CIT 380: Securing Computer SystemsSlide #1 CIT 380: Securing Computer Systems Introduction

CIT 380: Securing Computer SystemsSlide #2 CIT 380 within the Curriculum CIT 140CIT 370 CIT 380 Security CIT 484 Network Security CIT 430 Forensics

Information Security Today External Threats Internal Threats Regulations Customer expectations CIT 380: Securing Computer SystemsSlide #3

Misconceptions Hindrance to the smooth operations of the business Expensive – with little benefit Impossible to achieve Fine as long as we have a firewall CIT 380: Securing Computer SystemsSlide #4

Reality Supports and aligns with the business Proactive rather than reactive Solutions-based not just fear-mongering Cost-benefit based –Reduce financial and legal impact of an attack CIT 380: Securing Computer SystemsSlide #5

CIA Triad CIT 380: Securing Computer SystemsSlide #6

Confidentiality Protecting the secrecy and privacy of information. Trade secrets Personally Identifiable Information Wikileaks CIT 380: Securing Computer SystemsSlide #7

Data Breaches Wal-Mart Ohio State University CIT 380: Securing Computer SystemsSlide #8

Integrity Protecting the accuracy of information processing or data from improper modification. Ensuring data is processed correctly Data is not intentionally or accidentally corrupted CIT 380: Securing Computer SystemsSlide #9

CIT 380: Securing Computer SystemsSlide #10 Integrity 2005 Walmart $1.5 million bar code scam. – Stung-in-15-Million-BarCode-Scam/ Stung-in-15-Million-BarCode-Scam/

Availability Ensuring the systems and data can be accessed when required. Opposite of destruction or accidental deletion. Impacted by human error, hardware failures, software bugs, malicious code CIT 380: Securing Computer SystemsSlide #11

CIT 380: Securing Computer SystemsSlide #12 Availability Prevent loss of system access. Denial of service (DoS) attacks common. –Easy to launch, difficult to track down. –Can be just part of another attack

CIT 380: Securing Computer SystemsSlide #13 NSTISSC Security Model

CIT 380: Securing Computer SystemsSlide #14 States of Information 1.Storage Information not currently being accessed. 2.Processing Information currently being used by processor. 3.Transmission Information in transit btw one node and another.

CIT 380: Securing Computer SystemsSlide #15 Security Measures Technology. –Hardware/software used to ensure confidentiality, integrity, or availability. Policy and practice. –Security requirements and activities. Education, training, and awareness. –Understanding of threats and vulnerabilities and how to protect against them.

CIT 380: Securing Computer SystemsSlide #16 What is Security? Security is the prevention of certain types of intentional actions from occuring in a system. –These potential actions are threats. –Threats that are carried out are attacks. –Intentional attacks are carried out by an attacker. –Objects of attacks are assets.

CIT 380: Securing Computer SystemsSlide #17 Goals of Security Prevention –Prevent attackers from violating security policy Detection –Detect attackers’ violation of security policy Recovery –Stop attack, assess and repair damage Survivability –Continue to function correctly even if attack succeeds

Discussion: Medical Records Are these important? –Confidentiality –Integrity –Availability Cost versus Benefit –Cost in money and inconvenience Technology, Policy, Education Solutions CIT 380: Securing Computer SystemsSlide #18

Discussion: Stolen Credit Card What can a merchant do to detect that a card is stolen? What are the cost to the merchant? CIT 380: Securing Computer SystemsSlide #19