1 IS 2150 / TEL 2810 Information Security and Privacy James Joshi Associate Professor, SIS Introduction Aug 28, 2013.

Slides:



Advertisements
Similar presentations
Cryptography and Network Security 2 nd Edition by William Stallings Note: Lecture slides by Lawrie Brown and Henric Johnson, Modified by Andrew Yang.
Advertisements

September 10, 2012Introduction to Computer Security ©2004 Matt Bishop Slide #1-1 Chapter 1: Introduction Components of computer security Threats Policies.
Chap 1: Overview Concepts of CIA: confidentiality, integrity, and availability Confidentiality: concealment of information –The need arises from sensitive.
Lecture 1: Overview modified from slides of Lawrie Brown.
EEC 688/788 Secure and Dependable Computing Lecture 2 Wenbing Zhao Department of Electrical and Computer Engineering Cleveland State University
IT 221: Introduction to Information Security Principles Lecture 1: Introduction to IT Security For Educational Purposes Only Revised: August 28, 2002.
Security Controls – What Works
1 Overview CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute March 8, 2004.
Chapter 1 – Introduction
1 Cryptography and Network Security Third Edition by William Stallings Lecturer: Dr. Saleem Al_Zoubi.
Client/Server Computing Model of computing in which very powerful personal computers (clients) are connected in a network with one or more server computers.
22 November Security and Privacy  Security: the protection of data, networks and computing power  Privacy: complying with a person's desires when.
1 An Overview of Computer Security computer security.
Chapter 1: Introduction Components of computer security Threats Policies and mechanisms The role of trust Assurance Operational Issues Human Issues Computer.
1 IS 2150 / TEL 2810 Introduction to Security James Joshi Assistant Professor, SIS Lecture 1 August 30, 2007.
1 IS 2150 / TEL 2810 Introduction to Security Lecture 1 August 31, 2006.
July 1, 2004Computer Security: Art and Science © Matt Bishop Slide #1-1 Chapter 1: Introduction Components of computer security Threats Policies.
Stephen S. Yau CSE465 & CSE591, Fall Information Assurance (IA) & Security Overview Concepts Security principles & strategies Techniques Guidelines,
April 1, 2004ECS 235Slide #1 Chapter 1: Introduction Components of computer security Threats Policies and mechanisms The role of trust Assurance Operational.
Introduction (Pendahuluan)  Information Security.
Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown.
Developing Secure Systems Introduction Jan 8, 2013 James Joshi, Associate Professor.
1 CSE 651: Introduction to Network Security Steve Lai Spring 2010.
Topics in Information Security Prof. JoAnne Holliday Santa Clara University.
An Introduction to Information Assurance COEN 150 Spring 2007.
1 Cryptography and Network Security Fourth Edition by William Stallings Lecture slides by Lawrie Brown Changed by: Somesh Jha [Lecture 1]
A First Course in Information Security
SEC835 Database and Web application security Information Security Architecture.
IS 2150 / TEL 2810 Introduction to Security
Cryptography and Network Security
Information Security Rabie A. Ramadan GUC, Cairo Room C Lecture 2.
CS526: Information Security Chris Clifton August 26, 2003 Course Overview Portions of the material courtesy Professor Matt Bishop.
CSCE 727 Information Warfare
Center of Excellence for IT at Bellevue College. Cyber security and information assurance refer to measures for protecting computer systems, networks,
@Yuan Xue CS 285 Network Security Fall 2008.
Sample Security Model. Security Model Secure: Identity management & Authentication Filtering and Stateful Inspection Encryption and VPN’s Monitor: Intrusion.
Cryptography, Authentication and Digital Signatures
Chapter 1 Overview The NIST Computer Security Handbook defines the term Computer Security as:
IT Strategy for Business © Oxford University Press 2008 All rights reserved Chapter 12 IT Security Strategies.
. 1. Computer Security Concepts 2. The OSI Security Architecture 3. Security Attacks 4. Security Services 5. Security Mechanisms 6. A Model for Network.
SECURITY Professor Mona Mursi. ENVIRONMENT IT infrastructures are made up of many components, abstractly: IT infrastructures are made up of many components,
Lecture slides prepared for “Computer Security: Principles and Practice”, 3/e, by William Stallings and Lawrie Brown, Chapter 1 “Overview”. © 2016 Pearson.
Csci5233 computer security & integrity 1 An Overview of Computer Security.
12/18/20151 Computer Security Introduction. 12/18/20152 Basic Components 1.Confidentiality: Concealment of information (prevent unauthorized disclosure.
Introduction and Overview of Information Security and Policy By: Hashem Alaidaros 4/10/2015 Lecture 1 IS 332.
1 Network Security: Introduction Behzad Akbari Fall 2009 In the Name of the Most High.
E-Commerce E-Commerce Security?? Instructor: Safaa S.Y. Dalloul E-Business Level Try to be the Best.
July 1, 2004Computer Security: Art and Science © Matt Bishop Slide #1-1 Chapter 1: Introduction Components of computer security Threats Policies.
1 IS 2150 / TEL 2810 Information Security and Privacy James Joshi Associate Professor, SIS Lecture 1 Jan 16, 2013.
November 1, 2004Introduction to Computer Security ©2004 Matt Bishop Slide #1-1 Chapter 1: Introduction Components of computer security Threats Policies.
1 Network Security Maaz bin ahmad.. 2 Outline Attacks, services and mechanisms Security attacks Security services Security Mechanisms A model for Internetwork.
@Yuan Xue CS 285 Network Security Fall 2013 Yuan Xue.
@Yuan Xue CS 285 Network Security Fall 2012 Yuan Xue.
Advanced System Security Dr. Wayne Summers Department of Computer Science Columbus State University
Computer Security Introduction
CS457 Introduction to Information Security Systems
CS 395: Topics in Computer Security
Information Security, Theory and Practice.
Chapter 1: Introduction
Secure Software Confidentiality Integrity Data Security Authentication
Data & Network Security
Chapter 1: Introduction
INFORMATION SYSTEMS SECURITY and CONTROL
An Overview of Computer Security
Information Security: Terminology
Computer Security Introduction
Security.
Chapter 1: Introduction
Unit # 1: Overview of the Course Dr. Bhavani Thuraisingham
Overview CSE 365 – Information Assurance Fall 2019 Adam Doupé
Presentation transcript:

1 IS 2150 / TEL 2810 Information Security and Privacy James Joshi Associate Professor, SIS Introduction Aug 28, 2013

2 Contact Instructor: James B. D. Joshi 706A, IS Building Phone: Web: Office Hours: By appointments GSA: Nathalie Baracaldo Tuesdays:10-12AM LERSAIS Room

3 Course Goals to develop a broader understanding of the information security field, Recognize, analyze and evaluate security problems and challenges in networks and systems. Apply their knowledge to synthesize possible approaches to solve the problems in an integrated way. Analyze and evaluate the fundamentals of security policy models and mechanisms, and their need for different types of information systems and applications Apply the basics of Cryptographic techniques and network security for ensuring the basic security goals of security of information systems. Recognize the various security issues/terminologies related to software, networks and applications to show how they are interrelated and available techniques and approaches to solve/tackle security problems. Describe/identify the various basic social, legal and non-technical dimensions of security and its relation to technical counterparts.

4 Certified for IA Standards SAIS Track is certified for 5 CNSS standards 85% of content address the requirements of the first three CNSS standards Hence CORE course for SAIS track Course webpage:

5 Course Outline Basic Cryptography and Network security Crypto systems, digital signature, authentication, PKI IPSec, VPN, Firewalls Security/Privacy Basics General overview and definitions Security models and policy issues Privacy Systems Design Issues and Information assurance Design principles; Security Mechanisms; Auditing Systems; Risk analysis; System verification Intrusion Detection and Response Attack Classification and Vulnerability Analysis Detection, Containment and Response/Recovery Legal, Ethical, Social Issues Evaluation, Certification Standards Miscellaneous Issues Malicious code Security in cloud, social networks, BigData

6 Course Material Textbook Introduction to Computer Security, Matt Bishop, Errata URL: Computer Security: Art and Science, Matt Bishop – is fine too Other Recommended Security in Computing, Charles P. Pfleeger, Prentice Hall Inside Java 2 Platform Security, 2 nd Edition, L. Gong, G. Ellision, M. Dageforde Security Engineering: A Guide to Building Dependable Distributed Systems, Ross Anderson, Wiley, John & Sons, Incorporated, 2001 (newer version) Practical Unix and Internet Security, Simon Garfinkel and Gene Spafford Additional readings will be provided Required or Optional

7 Prerequisites Assumes the following background Programming skill Some assignments in Java Working knowledge of Operating systems, algorithms and data structures, database systems, and networks Basic Mathematics Set, logic, induction techniques, data structure/algorithms Not sure? SEE ME

8 Grading Assignments (55%) Homework/paper review: 35% Labs and quizzes:20% Programming project 15% Exams (30%) includes Midterm: 15% Final: 15% Other Seminar (LERSAIS) and/or participation

9 Course Policies Your work MUST be your own Zero tolerance for cheating/plagiarism You get an F for the course if you cheat in anything however small – NO DISCUSSION Discussing the problem is encouraged Homework Penalty for late assignments (15% each day) Seek extension under pressing circumstances Ensure clarity in your answers – no credit will be given for vague answers Sample solutions will be provided Check webpage for everything! You are responsible for checking the webpage for updates

10 LERSAIS

11 LERSAIS Laboratory of Education and Research in Security Assured Information Systems Established in 2003 National Center of Academic Excellence in Information Assurance Education - Research Program A US National Security Agency program initiated in 1998 through a presidential directive to SECURE the Cyberspace Partnered by Department of Homeland Security since 2003 LERSAIS is Pitt’s representative center Website: Check out for Friday Seminars:

12 A Word on SAIS Track Pitt’s IA curriculum has been certified for Committee on National Security Systems IA Standards CNSS 4011: Information Security Professionals CNSS 4012: Designated Approving Authority CNSS 4013: System Administrator in Information Systems Security CNSS 4014: Information Systems Security Officer CNSS 4015: System Certifiers Pitt is one among few Institutions in the US and one of two in the State of Pennsylvania to have five certifications One of the first group of schools to be designated as CAE-Research

13 What is Information Security? Overview of Computer Security

14 Information Systems Security Deals with Security of (end) systems Examples: Operating system, files in a host, records, databases, accounting information, logs, etc. Security of information in transit over a network Examples: e-commerce transactions, online banking, confidential s, file transfers, record transfers, authorization messages, etc. “Using encryption on the internet is the equivalent of arranging an armored car to deliver credit card information from someone living in a cardboard box to someone living on a park bench” – Gene Spafford

15 Basic Components of Security Confidentiality Keeping data and resources secret or hidden Conceal existence of data Integrity Refers to correctness and trustworthiness Ensuring authorized modifications; May refer to Data integrity Origin integrity (Authentication) Availability Ensuring authorized access to data and resources when desired Often assume a statistical model for pattern of use – which can be distorted Trust Management (Emerging Challenge) Trust Management (Emerging Challenge) CIA Prevention Detection Prevention Detection

16 CIA-based Model NSTISSC 4011 Security Model (CNSS 4011)

17 Basic Components of Security Additional from NIST (National Institute of Standards and Technology Accountability Ensuring that an entity’s action is traceable uniquely to that entity [Security] assurance Assurance that all four objectives are met Other Non-repudiation: false denial of an act

18 Interdependencies confidentiality Integrity integrity confidentiality availability Integrity confidentiality accountability Integrity confidentiality

Information security today Financial losses (FEW YEARS back) The FBI estimates that an insider attack results in an average loss of $2.8 million Reports indicate annual financial loss due to information security breaches of $ billion More recent Sony’s estimiate: $170M from hacks on Playstation network (77 M accounts compromized) Citibank – 360K bank card users The cost of global cybercrime, at $114 billion annually, is significantly more than the annual global market for marijuana, cocaine and heroin combined 19

20 Information security today National defense Cybersecurity "was the single core capability where states had made the least amount of overall progress," U.S. Computer Emergency Readiness Team (US-CERT) reported an over 650-percent increase in the number of cyber incidents reported by federal agencies over a 5 year period

21 Terminology Security Features or Services Security Features or Services Attackers/Intruders/ Malfeasors Security Architecture Resources Assets Information Requirements Policies Requirements Policies Requirements Policies Requirements Policies Security Models/ Mechanisms Security Models/ Mechanisms

22 Attack Vs Threat A threat is a “potential” violation of security The violation need not actually occur The fact that the violation might occur makes it a threat It is important to guard against threats and be prepared for the actual violation The actual violation of security is called an attack

23 Common security threats/attacks Interruption, delay, denial of service System assets or information become unavailable or are rendered unavailable Interception or snooping Unauthorized party gains access to information by browsing through files or reading communications Modification or alteration Unauthorized party changes information in transit or information stored for subsequent access Fabrication, masquerade, or spoofing Spurious information is inserted into the system or network by making it appear as if it is from a legitimate entity Repudiation of origin False denial that an entity did (send/create) something

24 Classes of Threats (Shirley) Disclosure: unauthorized access to information Snooping Deception: acceptance of false data Modification, masquerading/spoofing, repudiation of origin, denial of receipt Disruption: interruption/prevention of correct operation Modification Usurpation: unauthorized control of a system component Modification, masquerading/spoofing, delay, denial of service

25 Policies and Mechanisms A security policy states what is, and is not, allowed This defines “security” for the site/system/etc. Policy definition: Informal? Formal? Mechanisms enforce policies Composition of policies If policies conflict, discrepancies may create security vulnerabilities

26 Goals of Security Prevention To prevent someone from violating a security policy Detection To detect activities in violation of a security policy Verify the efficacy of the prevention mechanism (Response &) Recovery Stop policy violations (attacks) Assess and repair damage Ensure availability in presence of an ongoing attack Fix vulnerabilities for preventing future attack Retaliation against the attacker

27 Assumptions and Trust Policies and mechanisms have implicit assumptions Assumptions regarding policies Unambiguously partition system states into “secure” and “nonsecure” states Correctly capture security requirements Mechanisms Assumed to enforce policy; i.e., ensure that the system does not enter “nonsecure” state Support mechanisms work correctly

28 Types of Mechanisms Let P be the set of all the reachable states Let Q be a set of secure states identified by a policy: Q  P Let the set of states that an enforcement mechanism restricts a system be R The enforcement mechanism is Secure if R  Q Precise if R = Q Broad if there are some states in R that are not in Q

29 Types of Mechanisms secure precise broad set Rset Q (secure states)

30 Information Assurance Information Assurance Advisory Council (IAAC): “Operations undertaken to protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality and non-repudiation” National Institute of Standards Technology “Assurance is the basis for confidence that the security measures, both technical and operational, work as intended to protect the system and the information it processes”

31 Assurance Assurance is to indicate “how much” to trust a system and is achieved by ensuring that The required functionality is present and correctly implemented There is sufficient protection against unintentional errors There is sufficient resistance to intentional penetration or by-pass Basis for determining this aspect of trust Specification Requirements analysis Statement of desired functionality Design Translate specification into components that satisfy the specification Implementation Programs/systems that satisfy a design

32 Operational Issues Designing secure systems has operational issues Cost-Benefit Analysis Benefits vs. total cost Is it cheaper to prevent or recover? Risk Analysis Should we protect something? How much should we protect this thing? Risk depends on environment and change with time Laws and Customs Are desired security measures illegal? Will people do them? Affects availability and use of technology

33 Human Issues Organizational Problems Power and responsibility Financial benefits People problems Outsiders and insiders Which do you think is the real threat? Social engineering

34 Tying all together: The Life Cycle Operation & Maintenance Implementation Design Specification Policy Threats Human factor