Download to read offline
More Related Content
Similar to Information security ist lecture
Information security ist lecture
- 1.
- 2. Basic Concepts OfSecurity • Information security has become a continuing concern in all areas of an Information system. Security is neither a product nor a software; it is a discipline that needs to be taken into consideration in any organizational decision. It is indeed true that there is no such thing as a completely secure system. But it is also correct that by increasing the security measures that protect your assets, you are making your system a much more difficult target for intruders, which, in turn, reduces the chances of becoming a victim when the right security technologies are in place.
- 3. Network Security • Networksecurity is the practice of preventing and protecting against unauthorized intrusion into corporate networks. • Network security is the process of taking physical and software preventative measures to protect the underlying networking infrastructure from unauthorized access, misuse, malfunction, modification, destruction, or improper disclosure, thereby creating a secure platform for computers, users, and programs to perform their permitted critical functions within a secure environment.
- 4. Network security consistsof: • Protection: You should configure your systems and networks as correctly as possible • Detection: You must be able to identify when the configuration has changed or when some network traffic indicates a problem • Reaction: After identifying problems quickly, you must respond to them and return to a safe state as rapidly as possible
- 5. Network security methods •Access control: You should be able to block unauthorized users and devices from accessing your network. Users that are permitted network access should only be able to work with the limited set of resources for which they've been authorized. • Anti-malware: Viruses, worms, and trojans by definition attempt to spread across a network, and can lurk dormant on infected machines for days or weeks. Your security effort should do its best to prevent initial infection and also root out malware that does make its way onto your network. • Application security: Insecure applications are often the vectors by which attackers get access to your network. You need to employ hardware, software, and security processes to lock those apps down. • Behavioral analytics: You should know what normal network behavior looks like so that you can spot anomalies or breaches as they happen.
- 6. Network security methods(cont.) •Data loss prevention: Human beings are inevitably the weakest security link. You need to implement technologies and processes to ensure that staffers don't deliberately or inadvertently send sensitive data outside the network. • Email security: Phishing is one of the most common ways attackers gain access to a network. Email security tools can block both incoming attacks and outbound messages with sensitive data. • Firewalls: Perhaps the granddaddy of the network security world, they follow the rules you define to permit or deny traffic at the border between your network and the internet, establishing a barrier between your trusted zone and the wild west outside. They don't preclude the need for a defense-in-depth strategy, but they're still a must-have. • Intrusion detection and prevention: These systems scan network traffic to identify and block attacks, often by correlating network activity signatures with databases of known attack techniques. • Mobile device and wireless security: Wireless devices have all the potential security flaws of any other networked gadget — but also can connect to just about any wireless network anywhere, requiring extra scrutiny.
- 7. Network security methods(cont.) •Network segmentation: Software-defined segmentation puts network traffic into different classifications and makes enforcing security policies easier. • Security information and event management (SIEM): These products aim to automatically pull together information from a variety of network tools to provide data you need to identify and respond to threats. • VPN: A tool (typically based on IPsec or SSL) that authenticates the communication between a device and a secure network, creating a secure, encrypted "tunnel" across the open internet. • Web security: You need to be able to control internal staff's web use in order to block web-based threats from using browsers as a vector to infect your network.
- 8.
- 9. Confidentiality • When informationis read or copied by someone not authorized to do so, then it will be “loss of confidentiality”. For sensitive information, confidentiality is a very important criterion. Bank account statements, personal information, credit card numbers, trade secrets, government documents are some examples of sensitive information. This goal of the CIA triad emphasizes the need for information protection. For example, confidentiality is maintained for a computer file, if authorized users are able to view it, while unauthorized persons are blocked from seeing it.
- 10. Integrity • Information canbe corrupted or manipulated if it’s available on an insecure network and is referred to as “loss of integrity.” This means that unauthorized changes are made to information, whether by human error or intentional tampering. Integrity is particularly important for critical safety and financial data used for activities such as electronic funds transfers, air traffic control, and financial accounting. For example, banks are more concerned about the integrity of financial records, with confidentiality having only second priority. Some bank account holders or depositors leave ATM receipts unchecked and hanging around after withdrawing cash. This shows that confidentiality does not have the highest priority. In the CIA triad, integrity is maintained when the information remains unchanged during storage, transmission, and usage not involving modification to the information. •
- 11. Availability • Information canbe erased or become inaccessible, resulting in “loss of availability.” This means that people who are authorized to get information are restricted from accessing. Availability is often the most important attribute in service-oriented businesses that depend on information. Denying access to information has become a very common attack nowadays. Almost every week you can find news about high profile websites being taken down by Denial of Service attacks. The CIA triad goal of availability is the situation where information is available when and where it is rightly needed.
- 12. protecting the C-I-Atriad • Authorization, Authentication, and Nonrepudiation processes and methods, which are some of the main controls aimed at protecting the C-I-A triad • To make information available or accessible/modifiable to those who need it and who can be trusted with it (for accessing and modification), organizations use authentication and authorization. Authentication is proving that a user is the person he or she claims to be. That proof may involve something the user knows (such as a password), something the user has (such as a “smartcard”), or something about the user that proves the person’s identity (such as a fingerprint). Authorization is the act of determining whether a particular user (or computer system) has the right to carry out a certain activity, such as reading a file or running a program. • Users must be authenticated before carrying out the activity they are authorized to perform. Security is strong when the means of authentication cannot later be refuted—the user cannot later deny that he or she performed the activity. This is known as non-repudiation.
- 13. THE OSI SECURITYARCHITECTURE • The OSI security architecture focuses on security attacks, mechanisms, and services. These can be defined briefly as • Security attack: Any action that compromises the security of information owned by an organization. • Security mechanism: A process (or a device incorporating such a process) that is designed to detect, prevent, or recover from a security attack. • Security service: A processing or communication service that enhances the security of the data processing systems and the information transfers of an organization. The services are intended to counter security attacks, and they make use of one or more security mechanisms to provide the service.
- 14. SECURITY ATTACKS • ACTIVEATTACKS • PASSIVE ATTACKS
- 15. • A passiveattack attempts to learn or make use of information from the system but does not affect system resources. An active attack attempts to alter system resources or affect their operation. Passive attacks are eavesdropping on, or monitoring of, transmissions. The goal of the opponent is to obtain information that is being transmitted. • Two types of passive attacks are the release of message contents and traffic analysis.
- 16. Release of message Contents Therelease of message contents is easily understood . A telephone conversation, an electronic mail message, and a transferred file may contain sensitive or confidential information. We would like to prevent an opponent from learning the contents of these transmissions.
- 17. traffic analysis • Asecond type of passive attack, traffic analysis, is subtler . Suppose that we had a way of masking the contents of messages or other information traffic so that opponents, even if they captured the message, could not extract the information from the message. • The common technique for masking contents is encryption. If we had encryption protection in place, an opponent still might be able to observe the pattern of these messages. The opponent could determine the location and identity of communicating hosts and could observe the frequency and length of messages being exchanged. This information might be useful in guessing the nature of the communication that was taking place.
- 18. PASSIVE ATTACKS • Passiveattacks are very difficult to detect, because they do not involve any alteration of the data. Typically, the message traffic is sent and received in an apparently normal fashion, and neither the sender nor the receiver is aware that a third party has read the messages or observed the traffic pattern. • However, it is feasible to prevent the success of these attacks, usually by means of encryption. Thus, the emphasis in dealing with passive attacks is on prevention rather than detection.
- 19. Active Attacks • Activeattacks involve some modification of the data stream or the creation of a false stream and can be subdivided into four categories: • Masquerade • replay • modification of messages • denial of service.
- 20. Masquerade • A masqueradetakes place when one entity pretends to be a different entity. A masquerade attack usually includes one of the other forms of active attack. For example, authentication sequences can be captured and replayed after a valid authentication sequence has taken place, thus enabling an authorized entity with few privileges to obtain extra privileges by impersonating an entity that has those privileges.
- 21. replay • Replay involvesthe passive capture of a data unit and its subsequent retransmission to produce an unauthorized effect
- 22. Modification of messages •Modification of messages simply means that some portion of a legitimate message is altered, or that messages are delayed or reordered, to produce an unauthorized effect. For example, a message meaning “Allow John Smith to read confidential file accounts” is modified to mean “Allow Fred Brown to read confidential file accounts.”
- 23. denial of service •The denial of service prevents or inhibits the normal use or management of communications facilities. This attack may have a specific target; for example, an entity may suppress all messages directed to a particular destination (e.g., the security audit service). Another form of service denial is the disruption of an entire network—either by disabling the network or by overloading it with messages to degrade performance.
- 24. Active attacks • Activeattacks present the opposite characteristics of passive attacks. Whereas passive attacks are difficult to detect, measures are available to prevent their success. On the other hand, it is quite difficult to prevent active attacks absolutely because of the wide variety of potential physical, software, and network vulnerabilities. Instead, the goal is to detect active attacks and to recover from any disruption or delays caused by them. If the detection has a deterrent effect, it also may contribute to prevention.