This document provides an introduction to system security. It outlines the prerequisites for the course, including computer networks, operating systems, algorithms, computer organization and data structures. The syllabus covers cryptography, access control, software security and network security. It defines key security concepts like vulnerabilities, threats, attacks, and controls. The document discusses different types of threats like interception, interruption, modification and fabrication. It also covers the goals of security - confidentiality, integrity and availability. Different security attacks both active and passive are defined. Finally, it introduces security mechanisms like encipherment, digital signatures and access control to protect confidentiality, integrity and availability.

1. System Security
Prof. Rupesh Mishra
System Security - Introduction

2. Prerequisites
• Computer Networks
• Operating Systems
• Algorithm & Programming
• Computer Organization and Architecture
• Data Structure
System Security - Introduction 2

3. Syllabus
• 150 = 100 + 25 + 25
• Cryptography
• Access Control
• Software Security
• Network Security
System Security - Introduction 3

4. • Text Book
1. Cryptography and Network Security by Behrouz A.
Forouzan, TATA McGraw hill.
2. Security in Computing by Charles P. Pfleeger ,
Pearson Education
• Reference Book
1. Cryptography and Network Security, William
Stalling, Prentice hall
System Security - Introduction 4

5. Information Asset
System Security - Introduction 5

6. Computing
System
Software
Hardware
Data
System Security - Introduction 6

7. Vulnerability
Weakness in the security
system
Threat
Circumstances that cause
harm or loss to system
Attack
Exploiting the
vulnerability of system
System Security - Introduction 7

8. Control
• An action, device, procedure or technique to
remove or reduce vulnerability.
• A threat is blocked by controlling
vulnerability.
System Security - Introduction 8

9. •Interception
•Interruption
•Modification
•Fabrication
Threats
System Security - Introduction 9

10. Interception
System Security - Introduction 10

11. Interception
• Unauthorized party has gained access to an
asset.
• Unauthorized party can be a Person,
Program or System.
• Copying data , Wiretapping
System Security - Introduction 11

12. Interruption
System Security - Introduction 12

13. Interruption
• An asset of the system becomes
unavailable or unusable.
o Destruction of hardware devices.
o Deleting program or data file.
o Malfunction of O.S.
System Security - Introduction 13

14. Modification
• Unauthorized tempering of asset.
o Change database value
o Alter program to perform additional
computation
o Modify data to be transmitted
System Security - Introduction 14

15. Fabrication
• Fabrication of counterfeit objects on a
computing system.
o Add records to an existing database
System Security - Introduction 15

16. Software Vulnerability
• Software Deletion(Interruption)
• Software Modification
o Logic Bomb
o Trojan Horse
o Virus
o Trap Door
o Information Leak
• Software Theft
System Security - Introduction 16

17. System Security - Introduction 17

18. Security
Confident-
iality
IntegrityAvailability
System Security - Introduction 18

19. Confidentiality
• No unauthorized disclosure of information
System Security - Introduction 19
I Don’t want
anyone to steal
my credit card
number

20. Confidentiality
• Only authorized party can access the
protected data.
• Determine authorized people
• Determine data access policy
• Awareness of sensitivity of data
System Security - Introduction 20

21. Integrity
• No unauthorized modification of information
System Security - Introduction 21
I Don’t want
anyone to
change my
report

22. AspectsofIntegrity
Authorized Action
Separation and
Protection
Error Detection &
Correction
System Security - Introduction 22

23. Availability
• System should be available for legitimate
use.
System Security - Introduction 23
I want to check
my E-Mails
24/7

24. Availability
• Applicable to data and services.
o Timely response to the request
o Fault Tolerance
o Easy to use
o Concurrency Controlled
o Deadlock Management
System Security - Introduction 24

25. Computer Security
• The protection afforded to an automated
information system in order to attain the
applicable objectives of preserving the
integrity , availability and confidentiality of
resources.
System Security - Introduction 25

26. Security
Attack
Active
Attack
Passive
attack
System Security - Introduction 26

27. Snooping
System Security - Introduction 27

28. Snooping
System Security - Introduction 28

29. Traffic Analysis
System Security - Introduction 29

30. Modification
System Security - Introduction 30

31. Modification
System Security - Introduction 31

32. Masquerading
System Security - Introduction 32

33. Masquerading
System Security - Introduction 33

34. Replay
System Security - Introduction 34

35. Repudiation
System Security - Introduction 35

36. Denial of Service
System Security - Introduction 36

37. Denial of Service
System Security - Introduction 37

38. Active Attack Passive Attack
Access and modify
information
Access information
System is harmed No harm to system
Easy to detect than prevent
Difficult to detect than
prevent
Threat to Integrity, Availability Threat to Confidentiality
Masquerading, Repudiation,
DOS
Snooping, Traffic analysis
System Security - Introduction 38

39. Security
Attack
Confidentiality
(Passive)
Snooping
Traffic
Analysis
Integrity
(Active)
Modification
Masquerading
Replaying
Repudiation
Availability
(Active)
DOS
System Security - Introduction 39

40. Service Security Mechanism
Data
Confidentiality
Encipherment , Routing Control
Data Integrity
Encipherment , Digital Signature,
Data Integrity
Authentication
Encipherment , Digital Signature,
Authentication Exchange
Nonrepudiation
Digital Signature, Data Integrity,
Notarization
Access Control Access Control
System Security - Introduction 40

41. System Security - Introduction 41

42. Encipherment
Cryptography
Steganography
System Security - Introduction 42

43. Cryptography
• Secret writing
• Encryption * Decryption
• Symmetric * Asymmetric
System Security - Introduction 43

44. Steganography
This course is about cryptography,
not on steganography
Thank You !!!!!!!
System Security - Introduction 44