By the end of the lesson you should be able to:
Data Security refers to the process of protecting computer hardware, software, and communication systems against unauthorized access, destruction, or even modification
Control refers to procedure, action, device, or technique that reduces or eliminates the vulnerability of an information system
Data Security Principles
These are also known as information security triads. They include Confidentiality, Integrity, and Availability.
Confidentiality refers to the ability of a system to ensure that the information system is only accessed or disclosed to authorized parties.
Integrity ability of a system to ensure that can only be modified or altered by authorized parties
Availability ability of a system to ensure that information system assets are usable by and accessible to all authorized parties
Other Pillars of Data Security
Security Threats and Control Measures
A threat refers to a set of circumstances that has the potential to cause loss or harm to information or information system gadgets. Threats mostly exploit a vulnerability (weakness) in an information system. Vulnerability is a weakness in the system.
Threats from System Failure
Threats from Malicious Programs
By the end of the lesson you should be able to:
Control Measures against Hardware Failure
Threats from malicious programs
Common types of malicious programs include:
Control measures against malicious programs
Computer Network Security
Understanding Network Security
What is network security
Before we talk about network security, we need to understand in general terms what security is. Security is a continuous process of protecting an object from attack. That object may be a person, an organization such as a business, or property such as a computer system or a file. When we consider a computer system, for example, its security involves the security of all its resources such as its physical hardware components such as readers, printers, the CPU, the monitors, and others. In addition to its physical resources, it also stores non-physical resources such as data and information that need to be protected.
In a distributed computer system such as a network, the protection covers physical and non-physical resources that make up the network including communication channels and connectors like modems, bridges, switches, and servers, as well as the files stored on those servers. In each one of these cases, therefore, security means preventing unauthorized access, use, alteration, and theft or physical damage to these resources. Security as defined thus involves the following three elements:
1. Confidentiality: to prevent unauthorized disclosure of information to third parties. This includes the disclosure of information about resources.
2. Integrity: to prevent unauthorized modification of resources and maintain the status quo. It includes the integrity of system resources, information, and personnel. The alteration of resources like information may be caused by a desire for personal gain or a need for revenge.
3. Availability: to prevent unauthorized withholding of system resources from those who need them when they need them.
Two types of security
A facility is physically secure if it is surrounded by a barrier like a fence, has secure areas both inside and outside, and can resist penetration by intruders. Physical security can be guaranteed if the following four mechanisms are in place: deterrence, prevention, detection, and response
Is usually the first line of defense against intruders who may try to gain access. It works by creating an atmosphere intended to frighten intruders. Sometimes this may involve warnings of severe consequences if security is breached.
Is the process of trying to stop intruders from gaining access to the resources of the system. Barriers include firewalls, DMZs, and use of access items like keys, access cards, biometrics, and others to allow only authorized users to use and access a facility.
Occurs when the intruder has succeeded or is in the process of gaining access to the system. Signals from the detection process include alerts to the existence of an intruder. Sometimes these alerts can be real time or stored for further analysis by the security personnel.
Is an aftereffect mechanism that tries to respond to the failure of the first three mechanisms. It works by trying to stop and/or prevent future damage or access to a facility.
The areas outside the protected system can be secured by wire and wall fencing, mounted noise or vibration sensors, security lighting, close circuit television (CCTV), buried seismic sensors, or different photoelectric and microwave systems [I]. Inside the system, security can be enhanced by use electronic barriers such as firewalls and passwords.
A firewall is hardware or software used to isolate the sensitive portions of an information system. facility from the outside world and limit the potential damage that can be done by a malicious intruder.
Types of firewalls
These are packet-level filters. They contain gates that allow packets to pass through if they satisfy a minimum set of conditions, and choke or prevent those packets that do not meet the entry conditions. The minimum conditions may require packets to have permissible origin or destination addresses, as determined by the network administrator
With proxy servers, clients direct their requests for the application and the Internet connection through the server. If individual client requests conform to the pre-set conditions, then the firewall will act on the request; otherwise it is dropped. These firewalls require specialized client and server configurations depending on the application.
These firewalls combine the filter and proxy functionalities. Because of this, they are considered complex and more advanced. The conditions for a stateful inspection are, like the filter, based on a set of rules. But unlike filters, these rules are not based on TCP or UDP but on applications like proxy servers. They filter packets by comparing their data with archived friendly packets.
A password is a string of usually six to eight characters, with restrictions on length and start character, to verify a user to an information system facility, usually a computer system. Password security greatly depends on the password owner observing all of these four cardinal rules:
Password security is not only important to individuals whose files are stored on a system, but it is also vital to the system as a whole because once an intruder gains access to one password, he or she has gained access to the whole system, making all its files vulnerable.
This is virtual security in the sense that it is not physically implemented like building walls, issuing passwords, or putting up a firewall, but it is effectively based solely on a philosophy. The philosophy itself relies on a need to know basis, implying that a person is not dangerous as long as that person doesn't have knowledge that could affect the security of the system like a network, for example. In real systems where this security philosophy is used, security is assured through a presumption that only those with responsibility and who are trustworthy can use the system and nobody else needs to know. So in effect the philosophy is based on trust of those involved assuming that they will never leave. If they do, then that means the end of security for that system. There are several examples where ST0 has been successfully used.
These include Coca-Cola, KFC, and other companies that have, for generations, kept their secret recipes secure based on a few trusted employees.
What do we mean when we say that a resource or a system is secure? A resource is secure, based on the above definition, if that resource is protected from both internal and external unauthorized access. Similarly, system resources are secure when they are all protected from unauthorized access. These resources, physical or not, are objects. Ensuring security of an object, thus means protecting that object from unauthorized access both from within the object and externally. In short, we protect objects. System objects are either tangible or non-tangible. If we focus on computer system security in general and on network security in particular, the tangible objects are the hardware resources in the system and the intangible object is the information and data in the system, both in transition and static in storage.
Protecting hardware resources include protecting: End user objects that includes the user interface hardware components such as all client system input components including a keyboard, the mouse, touch screen, light pens, and others.
Network objects like firewalls, hubs, switches, routers and gateways which are vulnerable to hackers. Network communication channels to prevent eavesdroppers from intercepting network communications.
Protecting software resources includes protecting hardware-based software, operating systems, server protocols, browsers, application software, and intellectual property stored on network storage disks and databases. It also involves protecting client software such as investment portfolios, financial data, real estate records, images or pictures, and other personal files commonly stored on home and business computers.
2.3 Security Services
We have defined security, and in particular system security, as a process of preventing unauthorized access to the system resources. Such prevention of unauthorized access to system resources is achieved through a number of security services that include access control, authentication, confidentiality, integrity, and non-repudiation.
2.3.1 Access Control
This is a service the system uses, together with a user pre-provided identification information such as a password, to determine who uses what of its services.
Hardware Access Control Systems
Rapid advances in technology have resulted in efficient access control tools that are open and flexible while at the same time ensuring reasonable precautions against risks. Access control tools falling in this category include:
Software Access Control Systems
Software access control falls into two types: point of access monitoring and remote monitoring. In point of access (POA), personal activities can be monitored by a PC-based application. The application can even be connected to a network or to a designated machine or machines. The application collects and stores access events and other events connected to the system operation and downloads access rights to access terminals.
In remote mode, the terminals can be linked in a variety of ways including the use of modems, telephone lines, and all forms of wireless connections. Such terminals may, sometimes if needed, have an automatic calling at pre-set times if desired or have an attendant to report regularly.
Authentication is a service used to identify a user. User identity, especially of remote users, is difficult because many users, especially those intending to cause harm, may masquerade as the legitimate users when they actually are not. This service provides a system with the capability to verify that a user is the very one he or she claims to be based on what the user is, knows, and has.
Thus authentication is a process whereby the system gathers and builds up information about the user to ensure that the user is genuine. In data communication, authentication is also used to verify the identity of the sender and the integrity of the message. In computer systems, authentication protocols based on cryptography use either secret-key or public-key schemes to create an encrypted message digest that is appended to a document as a digital signature.
Physically we can authenticate of users or user surrogates based on checking one or more of the following user items;
The confidentiality service protects system data and information from unauthorized disclosure. When data leave one extreme of a system such as a client's computer in a network, it ventures out into a non-trusting environment. So the recipient of that data may not fully trust that no third party like a cryptanalysis or a man-in-the middle has eavesdropped on the data. This service uses encryption algorithms to ensure that nothing of the sort happened while the data was in the wild. Encryption protects the communications channel from sniffers.
Sniffers are programs written for and installed on the communication channels to eavesdrop on network traffic, examining all traffic on selected network segments. Sniffers are easy to write and install and difficult to detect.
The encryption process uses an encryption algorithm and key to transform data at the source, called plaintext; turn it into an encrypted form called cipher-text, usually unintelligible form; and finally recover it at the sink
The integrity service protects data against active threats such as those that may alter it. Just like data confidentiality, data in transition between the sending and receiving parties is susceptible to many threats from hackers, eavesdroppers, and cryptanalysts whose goal is to
intercept the data and alter it based on their motives.
This service, through encryption and hashing algorithms, ensures that the integrity of the transient data is intact.
This is a security service that provides proof of origin and delivery of service and/or information. In real life, it is possible that the sender may deny the ownership of the exchanged digital data that originated from him or her. This service, through digital signature and encryption algorithms, ensures that digital data may not be repudiated by providing proof of origin difficult to deny. A digital signature is a cryptographic mechanism that is the electronic equivalent of a written signature to authenticate a piece of data as to the identity of the sender.
Because security solutions come in many different types and use different technologies, security standards are used to bring about interoperability and uniformity among the many system resources with differing technologies within the system and between systems. System
managers, security chiefs, and experts choose or prefer standards, if no de facto standard exists, that are based on service, industry, size, or mission. The type of service an organization is offering determines the types of security standards used. Like service, the nature of the industry an organization is in also determines the types of services offered by the system, which in turn determines the type of standards to adopt. The size of an organization also determines what type of standards to adopt. In relatively small establishments, the ease of implementation and running of the system influence the standards to be adopted.
Finally, the mission of the establishment also determines the types of standards used. For example, government agencies have a mission that differs from that of a university. These two organizations, therefore, may choose different standards. Here are the bodies and organizations behind the formulation, development, and maintenance of these standards. These bodies fall into the following categories:
International organizations such as the Internet
BEST PRACTICES IN SECURITY
To keep abreast of all changes of network insecurity, security experts and security managers must know how and what to protect and what controls to put in place and at what time. It takes security management, planning, policy development, and the design of procedures. Here are some examples of best practices;
Developed by the CASPR Project, this effort aims to provide a set of best practices that can be universally applied to any organization regardless of industry, size or mission. Such best practices would, for example, come from the world's experts in information security. CASPR distills the knowledge into a series of papers, and publishes them so they are freely available on the Internet to everyone.
The project covers a wide area including operating system and system security, network and telecommunication security, access control and authentication, info-security management, info-security auditing and assessment, info-security logging and monitoring, application security, application and system development, and investigations and forensics.
Developed by IT auditors and made available through the Information Systems Audit and Control Association, COBIT provides a framework for assessing a security program. COBIT is an open standard for control of information technology. COBIT was designed to help three distinct audiences;
Is an approach for self-directed information security risk evaluations that :
In short, it provides measures based on accepted best practices for evaluating security programs. It does this in three phases:
ELEMENTS OF SECURITY
We will conclude this chapter on security by discussing those fundamental elements that someone interested in the security of a computer system or a network may find valuable. One may decide to take all of them or a combination of some of them. Remember we have been saying that there is no perfect security, and security of individual computer systems or a network is based on the needs of that system. So the choice of which of these elements to use depends entirely on the needs of the enterprise that owns the computer system or network.
The Security Policy
There are many and varied views on the necessity of a security plan. Some security experts do not consider it essential while others do. However, it is an important element in the security environment of an enterprise. The security plan emphasizes a number of factors starting with the identification of all critical operations in the system that must be secured, those that are needed, but not critical to daily operations, and those operations that can be secured.
Second it prioritizes the system resources and the information stored on each. The security policy also assigns risk factors to all these classified resources. Once the risk factors are assigned to each resource, a list of acceptable security measures for each resource is drawn. It further categorizes the activities of the computer system or network as acceptable and unacceptable. A security plan must also focus on the people using the system by dividing them into two groups, those on the security team and the users. For each group appropriate education on security must be enforced, emphasizing what constitutes security and what needs to be done in case of a security breach. There are different aspects of a security plan and varying depths of what must be included depending on the needs of the enterprise.
As information becomes more valuable and more people join the ever growing Internet, scavenger hunters, hackers, activists, robbers, and all sorts of people will continue to flock onto the Internet and the security of information of a society increasingly dependent on computer networks will become vital. The importance of this security element, therefore, cannot be over emphasized. Security experts approach access control based on a variety of techniques including access control list, a list that identifies individual users and groups associated with each object in the database and the rights that the user or group has when accessing that object, and the execution control list, which consists of the resources and actions that a program can access/perform while it is executing and determines which program activities are appropriate and which are not.
Strong Encryption Algorithms
The amount of information stored and traversing the computer systems and networks has been increasing both in volume and value as networks expand. The security of that information, however, has become increasingly threatened by the quality and security of the software running on these machines as we have already pointed out and also by the sheer determination and number of hackers trying to access that information. Research has shown a high volume of vulnerabilities in the network infrastructure and embarrassingly poor protocols. Hackers are exploiting these software bugs, which are sometimes easy to fix, eavesdropping and intercepting communication data with increasing ease. The security of information, therefore, rests with finding strong encryption algorithms that will thwart would be intruders
Many people have rightly put it that the future of e-commerce is riding on strong encryption and authentication techniques. As more and more people go online to buy and sell their wares, they need strong and trustworthy algorithms that will make such transactions safe.
The purpose of auditing is to find as many problems as possible in the system before the intruders find them for you. The wisdom of testing is that the better and more you test, the more difficult your network will be to attack. An audit keeps you aware and honest about the security of the system so that you discard the myth that if it is not broken into it is secure. Also if done by an outsider, an audit however poor it is, gives you a standard to measure your security needs. Finally, an audit done by an outsider gives a comparison of the types of problems you have as compared to those in other institutions where the auditor has been.
There are two types of auditing: active and passive.
Active auditing involves actively responding to illicit access and intrusion and in between these intrusions; passive, on the other hand, is not a real-time mechanism. It depends on someone to review the logs and then act upon the information they contain.