its a computer security based ppt which is very useful
- 1. Computer Security MIS 604 – IT Solutions to Business Problems Spring 2002 Principles of Computer Security
- 2. • Computer Security • Goals of Computer Security • Principles of Computer Security • Security Policy Topics
- 3. Definition: Computer Security is the ability of a system to protect information and system resources with respect to confidentiality and integrity. Aspects of Security: – Prevention: take measures that prevent your assets from being damaged – Detection: take measures so that you can detect when, how, and by whom an asset has been damaged – Reaction: take measures so that you can recover your assets or to recover from a damage to your assets Analogy: Home Security Analogy: Credit Card Security? Computer Security
- 4. 1. Confidentiality: Preventing, detecting or deterring the improper disclosure of information 2. Integrity: Preventing, detecting, or deterring the improper modification of data 3. Availability: Preventing, detecting, or deterring the unauthorized denial of service or data to legitimate users 4. Authenticity: Ensuring that users of data/resources are the persons they claim to be 5. Accountability: Able to trace breach of security back to responsible party Computer Security - Goals
- 5. • Prevent unauthorised disclosure of information • Two aspects of confidentiality – Privacy: protection of personal data – e.g., personal medical records, student grade information – Secrecy: protection of data belonging to an organisation – e.g., Formula for a new drug, plans for the company for the next 5 years, Student Records Confidentiality
- 6. • Detection (and correction) of intentional and accidental modifications of data in a computer system • Various examples of modification – Corruption of hard drive – Changing course grades by breaking into university records – Transferring money from one account to another account fraudulently Integrity
- 7. • The property that a product’s services are accessible when needed and without undue delay • Denial of Service is the prevention of authorised access of resources or the delaying of time-critical operations • Distributed Denial of Service occurs when multiple sources contribute to denial of service simultaneously Availability
- 8. • Audit information must be selectively kept and protected so that actions affecting security can be traced to the responsible party • Users are identified and authenticated to have a basis for access control decisions. • The security system keeps an audit log (audit trail) of security relevant events to detect and investigate intrusions. Accountability
- 9. • Where to focus security controls? – Data: Format and content of data – Operations: Operations allowed on data – Users: Access control of data based on user Principles of Computer Security - I Application Software User (subject) Hardware Resource (object)
- 10. • Where to place security controls? – Lower layers offer more generic control – Higher layers allow most functionality and ease of use Principles of Computer Security - II hardware applications services (middleware) operating system OS kernel
- 11. • Security, functionality and ease-of-use linked together ? – Increasing Security hampers functionality & ease-of-use – Most secure computer is the one not plugged in and buried in 30 cu. ft. of concrete! Principles of Computer Security - III Security Functionality Ease-of-Use
- 12. • Centralized or Decentralized Security Control? – A central security authority provides much better control but may act as a bottleneck for productivity – A decentralized security control provides ability to fine tune security control for applications making system easy to use Principles of Computer Security - IV
- 13. • How do you stop an attacker from getting access to a layer below your protection mechanism? • Every protection mechanism defines a security perimeter (boundary). Attackers try to bypass protection mechanisms. Principles of Computer Security - V hardware applications services (middleware) operating system OS kernel Hackers attack at level below security perimeter
- 14. • Tools to bypass protection mechanisms – Recovery Tools: These can read the hard disks byte-to- byte without acquiescing to high level security checks – Unix Devices: Unix treats physical memory devices like files, so, if improper access controls are defined a hacker can read disks – Backups: Backups are made to recover data in a computer crash. If not stored properly data can be read from the backup media Principles of Computer Security – V cont’d.
- 15. • A definition of information security with a clear statement of management's intentions • An explanation of specific security requirements including: – Compliance with legislative and contractual requirements – Security education, virus prevention and detection, and business continuity planning – A definition of general and specific roles and responsibilities for the various aspects of information security program in business – an explanation of the requirement and process for reporting suspected security incidents, and – the process, including roles and responsibilities, for maintaining the policy document. Security Policy Source: IBM Consulting
- 16. • Medical records pose particular security problems. Assume that your medical records can be accessed on-line. On the one hand, this information is sensitive and should be protected from disclosure. On the other hand, in an emergency it is highly desirable that whoever treats you has access to your records. How would you draft your security policy and use prevention, detection and recovery to secure your records? Security Policy – Medical Records
Editor's Notes
- #2: Prevention: locks at doors, window bars, walls round the property Detection: stolen items are missing, burglar alarms, closed circuit TV Reaction: call the police, replace stolen items, make an insurance claim … Prevention: encrypt your orders, rely on the merchant to perform checks on the caller, don’t use the Internet (?) … Detection: an unauthorized transaction appears on your credit card statement Reaction: complain, ask for a new card number, etc.
- #3: Prevention: locks at doors, window bars, walls round the property Detection: stolen items are missing, burglar alarms, closed circuit TV Reaction: call the police, replace stolen items, make an insurance claim … Prevention: encrypt your orders, rely on the merchant to perform checks on the caller, don’t use the Internet (?) … Detection: an unauthorized transaction appears on your credit card statement Reaction: complain, ask for a new card number, etc.
- #10: Visualize security mechanisms as concentric protection rings, with hardware mechanisms in the centre and application mechanisms at the outside Mechanisms towards the centre tend to be more generic while mechanisms at the outside are more likely to address individual user requirements