Lecture 1 ~ Introduction to Information Security ~

Assalamualaikum w.b.t

First lecture encek ajr Introduction to Information Security.. Nie semue intro ajer dulu... Antara topics lam lecture 1 nie : -
~What is security?
~Security Architecture
~Security Principles
~Security Policy
~Security Attacks / Threats
~Methods of Defense
~Security Services
~Security Mechanisms

What is Security ?
Definition:
~Security is the quality or state of being secure that is to be free from danger and to be protected from adversaries – from those who would do harm, intentionally or otherwise
Information Security:
~Information Security is the protection of information and the systems and hardware that use, store, and transmit that information

Security Trends



Security Area


Security Architecture
~Defined by ITU-T Recommendation X.800 that called OSI Security Architecture.
~Useful to managers as a way of organizing the task of providing security
~Architecture was developed as an international standard, computer and communications vendors have developed security features for their products and services that relate to the structured definition of services and mechanisms.
~Focuses on security attacks, security mechanisms and security services.

Security Principles



Security Policy
~Set of rules to apply to security relevant activities in a security domain
~Level of security policy: objectives, organizational and system.
~Key aspects of security policy: authorization, access control policy, accountability


Security Attacks / Threats


Passive Attacks : Release of Message Contents



Passive Attacks : Traffic Analysis



Active Attacks : Masquerade



Active Attacks : Replay



Active Attacks : Modification of Messages



Active Attacks : Denial of Service



Passive Attack vs. Active Attack
Passive Attack :
~Very difficult to detect. Why?
~Feasible to prevent the success of these attacks. How?
~Emphasis in dealing with passive attacks is on prevention rather than detection. Why?

Active Attacks :
~Quite difficult to prevent active attacks. Why?
~Instead, the goal is to detect active attacks and to recover from any disruption or delays caused by them.
~If the detection has a deterrent effect, it may also contribute to prevention.

Methods of Defense
~We can deal with harm that occurs when a threat is realized against a vulnerability in several ways:
~Prevent it, by blocking the attack or closing the vulnerability.
~Deter it, by making the attack harder, but not impossible.
~Deflect it, by making another target more attractive.
~Detect it, either as it happens or some time after the fact.
~Recover from its effects.

Methods of Defense:Controls
~Encryption
~Software Controls - access limitations in a data base, in operating system protect each user from other users
~Hardware Controls –smartcard
~Policies - frequent changes of passwords
~Physical Controls

Methods of Defense:Software Controls
Program controls include:
~Internal program controls: part of the program that enforce security restrictions, such as access limitations in a database management program.
~Operating system and network system controls: limitations enforced by the operating system or network to protect each user from all other users.
~Independent control programs: application programs, such password checkers, intrusion detection utilities or virus scanners, that protect against certain types of vulnerabilities.
~Development controls: quality standards under which a program is designed, coded, tested and maintained, to prevent software faults from becoming exploitable vulnerabilities

Methods of Defense:Hardware Controls
Numerous hardware devices have been created to assist in providing computer security. These devices include a variety of means, such as:
>Hardware or smart card implementations of encryption
>Locks or cables limiting access or deterring theft
>Devices to verify user’s identities
>Firewalls
>Intrusion detection systems
>Circuit boards that control access to storage media

Methods of Defense:Policies & Procedure Controls
~Controls can also be in place based on agreed-upon procedures or policies among users, rather than enforcing security through hardware or software means.
~Training and administration follow immediately after establishment of policies, to reinforce the importance of security policy and to ensure their proper use.

Methods of Defense:Encryption Controls
~Encryption is the formal name for scrambling data so that interpretation is meaningless without the intruder’s knowing how the scrambling was done.
~Encryption can virtually nullify the value of an interception and the possibility of effective modification or fabrication.
*It clearly addresses the need for confidentiality of data.
*It also can be used to ensure integrity.
~Encryption is the basis of protocols that enable us to provide security while accomplishing an important system or network task.

Methods of Defense:Effectiveness of Controls
~Principle of effectiveness: Controls must be used and used properly to be effective.
~There are several aspects that can enhance the effectiveness of controls:
*Awareness of problem
*Likelihood of use
*Overlapping controls
*Periodic review

Security Services
Defined by X.800:
~A security service as a service provided by a protocol layer of communicating open systems which ensure adequate security of the systems or of data transfers.
Defined by RFC 2828:
~A processing or communication service that is provided by a system to give a specific kind of protection to system resources where security services implement security policies and are implemented by security mechanisms.

~Authentication - assurance that the communicating entity is the one claimed
~Access Control - prevention of the unauthorized use of a resource
~Data Confidentiality –protection of data from unauthorized disclosure
~Data Integrity - assurance that data received is as sent by an authorized entity
~Non-Repudiation - protection against denial by one of the parties in a communication

Security Services: 5 Categories & 14 Specific Services



Security Services:Data Integrity



Security Services:Data Confidentiality



Security Services:Authentication



Security Services:Nonrepudiation



Security Mechanism
~Security mechanism is any process (or a device incorporating such a process) that is designed to detect, prevent or recover from a security attack.
~Security mechanisms exist to provide and support security services and was defined by X.800
~Divided into two classes: those that are implemented in a specific protocol layer and those that are not specific to any particular protocol layer or security services
*Specific Security Mechanisms
*Pervasive Security Mechanisms

Lecture Summary
~Due to the technology era today, information security is made more importance implemented in most of organization.
~Studying information security is also importance due to the demand career in this area.
~Most of the major requirements for security services can be given self-explanatory one word labels:
*Confidentiality, authentication, nonrepudiation, integrity

hmm... tue jer la pengenalan tentang Information Security nie... Laen lecture kiter juper lg encek... yuhuuuu...

"Great minds discuss ideas, normal minds discuss events, small minds discuss people."