Computer Security Mike Asoodeh & Ray Dejean Office of Technology Southeastern Louisiana University

Security is a critical area of any information system, and the question is not ‘is the information system vulnerable?’ but ‘how vulnerable is it?’.

Security Realities  Impenetrable security doesn’t exist  Too many facts, not enough information  Human-made environment

Facts  Recent attacks on seemingly "secure" sites such as The White House, DOD, FBI and Microsoft.com have proven that despite massive public and private investment in cyber defense technology and methodology, hackers continue to pose a serious threat to the "information infrastructure."

Facts  These days invasions are experienced directly (perhaps for the first time) by the growing masses of casual web surfers. Personal protection techniques available: –What you know –What you have –What you are

Facts  Computer related attacks double annually Viruses, Hoax and inviting s, Chain letters (spam)  68% acknowledge financial loss  90% not reported  74% used internet connection as POA

Classical Security Model  Isolated islands behind protective barriers  Security management was mainly access control administration of limited numbers of system users (a.k.a. Employees)

Traditional Access Points

eBusiness Model  Open to partners  Open to customers  Open to hackers, thieves, malicious code

New Access Points

A Systemic Approach to Security  Identification of the risks to the environment and business  Development of a security policy that is consistent with business objectives and requirements  Translation of policy into practice through technology and operational Best Practices  Business continuity Plan  Properly trained and trustworthy staff

New Security Considerations Internet / Intranet Attacks  Vandalism/hacktivism  Denial of service  Virus and other malicious code infection  Information theft  Intrusion  Exploitation of assets

New Security Considerations Trust  Identity of partners  Identity of customers  Identity of employees

New Security Considerations Privacy and protection of identity  prevent data interception and data spoofing with a Policy Based Access Control –Who can access data? –Who can invoke service? –Who can impact system? –Are our Assets protected?