Network security cryptography m sadiq ali khan msakhan@uok edu pk
1 / 44

computer security - PowerPoint PPT Presentation

  • Uploaded on

Create Social Media Strategy, and revolutionize your campaigns with Cygnis Media

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

PowerPoint Slideshow about 'computer security' - cygnismedia

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript

What is computer security l.jpg
What is Computer Security?

  • Computer Security: The protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability and confidentiality of information system resources (includes hardware, software, firmware, information/data, and telecommunications).

Computer security requirements l.jpg
Computer Security Requirements

  • Secrecy

  • Integrity

  • Availability

  • Authenticity

  • Non-repudiation

  • Access control

Secrecy l.jpg

  • Secrecy requires that the information in a computer systems only be accessible for reading by authorized parties. This type of access includes printing, displaying, and other forms of disclosure, including simply revealing the existing of an object.

Integrity l.jpg

  • Integrity requires that the computer system asset can be modified only by authorized parties. Modification includes writing, changing, changing status, deleting, and creating.

More about integrity l.jpg
More About Integrity

  • Integrity: In lay usage, information has integrity when it is timely, accurate, complete, and consistent. However, computers are unable to provide or protect all of these qualities. Therefore, in the computer security field, integrity is often discussed more narrowly as having two data integrity and system integrity. "Data integrity is a requirement that information and programs are changed only in a specified and authorized manner." National Research Council, Computers at Risk, (Washington, DC: National Academy Press, 1991), p. 54. System integrity is a requirement that a system "performs its intended function in an unimpaired manner, free from deliberate or inadvertent unauthorized manipulation of the system." (National Computer Security Center, Pub. NCSC-TG-004-88.) The definition of integrity has been, and continues to be, the subject of much debate among computer security experts.

Availability l.jpg

  • Availability requires that computer systems assets are available to authorized parties.

  • Availability: A "requirement intended to assure that systems work promptly and service is not denied to authorized users." (Computers at Risk, p. 54.)

  • Access control - Unauthorized users are kept out

Authenticity l.jpg

  • Authenticity means that parties in a information services can ascertain the identity of parties trying to access information services.

Non repudiation l.jpg

  • Originator of communications can’t deny it later

  • Associates the identity of the originator with the transaction in a non-deniable way

Access control l.jpg
Access Control

  • Unauthorized users are kept out of the system

  • Unauthorized users are kept out of places on the system/disk

Security requirements are often combined l.jpg
Security Requirements are often Combined

  • These are often combined

  • User authentication used for access control purposes

  • Non-repudiation combined with authentication

Type of attacks threats in computer systems l.jpg
Type of Attacks/Threats in Computer Systems

  • A threat is a danger which which could affect the security (confidentiality, integrity, availability) of assets, leading to a potential loss or damage.

  • Interruption

  • Interception

  • Modification

  • Fabrication

Interruption l.jpg

  • An asset of the system is destroyed or becomes unavailable or unusable. This is an attack on the availability. Examples include destruction of a piece of hardware, such as a hard disk, the cutting of a communication link, or the disabling of the file management system.

Interception l.jpg

  • Information disclosure/information leakage

  • An unauthorized party gains access to an asset.

  • This is an attack on confidentiality.

  • The unauthorized party could be a person, a program, or a computer.

  • Examples include wiretapping to capture data in a network. And the illicit copying of files or programs.

Modification l.jpg

  • Integrity violation

  • An unauthorized party not only gains access to but tampers with an asset.

  • This is an attack on the integrity.

  • Examples include changing values in a data file, altering a program so that it performs differently, and modifying the content of a message being transmitted in a network.

Fabrication l.jpg

  • An unauthorized part inserts counterfeit objects into the system. This is an attack on the authenticity. Examples include the insertion of spurious messages in a network or the addition of records to a file.

Classification of attacks l.jpg
Classification of Attacks

  • Computer Security attacks can be classified into two broad categories:

    • Passive Attacks can only observe communications or data

    • Active Attacks can actively modify communications or data, Often difficult to perform, but very powerful

      • Mail forgery/modification

      • TCP/IP spoofing/session hijacking

Passive attacks and active attacks l.jpg
Passive Attacks and Active Attacks

Passive attacks l.jpg
Passive Attacks

  • Eavesdropping on or monitoring of transmission.

  • The goal of the opponent is to obtain information that is being transmitted.

  • Two types:

    • Release-of-message contents

    • Traffic Analysis

Release of message contents l.jpg
Release-of-message Contents

  • Opponent finds out the contents or the actual messages being transmitted.

Traffic analysis l.jpg
Traffic Analysis

  • More subtle than release-of-message contents

  • Messages may be kept secret by masking or encryption but

  • The opponent figures out information being carried by the messages based on the frequency and timings of the message

Passive attacks problems l.jpg
Passive Attacks Problems

  • Difficult to detect because there is no modification of data

  • Protection approach should be based on prevention rather than detection.

Active attacks l.jpg
Active Attacks

  • Active attacks involve some sort of modification of the data stream or the creation of a false stream. Four sub-categories:

    • Masquerade

    • Replay

    • Modification of Messages

    • Denial of service

Masquerade l.jpg

  • An entity pretends to be another

  • For the purpose of doing some other form of attack

  • Example a system claims its IP address to be what it is not, IP spoofing

Replay l.jpg

  • First passive capture of data and then its retransmission to produce an unauthorized effect.

Modification of messages l.jpg
Modification of Messages

  • Some portion of a legitimate message is altered or messages are delayed or reordered to produce an unauthorized effect.

Denial of service l.jpg
Denial of Service

  • Prevents the normal use or management of communication facilities.

Problems with active attacks l.jpg
Problems with Active Attacks

  • Easy to detect but difficult to prevent

  • Efforts are directed to quickly recover from disruption or delays

  • Good thing is that detection will have a deterrent effect.

Computer security is based on eight major elements l.jpg
Computer security is based on eight major elements:

  • 1. Computer security should support the mission of the organization.

  • 2. Computer security is an integral element of sound management.

  • 3. Computer security should be cost-effective.

  • 4. Computer security responsibilities and accountability should be made explicit.

  • 5. System owners have computer security responsibilities outside their own organizations.

  • 6. Computer security requires a comprehensive and integrated approach.

  • 7. Computer security should be periodically reassessed.

  • 8. Computer security is constrained by societal factors.

Usability and security l.jpg

Convenience / Usability



Usability and Security

Determine where on this line your organization needs lie

Security solutions l.jpg

Physical security


Access control

Automatic call back

Node authentication

Differentiated access rights

User authentication

Passwords and passphrases

Challenge-response systems

Token or smart cards

Exchange of secret protocol

Personal characteristics - Biometrics

Security Solutions

Security protocol layers l.jpg
Security Protocol Layers

  • The further down you go, the more transparent it is

  • The further up you go, the easier it is to deploy

Security services l.jpg
Security Services

  • From the OSI definition:

    • Access control: Protects against unauthorized use

    • Authentication: Provides assurance of someone's identity

    • Confidentiality: Protects against disclosure to unauthorized identities

    • Integrity: Protects from unauthorized data alteration

    • Non-repudiation: Protects against originator of communications later denying it

Security mechanisms l.jpg
Security Mechanisms

  • Three basic building blocks are used:

    • Encryption is used to provide confidentiality, can provide authentication and integrity protection

    • Digital signatures are used to provide authentication, integrity protection, and non-repudiation

    • Checksums/hash algorithms are used to provide integrity protection, can provide authentication

  • One or more security mechanisms are combined to provide a security service