© G. Dhillon Principles of IS Security Security of Technical Systems in Organizations – an introduction

© G. Dhillon Preamble “….perpetrators don’t have the values assumed by the technologists. They generally stick to the easiest, safest, simplest means to accomplishing their objectives….”[Parker, 1991].

© G. Dhillon Vulnerabilities - 1 Modification When data held in computer systems is accessed in an unauthorized manner and is changed without requisite permissions Destruction When the hardware, software or the data is destroyed because of malicious intent Disclosure When data is made available or access to a software is made available without due consent of the individual responsible of the data or software

© G. Dhillon Vulnerabilities - 2 Interception When an unauthorized person or software gains access to data or computer resources Interruption When a computer system becomes unavailable for use Fabrication When spurious transactions are inserted into a network or records added to an existing database

© G. Dhillon Vulnerability of Computing Resources Computing resourceType of Vulnerability HardwareDestruction; Interception; Interruption SoftwareModification; Interception; Interruption DataDestruction; Interception; Interruption; Fabrication; Modification; Disclosure

© G. Dhillon Data Security Requirements Confidentiality: this requirement ensures privacy of data Integrity: this requirement ensures that data and programs are changed in an authorized manner Availability: this requirement ensures proper functioning of all systems such that there is no denial of service to authorized users Authentication - assures that the message is from a source it claims to be from Non repudiation - prevents an individual or entity from denying having performed a particular action related to data

© G. Dhillon The Confidentiality Attribute DataSoftware ConfidentialityA set of rules to determine if a subject has access to and object Limited access to code Kinds of controlsLabels, encryption, discretionary and mandatory access control, reuse prevention Copyright, patents, labels, physical access control locks Possible lossesDisclosure, inference, espionage Piracy, trade secret loss, espionage

© G. Dhillon The Integrity Attribute DataSoftware IntegrityUnimpaired, complete, whole, correct Unimpaired, everything present and in an ordered manner Kinds of controlsHash totals, check bits, sequence number checks, missing data checks Hash totals, pedigree checks, escrow, vendor assurance sequencing Possible lossesLarceny, fraud, concatenation Theft, fraud, concatenation

© G. Dhillon The Availability Attribute DataSoftware AvailabilityPresent and accessible when and where needed Usable and accessible when and where needed Kinds of controlsRedundancy, back up, recovery plan, statistical pattern recognition Escrow, redundancy, back up, recovery plan Possible lossesDenial of service, failure to provide, sabotage, larceny Larceny, failure to act, interference

© G. Dhillon The Authentication Attribute DataSoftware AuthenticationGenuine. Accepted as conforming to a fact Genuine. Unquestioned origin Kinds of controlsAudit log, verification validation Vendor assurances, pedigree documentation. Hash totals, maintenance log. Serial checks Possible lossesReplacement, false data entry, failure to act, repudiation, deception, misrepresentation Piracy, misrepresentation, replacement, fraud

© G. Dhillon The Non Repudiation Attribute DataSoftware Non repudiationGenuine, true and authentic communication Genuine. True Kinds of controlsAuthentication, validation checks Integrity controls, non modification controls Possible lossesMonetary, loss of identity, disclosure of private information Vulnerability of software code, fraud, misconstrued software

© G. Dhillon Methods of Defense Encryption Software Controls Software Development Controls Operating system controls Program controls Physical Controls

© G. Dhillon Summary CIA + Authentication + Non Repudiation The Principles The principle of easiest penetration The principle of timeliness The principle if effectiveness