted.  Another problem area for FTP is anonymous FTP. Anonymous FTP allows users who do not have an account on a computer to transfer files to and from a specific directory.
  • 22. Contd. 22  To use anonymous FTP, a user passes a remote computer name as an argument to FTP and then specifies "anonymous" as a user name.  Problems with anonymous FTP are: There is often no record of who has requested what information. The threat of denial-of-service attacks. That is, For deliberate or accidental denial-of-service attacks, authorized users may be denied access to a system if too many file transfers are initiated simultaneously.  It is important to securely set up the anonymous FTP account on the server because everyone on the network will have potential access.
  • 23. Trivial File Transfer Protocol(TFTP) 23  It is a file transfer program that is frequently used to allow diskless hosts to boot over the network.  Microsoft Windows 2000 implements a client utility to make use of TFTP services on UNIX flavors.  Because TFTP has no user authentication, it may be possible for unwanted file transfer to occur.  The use of TFTP to steal password files is a significant threat.
  • 24. Commands Revealing User Information 24  It is not uncommon to find interoperability between Microsoft products and various flavors of UNIX.  Commands that reveal user and system information pose a threat because crackers can use that information to break into a system.  Some of these commands whose output makes a system vulnerable to break-ins include:  Finger  Rexec
  • 25. Finger 25  The finger client utility on Windows NT and Windows 2000 can be used to connect to a finger daemon service running on a UNIX-based computer to display information about users.  When the finger client utility is invoked with a name argument, the password file is searched on a UNIX server.  Every user with a first name, last name, or user name that matches the name argument is returned.  When the finger program is run with no arguments, information for every user currently logged on to the system is displayed.  User information can be displayed for remote computers as well as for the local computer.
  • 26. Contd. 26  The output of finger typically includes logon name, full name, home directory, last logon time, and in some cases when the user received mail and/or read mail.  Personal information, such as telephone numbers, is often stored in the password file so that this information is available to other users.  Making personal information about users available poses a security threat because a password cracker can make use of this information.  In addition, finger can reveal logon activity.
  • 27. Rexec 27  The rexec utility is provided as a client on Microsoft Windows NT and Windows 2000.  The rexec client utility allows remote execution on UNIX-based systems running the rexecd service.  A client transmits a message specifying the user name, the password, and the name of a command to execute.  The rexecd program is susceptible to abuse because it can be used to probe a system for the names of valid accounts.  In addition, passwords are transmitted unencrypted over the network.
  • 28. Protocol Design 28  Communication protocols sometimes have weak points. Attackers use these to gain information and eventually gain access to systems. Some known issues are:  TCP/IP:- The TCP/IP protocol stack has some weak points that allows:  IP address spoofing  TCP connection request (SYN) attacks  ATM:- Security can be compromised by what is referred to as "manhole manipulation“, direct access to network cables and connections in underground parking garages and elevator shafts.
  • 29. Weak Password 29  Password selection will always be a contentious point as long as users have to select one.  Users usually select commonly used passwords because they are easy to remember, like anything from birthday to the names of loved ones. This creates a vulnerability.  A password is the key to a computer, a key much sought-after by hackers, as a means of getting a foothold into a system.  A weak password may give a hacker access not only to a computer, but to the entire network to which the computer is connected.  Users should treat their passwords like the keys to their homes.  Switches and routers are easily managed by an HTTP Web interface or through a command line interface.  Coupled to the use of weak passwords it allows anybody with some technical knowledge to take control of the device.
  • 30. Modem 30  If a computer has a modem connected to the Internet, the user needs to take appropriate precautions because modem connections can be a significant vulnerability.  Hackers commonly use a tool known as a "war dialer" to identify the modems at a target organization.  A war dialer is a computer program that automatically dials phone numbers within a specified range of numbers.  Most organizations have a block of sequential phone numbers.  By dialing all numbers within the targeted range, the war dialer identifies which numbers are for computer modems and determines certain characteristics of those modems.  The hacker then uses other tools to attack the modem to gain access to the computer network.  Anyone can download effective war dialers from the Internet at no
  • 31. Network Security In Action 31 Client Configuration DNS Network Services FTP/Telnet SMTP/POP Web Server IP & Port Scanning Web Server Exploit Email Exploit DoS Attack Trojan Attack Sniffing Traffic KeyStroke Logging Password Cracking MITM Attack Hardening Host AntiVirus Applications Using Firewall Using GPG/PGP Using SSH Using Certificate Using IPSec System Log Analysis Intrusion Detection System HoneyPot Spyware Detection and Removal Backup and Restore Finding Hidden Data NETWORK PREVENT DETECTION VULNERABILITAS
  • 32. Contd. 32 External attacker A network security design protects assets from threats and vulnerabilities in an organized manner To design security, analyze risks to your assets and create responses Corporate Assets Internal attacker Incorrect permissionsVirus