Date post: | 28-Mar-2015 |
Category: |
Documents |
Upload: | andrea-hundley |
View: | 214 times |
Download: | 0 times |
VA Course© AZ 2004upd LM 2007
01/11/2007
Introduction to security
VA Course© AZ 2004upd LM 2007
01/11/2007
Some confusion
Safety = Säkerhet = Security???
• Security– measures taken to guard against espionage or sabotage, crime,
attack, or escape Miriam Webster Online Dictionary
• Safety– to protect against failure, breakage, or accident
Miriam Webster Online Dictionary
VA Course© AZ 2004upd LM 2007
01/11/2007
What is Computer Security?
• “Security is keeping anyone from doing things you do not want them to do to, with, on, or from your computers or any peripheral devices”
Cheswick and Bellovin
• “The purpose of information security is to ensure business continuity and minimize business damage by preventing and minimizing the impact of security incidents… It has three basic components: confidentiality, integrity, and availability.”
BS 7799 : 1995, British Standards Institute
VA Course© AZ 2004upd LM 2007
01/11/2007
Is information security really a topic ?
VA Course© AZ 2004upd LM 2007
01/11/2007
Widely Known Threats
• Viruses and Worms• spreading worldwide in a matter of hours
• Access Control and Data Theft• breaking into computer systems
• OS, Databases and Applications• poor coding and flawed protocol design & implementation
VA Course© AZ 2004upd LM 2007
01/11/2007
CERT - Statistics
0
20000
40000
60000
80000
100000
120000
140000
1988 1990 1992 1994 1996 1998 2000 2002
Incidents
VA Course© AZ 2004upd LM 2007
01/11/2007
0
1000
2000
3000
4000
5000
6000
7000
8000
9000
1995
1996
1997
1998
1999
2000
2001
2002
2003
2004
2005
2006
CERT - Statistics
Vulnerabilities
VA Course© AZ 2004upd LM 2007
01/11/2007
Type of Breaches and Costs
Source: DTI, Information Security Breach Survey, 2002
VA Course© AZ 2004upd LM 2007
01/11/2007
Is information security really a topic ?
VA Course© AZ 2004upd LM 2007
01/11/2007
Security Services
Confidentialitymeans that the assets of a computing system are accessible only by authorized parties
Integritymeans that assets can be modified only by authorized parties or only in authorized ways
Availabilitymeans that assets are accessible to authorized parties
VA Course© AZ 2004upd LM 2007
01/11/2007
ISO 13335-1* – OSI** Security Services
• Confidentiality• Integrity• Availability• Authentication• Access Control• Non-repudiation
*International Organization for Standardization **Open System Interconnection
VA Course© AZ 2004upd LM 2007
01/11/2007
Trust Approach
• Security is about trust.• Trust encompasses
• Correctness• Reliability• Privacy• Safety• Survivability• Secrecy• Availability
VA Course© AZ 2004upd LM 2007
01/11/2007
Scope
• IT security– Dealing with technical parts of security
• Information System Security– The whole information processing system is of interest
• Information security– All information is of interest
VA Course© AZ 2004upd LM 2007
01/11/2007
Security is Multidimensional
VA Course© AZ 2004upd LM 2007
01/11/2007
House of security
Standards
Standards: Applying standards
•Technical Standards•Evaluation Standards•Process Standards
VA Course© AZ 2004upd LM 2007
01/11/2007
Standards
Management
The management processincludes:
•Commitment•Control•Steering
VA Course© AZ 2004upd LM 2007
01/11/2007
Standards
Management
Policy
Risk
Ana.
Risk analysis: Learning the risks the information face
Policy: Define guidelines regarding security
VA Course© AZ 2004upd LM 2007
01/11/2007
Standards
Management
Policy
Risk
Ana.
Analysis
Realization
Analysis: What kind of security needs to be realized
•Technical•Organizational
Realization: Enforce the security mechanisms
•Implementation•Documentation
VA Course© AZ 2004upd LM 2007
01/11/2007
Standards
Management
Policy
Risk
Ana.
Analysis
Realization
Maintenace
Maintenance: Keeping the system secure by means of:
•Improving security•Applying patches
VA Course© AZ 2004upd LM 2007
01/11/2007
Standards
Management
Policy
Risk
Ana.
Analysis
Audit
Realization
Maintenace
Audit: Verification of security:
•Technical Security•Organizational Security•Planning Security
VA Course© AZ 2004upd LM 2007
01/11/2007
Standards
Management
Policy
Risk
Ana.
Analysis
Audit
Realization
Maintenace
But security can only work if all components are working together and an awareness for the problems is given.
VA Course© AZ 2004upd LM 2007
01/11/2007
The Big Picture
VulnerabilitiesThreats Assets
Risk Analysis
Countermeasures
impact
these slides are based on USP slides from Cintia B. Margi and Prof. Wilson V. Ruggiero
VA Course© AZ 2004upd LM 2007
01/11/2007
Terminology• Asset
– Anything with value and in need for protection
• Threat– An action or potential action with the prosperity to cause damage
• Vulnerability– Circumstances that have the potential of causing loss
• Countermeasure– Controls protecting for protecting the assets
VA Course© AZ 2004upd LM 2007
01/11/2007
Assets
• What is an asset?• tangible assets
datahard & floppy disksnetwork equipmenttapes, manuals, etc…
• intangible assetspublic imagereputation, etc…
• a very broad scope from people to hardware and datathese slides are based on USP slides from Cintia B. Margi and Prof. Wilson V. Ruggiero
VA Course© AZ 2004upd LM 2007
01/11/2007
Assets
• Assets may be classified according to:• software and hardware assets• data assets• communication assets• administrative assets• human resources assets
• A list of assets that shall be protected is essential for risk analysis
these slides are based on USP slides from Cintia B. Margi and Prof. Wilson V. Ruggiero
VA Course© AZ 2004upd LM 2007
01/11/2007
Threats
• Threats to the system may come from:• someone
e.g. a spy, a hacker, a criminal or an ill-intended employee
• somethinge.g. hardware or software failure
• an evente.g. fire, power shortage, flooding, earthquake
• Threats can be classified in 3 groups• natural or physical threats• non-intentional threats• intentional threats these slides are based on USP slides from Cintia B. Margi and Prof. Wilson V. Ruggiero
VA Course© AZ 2004upd LM 2007
01/11/2007
Natural or Physical Threats
• Every kind of equipment or facilities are exposed to• e.g. fire, flooding, power shortages…
• Usually very hard to prevent, but easy to detect
• It is possible to minimize the amount
these slides are based on USP slides from Cintia B. Margi and Prof. Wilson V. Ruggiero
VA Course© AZ 2004upd LM 2007
01/11/2007
Non-Intentional Threats
• Threats that are caused by ignorance• a user or a system administrator poorly trained• someone who hadn’t read the system documentation & manuals• someone who hadn’t understood the importance of security rules
• damage is caused by ignorance
these slides are based on USP slides from Cintia B. Margi and Prof. Wilson V. Ruggiero
VA Course© AZ 2004upd LM 2007
01/11/2007
Intentional Threats
• Security products are designed to prevent intentional threats those are the ones that make news
• Two types of adversaries: internal and external• external villains include:
criminalshackersterroristsother enterprises
these slides are based on USP slides from Cintia B. Margi and Prof. Wilson V. Ruggiero
VA Course© AZ 2004upd LM 2007
01/11/2007
Intentional Threats
• External villains can try to have access to a system by:• breaking in, forging ID cards, through networks or even bribery
and/or coercion of internal staff
• The focus of security tools is usually external villains, but a great part of security problems is due to internal villains
“the enemy is already inside - and we hired them!”
these slides are based on USP slides from Cintia B. Margi and Prof. Wilson V. Ruggiero
VA Course© AZ 2004upd LM 2007
01/11/2007
Impact groups
VA Course© AZ 2004upd LM 2007
01/11/2007
People
Organization
Information security – Layer model
Technology
Physical
Information
VA Course© AZ 2004upd LM 2007
01/11/2007
Some Countermeasures
• Security techniques• Cryptography• Firewalls
• Software mechanisms• Secure development• Operating system protection• Internal program mechanism
• Hardware mechanisms
VA Course© AZ 2004upd LM 2007
01/11/2007
Countermeasures
• Management Activities• Rules and Routines for Awareness• Policy• Security Management
• Physical Security
VA Course© AZ 2004upd LM 2007
01/11/2007
Malicious Who?
• Misbehaving Users• mostly unintentional damage – out of curiosity
• Amateurs• reading about computer abuse and want to experience
• Hackers• proving that it is possible and earning popularity/acceptance• usually divided into Black Hats and White Hats
• Criminals• earn money with computer abuse (theft, espionage, ...)
worse
likelihood
VA Course© AZ 2004upd LM 2007
01/11/2007
Method, Opportunity, Motivewhat must a malicious attacker have?
• Method:• means to conduct the attack – skills, knowledge, tools ...
• Opportunity:• time and access to accomplish the attack
• Motive:• a reason to do it
VA Course© AZ 2004upd LM 2007
01/11/2007
Stakeholder• Regular Users
– They want to use the system• IT Staff & Security Manager
– They want to supply a working system• Business Manager
– They want productivity because of IT use• Asset Owner
– Their resources are in danger or they want to earn money• Public bodies
– Want orderly behavior and a prospering economy• ...
VA Course© AZ 2004upd LM 2007
01/11/2007
Remark
”Information Security is a parasit on the profits”Gerald Kovachic
• Information Security is– a business enabler – it can be sold or enalbes the business– an insurance – resources under risk and downtime means not
realized profit
VA Course© AZ 2004upd LM 2007
01/11/2007
Questions ?