IAS2253

Chapter One
Introduction to Computer and Network
Security

Objectives
Explain the relationships among the component
parts of information security, especially network
security
Define the key terms and critical concepts of
information and network security
Explain the business need for information and
network security
Identify the threats posed to information and
network security, as well as the common attacks
associated with those threats
2013 Course Technology/Cengage Learning. All Rights Reserved.

Objectives (contd.)
Distinguish between threats to information from
within systems and attacks against information
from within systems
Describe the organizational roles of information
and network security professionals
Define managements role in the development,
maintenance, and enforcement of information
security policy, standards, practices, procedures,
and guidelines

2013 Course Technology/Cengage Learning. All Rights Reserved.

Objectives (contd.)
Discuss how an organization institutionalizes
policies, standards, and practices using education,
training, and awareness programs

2013 Course Technology/Cengage Learning. All Rights Reserved.

Introduction
Network security
Critical to day-to-day IT operations of nearly every
organization

Information security
Field has matured in last 20 years
Large in scope

2013 Course Technology/Cengage Learning. All Rights Reserved.

What is Information Security?

Protection of information and its critical elements
Systems and hardware that use, store, and transmit
information

Information security includes:

Information security management
Computer and data security
Network security

2013 Course Technology/Cengage Learning. All Rights Reserved.

What is Information Security? (contd.)

Security layers
Network security
Protect components, connections, and contents

Physical items or areas

Personal security
Protect people

Operations security
Protect details of activities

Communications security
Protect media, technology, and content
2013 Course Technology/Cengage Learning. All Rights Reserved.

Information Security Terminology

Access
Ability to use, modify, or affect another object

Asset
Organizational resource being protected

Attack
Act that causes damage to information or systems

Control, safeguard, or countermeasure

Security mechanisms, policies, or procedures

2013 Course Technology/Cengage Learning. All Rights Reserved.

Information Security Terminology

(contd.)
Exploit
Technique used to compromise a system

Exposure
Condition or state of being exposed to attack

Intellectual property
Works of the mind
Inventions, literature, art, logos, and other creative
works

Loss
Single instance of damage to an information asset
2013 Course Technology/Cengage Learning. All Rights Reserved.

Information Security Terminology

(contd.)
Protection profile or security posture
Set of controls that protect an asset

Risk
Probability that something unwanted will happen

Subject
Agent used to conduct the attack

Object
Target entity of an attack

2013 Course Technology/Cengage Learning. All Rights Reserved.

10

Figure 1-2 Computer as the subject and object of an attack

Cengage Learning 2013

2013 Course Technology/Cengage Learning. All Rights Reserved.

11

Information Security Terminology

(contd.)
Threat
Entity presenting danger to an asset

Threat agent
Specific instance of a threat
Examples: lightning strike, tornado, or specific
hacker

Vulnerability
Weakness or fault in a system
Opens up the possibility of attack or damage

2013 Course Technology/Cengage Learning. All Rights Reserved.

12

Critical Characteristics of Information

Characteristics of information determine its value
Availability
Ability to access information without obstruction

Accuracy
Information is free from errors

Authenticity
Quality or state of being genuine

Confidentiality
Protection from disclosure to unauthorized
individuals or systems
2013 Course Technology/Cengage Learning. All Rights Reserved.

13

Critical Characteristics of Information

(contd.)
Data owners
Responsible for the security and use of a particular
set of information

Data custodians
Responsible for information storage, maintenance,
and protections

Data users
End users who work with information

Integrity
Information remains whole, complete, uncorrupted
2013 Course Technology/Cengage Learning. All Rights Reserved.

14

Critical Characteristics of Information

(contd.)
Utility
Information has value for some purpose or end

Possession
Ownership or control of some object or item

Privacy
Information is used in accordance with legal
requirements

2013 Course Technology/Cengage Learning. All Rights Reserved.

15

Security Models
Information security model
Maps security goals to concrete ideas

C.I.A. triad
Original basis of computer security

Figure 1-3 C.I.A. triad

Cengage Learning 2013

2013 Course Technology/Cengage Learning. All Rights Reserved.

16

Security Models (contd.)

McCumber cube
Graphical description of architectural approach
Widely used in computer and information security
27 cells represent areas to address to secure
information systems

2013 Course Technology/Cengage Learning. All Rights Reserved.

17

Security Models (contd.)

Figure 1-4 McCumber cube

Cengage Learning 2013

2013 Course Technology/Cengage Learning. All Rights Reserved.

18

Balancing Information Security and

Access
Information security must balance protection and
availability
Allow reasonable access
Protect against threats

Imbalance occurs when:

Needs of end user are undermined

2013 Course Technology/Cengage Learning. All Rights Reserved.

19

Business Needs First

Important organizational functions of an information
security program

Protects organizations ability to function

Enables safe operation of applications
Protects data
Safeguards technology assets

2013 Course Technology/Cengage Learning. All Rights Reserved.

20

Business Needs First (contd.)

Protecting the functionality of an organization
General management and IT management are
responsible
More to do with management than technology

Enabling safe operation of applications

Securing storage of business-critical data
Ensuring integrity of key business transactions
Making communications constantly available

2013 Course Technology/Cengage Learning. All Rights Reserved.

21

Business Needs First (contd.)

Protecting data that organizations collect and use
Data in motion
Data at rest

Safeguarding technology assets in organizations

Security should match size and scope of asset
Examples of assets: firewalls; caching network
appliances

2013 Course Technology/Cengage Learning. All Rights Reserved.

22

Threats to Information Security

Wide range of threats pervade interconnected
world
Threats are relatively well researched
See Table 1-1
12 categories of danger to an organizations people,
information, and systems

2013 Course Technology/Cengage Learning. All Rights Reserved.

23

Table 1-1 Threats to information security

Cengage Learning 2013
2013 Course Technology/Cengage Learning. All Rights Reserved.

24

Common Threats
Cracker
Individual who cracks (removes) software
protection

Cyberterrorist
Hacks systems to conduct terrorist activities

Hackers
Gain access without authorization

Hacktivist or cyberactivist
Disrupts or interferes with operations to protest
against an organization or government agency
2013 Course Technology/Cengage Learning. All Rights Reserved.

25

Common Threats (contd.)

Malicious code or malicious software
Computer viruses
Macro or boot virus

Worms
Trojan horses
Backdoor, trap door, or maintenance hook
Rootkit

Packet monkeys
Phreaker
Hacker who targets public telephone network
2013 Course Technology/Cengage Learning. All Rights Reserved.

26

Common Threats (contd.)

Script kiddies
Hackers of limited skill who use expertly written
software to attack a system

Shoulder surfing
Observing passwords of others

Software piracy
Unlawful use or duplication of software IP

2013 Course Technology/Cengage Learning. All Rights Reserved.

27

Attacks on Information Security

Threats are always present
Attacks occur through specific actions
May cause business loss

2013 Course Technology/Cengage Learning. All Rights Reserved.

28

Malicious Code
State-of-the-art malicious code attack
Polymorphic (or multivector) worm
Uses several attack vectors to exploit variety of
vulnerabilities
See Table 1-2 for known attack vectors

2013 Course Technology/Cengage Learning. All Rights Reserved.

29

Table 1-2 Attack replication vectors

Cengage Learning 2013

2013 Course Technology/Cengage Learning. All Rights Reserved.

30

Password Attacks
Password cracking
Attempt to bypass access controls
Guessing passwords

Rainbow tables
Used when the hash of the users password is known

Brute force attacks

Trying every possible combination

Dictionary
Trying specific, commonly used passwords
2013 Course Technology/Cengage Learning. All Rights Reserved.

31

Denial-of-Service (DoS) and

Distributed Denial-of-Service (DDoS)
Attacks
Denial-of-service attack
Attacker sends large number of requests to a target
Target system cannot handle volume of requests
System crashes
Or cannot handle legitimate requests

Distributed denial-of-service attack

Coordinated stream of requests against a target
Occurs from many locations simultaneously

2013 Course Technology/Cengage Learning. All Rights Reserved.

32

Figure 1-5 Denial-of-service attacks

Cengage Learning 2013
2013 Course Technology/Cengage Learning. All Rights Reserved.

33

Spoofing
Technique used to gain unauthorized access to
computers
Intruder sends messages with fake IP address of a
trusted host
Modifies the packet headers with the trusted IP

Newer routers and firewalls can offer protection

2013 Course Technology/Cengage Learning. All Rights Reserved.

34

Figure 1-6 IP spoofing

Cengage Learning 2013
2013 Course Technology/Cengage Learning. All Rights Reserved.

35

Man-in-the-Middle Attacks

Attacker monitors packets from the network

Modifies packets using IP spoofing techniques
Inserts packets back into network
Can be used to eavesdrop, modify, reroute, forge,
divert data

2013 Course Technology/Cengage Learning. All Rights Reserved.

36

Figure 1-7 Man-in-the-middle attack

Cengage Learning 2013
2013 Course Technology/Cengage Learning. All Rights Reserved.

37

E-Mail Attacks
Spam
Malicious code may be embedded in attachments

Mail bomb
Attacker reroutes large quantities of e-mail to the
target system
Poorly-configured e-mail systems at risk

2013 Course Technology/Cengage Learning. All Rights Reserved.

38

Sniffers
Program or device monitoring data traveling over a
network
Can be used for legitimate functions
Also for stealing information

Unauthorized sniffers virtually impossible to detect

Shows all data going by including passwords

2013 Course Technology/Cengage Learning. All Rights Reserved.

39

Social Engineering
Process of using social skills to convince people to
reveal access credentials
Usually involves impersonation
New employee
Employee who needs assistance
Someone higher in organizational hierarchy

2013 Course Technology/Cengage Learning. All Rights Reserved.

40

Buffer Overflow
Application error
Occurs when more data is sent to a buffer than it
can handle
Attacker can take advantage of the consequence of
the failure

2013 Course Technology/Cengage Learning. All Rights Reserved.

41

Timing Attacks
Measuring the time required to access a Web page
Deducing that the user has visited the site before
Presence of the page in browsers cache

Another type of timing attack:

Side channel attack on cryptographic algorithms

2013 Course Technology/Cengage Learning. All Rights Reserved.

42

Security Professionals and the

Organization
Information security program
Supported by wide range of professionals
Administrative support also required

Executive management
Chief information officer (CIO)
Chief information security officer (CISO)

2013 Course Technology/Cengage Learning. All Rights Reserved.

43

Security Professionals and the

Organization (contd.)
Information security project team

Champion
Team leader
Security policy developers
Risk assessment specialists
Security professionals
Systems, network, and storage administrators
End users

2013 Course Technology/Cengage Learning. All Rights Reserved.

44

Information Security Policy, Standards,

and Practices
Policy
Guidance implemented by senior management
Regulates activities
Similar to laws

Standards
Detailed description of how to comply with policy
De facto standards
De jure standards

2013 Course Technology/Cengage Learning. All Rights Reserved.

45

Figure 1-8 Policies, standards, and practices

Cengage Learning 2013

2013 Course Technology/Cengage Learning. All Rights Reserved.

46

Information Security Policy, Standards,

and Practices (contd.)
Management policy
Basis for information security planning, design, and
deployment

Criteria for effective policy

Dissemination
Review
Comprehension
Compliance
Uniformity

2013 Course Technology/Cengage Learning. All Rights Reserved.

47

Enterprise Information Security Policy

(EISP)
Other names for EISP
General security policy
IT security policy
Information security policy

Supports mission and vision of the organization

Executive-level document
Guides the security program
Addresses legal compliance

2013 Course Technology/Cengage Learning. All Rights Reserved.

48

Table 1-3 Components of the EISP

Cengage Learning 2013
2013 Course Technology/Cengage Learning. All Rights Reserved.

49

Issue-Specific Security Policy (ISSP)

States organizations position on each issue
Examples of topics

Use of company-owned networks and the Internet

Use of e-mail
Prohibitions against hacking
Use of personal equipment on company networks

2013 Course Technology/Cengage Learning. All Rights Reserved.

50

Table 1-4 Components of

the ISSP
Cengage Learning 2013

2013 Course Technology/Cengage Learning. All Rights Reserved.

51

Systems-Specific Policy (SysSP)

Managerial guidance SysSPs
Guides technology implementation and configuration
Regulates behavior of people in organization

Technical specification SysSPs

Access control lists
Capability table
Access control matrix

Configuration rule policies

Specific instructions to regulate security system

2013 Course Technology/Cengage Learning. All Rights Reserved.

52

Frameworks and Industry Standards in

Information Security
Security blueprint
Used to implement the security program
Basis for design, selection, and implementation of
program elements

Security framework
Outline of overall information security strategy
Roadmap for planned changes to the environment

Security models
Can be used to develop a security blueprint

2013 Course Technology/Cengage Learning. All Rights Reserved.

53

The ISO 27000 series

One of the most widely referenced security models
Gives recommendations for information security
management
See Figure 1-9 for overall methodology

2013 Course Technology/Cengage Learning. All Rights Reserved.

54

Figure 1-9 ISO/IEC 27002

major process steps
Cengage Learning 2013

2013 Course Technology/Cengage Learning. All Rights Reserved.

55

Table 1-6 ISO 27000 series current and planned standards (www.27000.org)
Cengage Learning 2013
2013 Course Technology/Cengage Learning. All Rights Reserved.

56

NIST Security Models

Available from csrc.nist.gov
Publicly available
Free
Reviewed by government and industry
professionals
Many documents available

2013 Course Technology/Cengage Learning. All Rights Reserved.

57

IETF Security Architecture

Security area working group
Acts as advisory board for IETF

RFC 2196: Site security handbook

Good reference
Covers five basic areas of security

2013 Course Technology/Cengage Learning. All Rights Reserved.

58

Benchmarking and Best Business

Practices
Methods used by some organizations
To assess security practices

Federal Agency Security Practices Web site

Popular resource for best practices

SANS Institute
Cooperative information security research
organization

Other sources
www.cert.org
http://www.us-cert.gov
2013 Course Technology/Cengage Learning. All Rights Reserved.

59

Benchmarking and Best Business

Practices (contd.)
Spheres of security
Shows that information is at risk from various
sources
Illustrated in Figure 1-10

Defense in depth
Layered implementation of security
Organization establishes multiple layers of security
controls

2013 Course Technology/Cengage Learning. All Rights Reserved.

60

Figure 1-10 Spheres of security

Cengage Learning 2013

2013 Course Technology/Cengage Learning. All Rights Reserved.

61

Figure 1-11 Defense in depth

Cengage Learning 2013

2013 Course Technology/Cengage Learning. All Rights Reserved.

62

Benchmarking and Best Business

Practices (contd.)
Redundancy
Implementing multiple types of technology
Prevents failure of one system from compromising
security of another system

Security perimeter
Defines the boundary between organizations
security and outside world
Both electronic and physical

2013 Course Technology/Cengage Learning. All Rights Reserved.

63

Figure 1-12 Security perimeters

Cengage Learning 2013

2013 Course Technology/Cengage Learning. All Rights Reserved.

64

Summary
Information security is the protection of information
Information value comes from its characteristics

A threat is an object, person, or entity that

represents a danger to an asset
An attack is an action that takes advantage of a
vulnerability to compromise a controlled system
Security models include the C.I.A. triad and the
McCumber cube

2013 Course Technology/Cengage Learning. All Rights Reserved.

65

Summary (contd.)
Information security functions

Protects organizations ability to function

Enables safe operation of applications
Protects data
Safeguards technology assets

Many types of professionals support an information

security program
Management policy is the basis for all information
security planning

2013 Course Technology/Cengage Learning. All Rights Reserved.

66