Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Information System Security(lecture 1)

3,348 views

Published on

Published in: Technology, News & Politics
  • Yes you are right. There are many research paper writing services available now. But almost services are fake and illegal. Only a genuine service will treat their customer with quality research papers. ⇒ www.HelpWriting.net ⇐
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • Hello! I can recommend a site that has helped me. It's called ⇒ www.HelpWriting.net ⇐ So make sure to check it out!
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • Hi there! I just wanted to share a list of sites that helped me a lot during my studies: .................................................................................................................................... www.EssayWrite.best - Write an essay .................................................................................................................................... www.LitReview.xyz - Summary of books .................................................................................................................................... www.Coursework.best - Online coursework .................................................................................................................................... www.Dissertations.me - proquest dissertations .................................................................................................................................... www.ReMovie.club - Movies reviews .................................................................................................................................... www.WebSlides.vip - Best powerpoint presentations .................................................................................................................................... www.WritePaper.info - Write a research paper .................................................................................................................................... www.EddyHelp.com - Homework help online .................................................................................................................................... www.MyResumeHelp.net - Professional resume writing service .................................................................................................................................. www.HelpWriting.net - Help with writing any papers ......................................................................................................................................... Save so as not to lose
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here
  • //DOWNLOAD THIS BOOKS INTO AVAILABLE FORMAT ......................................................................................................................... ......................................................................................................................... //DOWNLOAD PDF EBOOK here { https://tinyurl.com/y8nn3gmc } ......................................................................................................................... //DOWNLOAD EPUB Ebook here { https://tinyurl.com/y8nn3gmc } ......................................................................................................................... //DOWNLOAD doc Ebook here { https://tinyurl.com/y8nn3gmc } ......................................................................................................................... //DOWNLOAD PDF EBOOK here { https://tinyurl.com/y8nn3gmc } ......................................................................................................................... //DOWNLOAD EPUB Ebook here { https://tinyurl.com/y8nn3gmc } ......................................................................................................................... //DOWNLOAD doc Ebook here { https://tinyurl.com/y8nn3gmc } ......................................................................................................................... ......................................................................................................................... ......................................................................................................................... .............. Browse by Genre Available eBooks ......................................................................................................................... Art, Biography, Business, Chick Lit, Children's, Christian, Classics, Comics, Contemporary, Cookbooks, Crime, Ebooks, Fantasy, Fiction, Graphic Novels, Historical Fiction, History, Horror, Humor And Comedy, Manga, Memoir, Music, Mystery, Non Fiction, Paranormal, Philosophy, Poetry, Psychology, Religion, Romance, Science, Science Fiction, Self Help, Suspense, Spirituality, Sports, Thriller, Travel, Young Adult,
       Reply 
    Are you sure you want to  Yes  No
    Your message goes here

Information System Security(lecture 1)

  1. 1. Information System SecurityInformation System SecurityLecture 1Lecture 1Introduction to Information SystemIntroduction to Information SystemSecuritySecurity
  2. 2. 22OutlineOutline1.1. What is Security?What is Security?2.2. What is Information Security?What is Information Security?3.3. Why Information System Security?Why Information System Security?4.4. Vulnerability, Threat and AttackVulnerability, Threat and Attack5.5. Security PoliciesSecurity Policies6.6. Security MeasuresSecurity Measures7.7. Security RequirementsSecurity Requirements8.8. Security ServicesSecurity Services9.9. Security MechanismsSecurity Mechanisms
  3. 3. 331. What is security?1. What is security? SecuritySecurity:: protecting general assetsprotecting general assets Security can be realized through:Security can be realized through:1.1. PreventionPrevention: take measures that prevent your assets from being damaged.: take measures that prevent your assets from being damaged.2.2. DetectionDetection: take measures so that you can detect when, how, and by: take measures so that you can detect when, how, and bywhom an asset has been damaged.whom an asset has been damaged.3.3. ReactionReaction: take measures so that you can recover your assets or to recover: take measures so that you can recover your assets or to recoverfrom a damage to your assetsfrom a damage to your assets Examples: next slideExamples: next slide There are many branches of Security: national security,There are many branches of Security: national security,economic security,economic security, information securityinformation security, etc., etc.
  4. 4. 44ExamplesExamples Ex. 1 - Private propertyEx. 1 - Private property– Prevention: locks at doors, window bars, walls around the property.Prevention: locks at doors, window bars, walls around the property.– Detection: stolen items aren’t there any more, burglar alarms, CCTV, …Detection: stolen items aren’t there any more, burglar alarms, CCTV, …– Reaction: call the police,…Reaction: call the police,…
  5. 5. 55ExamplesExamples Ex. 2 - eCommerceEx. 2 - eCommerce– Prevention: encrypt your orders, rely on the merchant to perform checksPrevention: encrypt your orders, rely on the merchant to perform checkson the caller,…on the caller,…– Detection: an unauthorized transaction appears on your credit cardDetection: an unauthorized transaction appears on your credit cardstatementstatement– Reaction: complain, ask for a new credit card number, …Reaction: complain, ask for a new credit card number, …
  6. 6. 662. What is Information Security?2. What is Information Security? Information securityInformation security:: is concerned with protecting informationis concerned with protecting informationand information resources such as: books, faxes, computer data,and information resources such as: books, faxes, computer data,voice communications, etc.voice communications, etc. Information security isInformation security is determining:determining: whatwhat needs to be protected,needs to be protected, i.e.i.e., assets, assets andand whywhy (Security requirements which include CIA),(Security requirements which include CIA), whatwhat needs to be protected from (Threats, vulnerabilities, risks),needs to be protected from (Threats, vulnerabilities, risks), andand howhow (Security measures) to protect it for as long as it exists(Security measures) to protect it for as long as it exists– Security measures which are implemented according to a security policySecurity measures which are implemented according to a security policy
  7. 7. 773. What is Information System3. What is Information SystemSecurity (ISS)?Security (ISS)?InformationInformationSystemsSystems(assets)(assets)SecurityMeasuresAttackersPoliciesTaken from K. Martin’slecture, RHUL
  8. 8. 88Information System SecurityInformation System Security ISS is concerned with protecting Information systemISS is concerned with protecting Information systemassets such as PCs, software, applications, etc.assets such as PCs, software, applications, etc. In order to ensure the security of Information Systems, weIn order to ensure the security of Information Systems, weneed to determine:need to determine:1.1. Assets (i.e., Information systems) to be protectedAssets (i.e., Information systems) to be protected2.2. Security requirements; CIASecurity requirements; CIA3.3. Threats, vulnerabilities, risksThreats, vulnerabilities, risks4.4. Security policiesSecurity policies5.5. Security measuresSecurity measures
  9. 9. 994. Vulnerability, Threat and4. Vulnerability, Threat andAttackAttack AA vulnerabilityvulnerability: is a weakness in system design or: is a weakness in system design orimplementation and can be in hardware or software.implementation and can be in hardware or software.– Example: a software bug exists in the OS, or no password rules are set.Example: a software bug exists in the OS, or no password rules are set. AA threatthreat::– Is a set of circumstances that has the potential to cause loss or harmIs a set of circumstances that has the potential to cause loss or harm– is an indication of potential undesirable eventis an indication of potential undesirable event– It refers to a situation in whichIt refers to a situation in which a person could do something undesirable (an attacker initiating a denial-of-a person could do something undesirable (an attacker initiating a denial-of-service attack against an organizations email server), orservice attack against an organizations email server), or a natural occurrence could cause an undesirable outcome (a fire damaging ana natural occurrence could cause an undesirable outcome (a fire damaging anorganizations information technology hardware).organizations information technology hardware).
  10. 10. 10104. Vulnerability, Threat and4. Vulnerability, Threat andAttackAttack AA RiskRisk is the possibility of suffering harm or loss.is the possibility of suffering harm or loss. AnAn attackattack: is a realization of a threat: is a realization of a threat AnAn attackerattacker: is a person who exploit a vulnerability: is a person who exploit a vulnerability An attacker must have means, opportunity, and motiveAn attacker must have means, opportunity, and motive– Synonyms: enemy, adversary, opponent, eavesdropper, intruderSynonyms: enemy, adversary, opponent, eavesdropper, intruder
  11. 11. 1111Vulnerability, Attack and ThreatVulnerability, Attack and Threat AA hackerhacker::– A person who have advanced knowledge of operating systems andA person who have advanced knowledge of operating systems andprogramming languagesprogramming languages– Might discover holes within systems and the reasons for such holesMight discover holes within systems and the reasons for such holes– Share what they discover but never intentionally damage dataShare what they discover but never intentionally damage data AA crackercracker::– The one who breaks into or violates the system integrity of remoteThe one who breaks into or violates the system integrity of remotemachines with the malicious intent, i.e., gaining unauthorized accessmachines with the malicious intent, i.e., gaining unauthorized access– Might destroy vital data, deny legitimate users servicesMight destroy vital data, deny legitimate users services AA passive adversarypassive adversary is an adversary who is capable only ofis an adversary who is capable only ofreading from an unsecured channelreading from an unsecured channel AnAn active adversaryactive adversary is an adversary who may also transmit, alter,is an adversary who may also transmit, alter,or delete information on an unsecured channelor delete information on an unsecured channel
  12. 12. 1212Common security attacksCommon security attacks InterruptionInterruption, delay, denial of receipt or denial of service, delay, denial of receipt or denial of service– System assets or information become unavailable or are rendered unavailableSystem assets or information become unavailable or are rendered unavailable Interception or snoopingInterception or snooping– Unauthorized party gains access to information by browsing through files orUnauthorized party gains access to information by browsing through files orreading communications.reading communications. Modification or alterationModification or alteration– Unauthorized party changes information in transit or information stored forUnauthorized party changes information in transit or information stored forsubsequent access.subsequent access. Masquerade or spoofingMasquerade or spoofing– Spurious information is inserted into the system or network by making it appearsSpurious information is inserted into the system or network by making it appearsas if it is from a legitimate entity.as if it is from a legitimate entity. Repudiation of originRepudiation of origin– False denial that an entity created something.False denial that an entity created something.
  13. 13. 13135. Security Policy5. Security Policy AA security policysecurity policy states what is, and is not, allowedstates what is, and is not, allowed Is a document describing a company’s security controls andIs a document describing a company’s security controls andactivities.activities. Does not specify technologies.Does not specify technologies. Examples:Examples:– Policy: Password constructionPolicy: Password construction Account names must not be used inAccount names must not be used inpasswords.passwords.– Policy: Confidentiality of Personal informationPolicy: Confidentiality of Personal information all personalall personalinformation must be treated as confidential.information must be treated as confidential. A security Policy is a guideline for implementing securityA security Policy is a guideline for implementing securitymeasures.measures.
  14. 14. 14146. Security measures6. Security measures Security measuresSecurity measures include techniques for ensuring:include techniques for ensuring:– Prevention: such asPrevention: such as encryptionencryption,, user authenticationuser authentication,, one timeone timepasswordpassword,, anti-virusanti-virus,, firewalfirewall, etc.l, etc.– Detection: such asDetection: such as IDS (Intrusion Detection Systems)IDS (Intrusion Detection Systems), Monitoring tools,, Monitoring tools,Firewall log,Firewall log, digital signaturedigital signature, etc., etc.– Reaction (or recovery): Such as Backup systems, OS’s recovery points,Reaction (or recovery): Such as Backup systems, OS’s recovery points,etc.etc. Encryption (lectures 2 & 3)Encryption (lectures 2 & 3) Digital Signature (lecture 4)Digital Signature (lecture 4) User Authentication (lecture 5)User Authentication (lecture 5) Antivirus (lecture 7)Antivirus (lecture 7) IDS and firewalls (Lectures 8 & 9)IDS and firewalls (Lectures 8 & 9)Database security(lecture 6)
  15. 15. 15157. Security Requirements7. Security Requirements Most important security requirements are:Most important security requirements are:– ConfidentialityConfidentiality: keeping information secret from all but those: keeping information secret from all but thosewho are authorized to see it.who are authorized to see it. Also called secrecy or privacyAlso called secrecy or privacy– IntegrityIntegrity: ensuring information has not been altered by: ensuring information has not been altered byunauthorized or unknown means.unauthorized or unknown means.– AvailabilityAvailability :: keeping information accessible by authorized userskeeping information accessible by authorized userswhen requiredwhen required
  16. 16. 1616Security RequirementsSecurity Requirements Other requirements:Other requirements:– Entity authenticationEntity authentication :: corroboration of the identity of an entitycorroboration of the identity of an entity(e.g., a person, a credit card, etc.)(e.g., a person, a credit card, etc.) Identification, identity verificationIdentification, identity verification– Message authenticationMessage authentication : corroborating the source of: corroborating the source ofinformation; also known asinformation; also known as data origin authenticationdata origin authentication.. Message authentication implicitly provides data integrityMessage authentication implicitly provides data integrity– Digital SignatureDigital Signature : a means to bind information to an entity: a means to bind information to an entity– Non-repudiationNon-repudiation:: preventing the denial of previous commitmentspreventing the denial of previous commitmentsor actionsor actions
  17. 17. 1717Security RequirementsSecurity Requirements– AuthorizationAuthorization : conveyance, to another party, of official sanction: conveyance, to another party, of official sanctionto do or to be something.to do or to be something.– Access controlAccess control: restricting access to resources to privileged: restricting access to resources to privilegedentities.entities.– ValidationValidation: a means to provide timeliness of authorization to use: a means to provide timeliness of authorization to useor manipulate information or resources.or manipulate information or resources. These Requirements are referred to asThese Requirements are referred to as ISS objectivesISS objectives(another definition of ISS)(another definition of ISS)..
  18. 18. 18188. Security services8. Security services AnAn information security serviceinformation security service is a method to provide someis a method to provide somespecific aspects of securityspecific aspects of security– ExamplesExamples Confidentiality is a security objective (requirement), encryption is anConfidentiality is a security objective (requirement), encryption is aninformation security serviceinformation security service Integrity is another security objective (requirement), a method to ensureIntegrity is another security objective (requirement), a method to ensureintegrity is a security service.integrity is a security service. BreakingBreaking a security service implies defeating the objective ofa security service implies defeating the objective ofthe intended service.the intended service.
  19. 19. 19199. Security mechanisms9. Security mechanisms AA security mechanismsecurity mechanism encompasses Protocols, algorithms,encompasses Protocols, algorithms,Non-cryptographic techniques (hardware protection) toNon-cryptographic techniques (hardware protection) toachieve specific security objectives (confidentiality, integrity,achieve specific security objectives (confidentiality, integrity,…).…).
  20. 20. 2020

×