Scribd Logo
Upload

Welcome to Scribd!

  • 58 views

    MICE-5102: Information Security

    Uploaded by

    Zain Hamza
    The document provides an introduction to an information security course, including the syllabus, required texts, and references. The syllabus covers topics such as introduction to security, risk management, security technology, cryptography, physical security, and information security maintenance. Key concepts in information security include confidentiality, integrity, availability, authenticity, and accountability. The document also discusses security attacks, security services, models for network and access security, and handling security attacks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    MICE-5102: Information Security

    Uploaded by

    Zain Hamza
    58 views35 pages
    The document provides an introduction to an information security course, including the syllabus, required texts, and references. The syllabus covers topics such as introduction to security, risk management, security technology, cryptography, physical security, and information security maintenance. Key concepts in information security include confidentiality, integrity, availability, authenticity, and accountability. The document also discusses security attacks, security services, models for network and access security, and handling security attacks.

    Original Title

    lec_1

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document provides an introduction to an information security course, including the syllabus, required texts, and references. The syllabus covers topics such as introduction to security, risk management, security technology, cryptography, physical security, and information security maintenance. Key concepts in information security include confidentiality, integrity, availability, authenticity, and accountability. The document also discusses security attacks, security services, models for network and access security, and handling security attacks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    58 views35 pages

    MICE-5102: Information Security

    Uploaded by

    Zain Hamza
    The document provides an introduction to an information security course, including the syllabus, required texts, and references. The syllabus covers topics such as introduction to security, risk management, security technology, cryptography, physical security, and information security maintenance. Key concepts in information security include confidentiality, integrity, availability, authenticity, and accountability. The document also discusses security attacks, security services, models for network and access security, and handling security attacks.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 35

    MICE-5102: Information Security

    Introduction to Security
    Syllabus
    Introduction to Information Security; The Need
    for Security; Legal, Ethical, Professional Issues
    in Information Security; Risk Management;
    Planning for Security; Security Technology:
    Firewalls and VPNs; Security Technology:
    Intrusion Detection and Prevention Systems and
    Other Security Tools; Cryptography; Physical
    Security; Implementing Information Security;
    Security and Personnel; Information Security
    Maintenance.
    Texts
    1) Cryptography and network security principles
    and practice, William Stallings, Prentice Hall

    2) Principles of Information Security, Michael E.


    Whitman and Herbert J. Mattord, Cengage
    Learning
    References

    1. Cryptography and network security, Behrouz


    A. Forouzan and Debdeep Mukhopadhyay,
    McGrawHill
    2. Network Security: Private communication in a
    public world, Kaufman, C, Perlman, R and
    Speciner, M., Prentice Hall
    3. Applied Cryptography, Schneier, B., John
    Wiley
    Concepts
    These three concepts form what is often referred
    to as the CIA triad (Figure 1.1).

    • Confidentiality (covers both data


    confidentiality and privacy): preserving
    authorized restrictions on information access
    and disclosure, including means for protecting
    personal privacy and proprietary information.
    A loss of confidentiality is the unauthorized
    disclosure of information.
    • Integrity (covers both data and system
    integrity): Guarding against improper
    information modification or destruction, and
    includes ensuring information non-repudiation
    and authenticity. A loss of integrity is the
    unauthorized modification or destruction of
    information.

    • Availability: Ensuring timely and reliable access


    to and use of information. A loss of availability
    is the disruption of access to or use of
    information or an information system.
    Although the use of the CIA triad to define
    security objectives is well established, some in
    the security field feel that additional concepts
    are needed to present a complete picture. Two
    of the most commonly mentioned are:
    • Authenticity: The property of being genuine
    and being able to be verified and trusted;
    confidence in the validity of a transmission, a
    message, or message originator.
    • Accountability: The security goal that generates
    the requirement for actions of an entity to be
    traced uniquely to that entity.
    Low Impact
    • The loss could be expected to have a limited adverse effect on
    organizational operations, organizational assets, or
    individuals.
    • A limited adverse effect means that, for example, the loss of
    confidentiality, integrity, or availability might
    – (i) cause a degradation in mission capability to an extent
    and duration that the organization is able to perform its
    primary functions, but the effectiveness of the functions is
    noticeably reduced;
    – (ii) result in minor damage to organizational assets;
    – (iii) result in minor financial loss; or
    – (iv) result in minor harm to individuals.
    Moderate Impact
    • The loss could be expected to have a serious adverse effect on
    organizational operations, organizational assets, or
    individuals.
    • A serious adverse effect means that, for example, the loss
    might
    – (i) cause a significant degradation in mission capability to
    an extent and duration that the organization is able to
    perform its primary functions, but the effectiveness of the
    functions is significantly reduced;
    – (ii) result in significant damage to organizational assets;
    – (iii) result in significant financial loss; or
    – (iv) result in significant harm to individuals that does not
    involve loss of life or serious, life-threatening injuries.
    High Impact
    • The loss could be expected to have a severe or catastrophic
    adverse effect on organizational operations, organizational
    assets, or individuals.
    • A severe or catastrophic adverse effect means that, for
    example, the loss might
    – (i) cause a severe degradation in or loss of mission
    capability to an extent and duration that the organization
    is not able to perform one or more of its primary
    functions;
    – (ii) result in major damage to organizational assets;
    – (iii) result in major financial loss; or
    – (iv) result in severe or catastrophic harm to individuals
    involving loss of life or serious life threatening injuries.
    Examples of Security Requirements
    • confidentiality – student grades
    • integrity – patient information
    • availability – authentication service
    • authenticity – admission ticket
    • non-repudiation – stock sell order
    Computer Security Challenges
    1. not simple – easy to get it wrong
    2. must consider potential attacks
    3. procedures used counter-intuitive
    4. involve algorithms and secret info
    5. must decide where to deploy mechanisms
    6. battle of wits between attacker / admin
    7. not perceived on benefit until fails
    8. requires regular monitoring
    a process, not an event
    9. too often an after-thought
    10. regarded as impediment to using system
    Security Attacks
    Handling Attacks
    – Passive attacks – focus on Prevention
    • Easy to stop
    • Hard to detect
    – Active attacks – focus on Detection and Recovery
    • Hard to stop
    • Easy to detect
    Security Service
    – enhance security of data processing systems and
    information transfers of an organization
    – intended to counter security attacks
    – using one or more security mechanisms
    – often replicates functions normally associated
    with physical documents
    • which, for example, have signatures, dates; need
    protection from disclosure, tampering, or destruction;
    be notarized or witnessed; be recorded or licensed
    Security Services
    Model for Network Security
    Model for Network Security
    • using this model requires us to:
    1. design a suitable algorithm for the security
    transformation
    2. generate the secret information (keys) used by
    the algorithm
    3. develop methods to distribute and share the
    secret information
    4. specify a protocol enabling the principals to use
    the transformation and secret information for a
    security service
    Model for Network Access Security
    Model for Network Access Security
     using this model requires us to:
    1. select appropriate gatekeeper functions to
    identify users
    2. implement security controls to ensure
    only authorised users access designated
    information or resources
     note that model does not include:
    1. monitoring of system for successful
    penetration
    2. monitoring of authorized users for misuse
    3. audit logging for forensic uses, etc.

    You might also like