1. Computer Security Class 1
S.Abinash
Department of Computer Science
SIET

2. Department of Computer Science
Computer Security
Department of Computer Science
S.Abinash

3. Critical Infrastructure Areas
… telecommunications, electrical power systems, gas and oil, banking and finance, transportation, water supply systems, government services and emergency services.
S.Abinash

4. Threat Spectrum
S.Abinash

5. Cyberterrorism
The Internet Black Tigers conducted a successful "denial of service" attack on servers of Sri Lankan government embassies
Italian sympathizers of the Mexican Zapatista rebels attacked web pages of Mexican financial institutions.
Rise of “Hack-tivism”
Freeh, Testimony before Senate, 2000.
S.Abinash

6. Threats to Personal Privacy
Buying and selling confidential information from Social Security files.
Browsing IRS files.
Buying and selling bank account name lists.
A Princeton University student stole ~1800 credit card numbers, customer names, and user passwords from an e-commerce site.
House Ways and Means Committee, 102nd Congress, , Washington Post, S. Barr, 2 Aug. 1993
(4) Freeh, Testimoney 2000
S.Abinash

7. Identity Theft
“The theft of computer hard drives from TriWest Healthcare Alliance could turn into one of the largest identity thefts on record if the information is misused, the Federal Trade Commission said.”
S.Abinash

8. What is „Security?”
You Will Never Own a Perfectly Secure System.
You Will Never Own a Perfectly Secure System.
You Will Never Own a Perfectly Secure System.
S.Abinash

9. Well … Maybe If You Do This:
(even then there are standards)
S.Abinash

10. “Secure” Computer System
To decide whether a computer system is “secure”, you must first decide what “secure” means to you, then identify the threats you care about.
Virus
Identity
Theft
Denial of
Service
Espionage
Stolen
Customer
Data
Modified
Databases
Cyberterrorism
Equipment
S.Abinash

11. Confidentiality, Integrity, Availability (CIA)
Pillars of Security:
Confidentiality, Integrity, Availability (CIA)
Confidentiality: Who is authorized? Integrity: Is the data „good?” Availability: Can access data whenever need it?
Confidentiality
Integrity
Availability S
The first of the current issues deals with the concepts of Confidentiality, Integrity, and Availability.
What are these terms and what are the computer security implications?
Confidentiality - Assurance that information is not disclosed to unauthorized entities or processes. (Who do you want to see your information?)
Integrity - Ensures that data continues to be a proper representation of information and that information processing resources continue to perform the correct operations. (Is what you put in, what you get out?)
Availability - Goal of ensuring that information and information processing resources remain readily accessible to authorized users. (Do you get the Information when you want it?)
S = Secure
S.Abinash

12. Balancing CIA Need to balance CIA
Sensitive
Data
Biographical
Payroll
Health
Confidentiality
Integrity
Availability
Packet
Switch
File
Server
Bridge
Gateway
Other
Networks
Need to balance CIA
Ex: Disconnect computer from Internet to increase confidentiality (availability suffers, integrity suffers due to lost updates)
Ex: Have extensive data checks by different people/systems to increase integrity (confidentiality suffers as more people see data, availability suffers due to locks on data under verification)
In addition to all the rules and regulations, policies and procedures and the related system specific documentation, there are some current computer security issues of which you as the Executive should be made aware.
S.Abinash

13. Continued – Class 2