Cyber Security: Znar Ghasem

Cyber Security
Znar Ghasem
Objective
• Understand basic security concept
• Understand the three key objectives of computer Security
• Identify security challenges
• Understand the OSI security architecture
• Understand the different type of attacks
• Acquire knowledge of Security service and mechanism
• Acquire basic understanding of security model
Security
Security is concern about the assets
Computer Security concerns assets of computer systems: the
information and services they provide
Computer Network Security focuses on the protection of assets on
computers that are connected and can be accessed remotely
Definition of computer security
The protection afforded to an automated information system in order
to attain the applicable objectives of preserving the integrity,
availability, and confidentiality of information system resources
(includes hardware, software, firmware, information/
data, and telecommunications)
[NIST95]
What is a cyber security?
• Cyber Security is a set of principles and practices designed to
safeguard your computing assets and online information against
threats.
Carnegie Mellon University

Three key objectives of computer
security (CIA)
security
 Confidentiality:
• Data confidentiality: Assures that private/Sensitive/ confidential information is not
made available or disclosed to unauthorized individuals.
• Privacy: Assures that individuals control over their information, decide which
information may be collected/stored and by whom and to home may be disclosed
Protecting Sensitive Information
• Encryption
• Access control
• Authentication
• Authorisation
• Physical Security
security
 Integrity:
• Data integrity: Assures that information /programs are changed only in a
specified and authorized manner.
• System integrity: Assures that a system performs its intended function in an
unimpaired manner, free from deliberate or inadvertent unauthorized
manipulation of the system.
 Tools support Integrity
• Backup: archiving is done to restore altered data
• Checksum: function maps the contents of file to numeric values.
• Data correct codes: any change in data can be detected and automatically be
corrected .
security
• Availability: Assures that systems work promptly and service is not
denied to authorized users
• Tools to support availability
• Physical protection
• Computational redundancy : computer and storage devices that serves as
fallbacks and keep data available in the case of failures.
e.g.
- Redundant arrays of inexpensive disks(RAID)
- Web servers are usually organised in multiples called (farms)
Additional concept to CIA (complete
picture)
 Authenticity:
- The ability to determine that the statement, policies and permission is issued
by the system is genuine.
- The property of being genuine and being able to be verified and trusted;
confidence in the validity of a transmission, a message, or message
originator.
- The protocol support authenticity demonstrates nonrepudiation
 Nonrepudiation: authenticity statement that issued by person/system

cannot be denied
- Digital signatures: used to achieve nonrepudiation
Additional concept to CIA (complete
picture)
• Accountability: The security goal that generates the requirement for
actions of an entity to be traced uniquely to that entity.
- This supports nonrepudiation, deterrence, fault isolation, intrusion
detection and prevention, that after-action recovery and legal action
Level of impact of breach of
security
 Low
The loss could be expected to have a limited adverse effect on
organizational operations, organizational assets, or individuals.
 Moderate
The loss could be expected to have a serious adverse effect on
organizational operations, organizational assets, or individuals
High
The loss could be expected to have a severe or catastrophic adverse
effect on organizational operations, organizational assets, or individuals
The Challenges of Computer
Security
1. Computer Security is not simple
2. One must always consider potential /unexpected attacks. [ Attack usually exploit unexpected weakness in
security mechanism]
3. Because of point 2, the procedures used to provide particular services are often counter-intuitive
4. Where to deploy security mechanism
5. Security mechanisms typically involve more than a particular algorithm or protocol
6. Computer and network security is essentially a battle of wits between a perpetrator/attacker and
designer or Admin
7. The benefits of security usually not recognised , until failed or being victim
8. Requires regular and even constant monitoring
9. Often afterthought incorporated into system and not integral part of design process
10. Strong security perceived as impediment.
The OSI Security Architecture
Security attack: Any action that compromises the security of
information owned by an organization.
Security mechanism: A process (or a device incorporating such a
process) that is designed to detect, prevent, or recover from a
security attack.
 Security service: A processing or communication service that
enhances the security of the data processing systems and the
information transfers of an organization. The services are intended to
counter security attacks, and they make use of one or more security
mechanisms to provide the service
SECURITY ATTACKS
Passive Attacks : obtaining information through eavesdropping on, or monitoring of

transmissions( Interception)
Eavesdropping: interception of information in the transmission.
1. The release of message contents ( telephone conversation, email message, file).
Packet sniffer
2. Traffic analysis
 Active Attacks : Modifying data or creation of a false stream (interruption, modification, fabrication)
1. Masquerade : fabrication of information that is claimed to be from someone who is not actually the
author . Phishing or spoofing
2. Replay
2. Modification of messages
3. denial of service
Security Services (X.800)
1. Authentication - assurance that the communicating entity is the

one claimed.
• Peer Entity Authentication
• Data-Origin Authentication
2. Access Control - prevention of the unauthorized use of a resource

3. Data Confidentiality –protection of data from unauthorized
disclosure
• Connection Confidentiality
• Connectionless Confidentiality
• Selective-Field Confidentiality
• Traffic-Flow Confidentiality
.
4. Data Integrity - assurance that data received is as sent by an
authorized entity
• Connection Integrity with Recovery
• Connection Integrity without Recovery
• Selective-Field Connection Integrity
• Connectionless Integrity
• Selective-Field Connectionless Integrity
• 4. Non-Repudiation - protection against denial by one of the parties
in a communication
• Nonrepudiation, Origin
• Nonrepudiation, Destination
Security Mechanisms
• The mechanisms are divided into those that are implemented in a
specific protocol layer, such as TCP or an application-layer protocol,
and those that are not specific to any particular protocol layer or
security service.
• Specific security mechanisms
• Pervasive security mechanisms
Security Mechanisms
Specific Security Mechanisms
- May be incorporated into the appropriate protocol layer in order to
provide some of the OSI security services.
• Encipherment
• Digital Signature:
• Access Control
• Authentication Exchange
Security Mechanisms
Specific Security Mechanisms (cont)
• Data Integrity
• Traffic Padding
• Routing Control
• Notarization
A Model for Network Security
Model for Network Security
Four basic tasks required to design a security service
• Design a suitable algorithm for the security transformation
• Generate the secret information (keys) used by the algorithm
• Develop methods to distribute and share the secret information
• Specify a protocol enabling the principals to use the
transformation and secret information for a security service
Network Access Security Model
Protecting information from unwanted access
Summary
• Security
• CIA
• OSI security architecture
• Security attacks
• Security services
• Security mechanism
• Security model
• Any question?

Cyber Security: Znar Ghasem

Uploaded by

Copyright:

Available Formats

Cyber Security: Znar Ghasem

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Cyber Security: Znar Ghasem

Uploaded by

Copyright:

Available Formats

Cyber Security

Carnegie Mellon University

 Nonrepudiation: authenticity statement that issued by person/system

Passive Attacks : obtaining information through eavesdropping on, or monitoring of

1. Authentication - assurance that the communicating entity is the

2. Access Control - prevention of the unauthorized use of a resource

You might also like