1. Ingredients of Security
Integrity
Security
Availability
Confidentiality

2. Computer Security Integrity - Is the asset correct? …uncorrupt?
…authentic?
Confidentiality
- Who can access the asset?
Availability
- Is the asset accessible?

3. Computer Security What assets need to be secured? Physical
Configuration
INFORMATION
Identity
Privacy
Ultimately, it is information that must be secure.
-- therefore the term information assurance

4. Integrity
Quality of Information System (IS) reflecting local correctness
and reliability of the operating system; the logical
completeness of the hardware and software implementing
the protection mechanisms; and the consistency of the data
structures and occurrence of stored data.†
attack
Spoofing
impersonating another person, device or process
Relay
causing another computer to send out your attack
Viruses / Worms
infecting transmitted data
† Definition from National Information Systems Security

5. Confidentiality
Assurance that information is not disclosed to unauthorized
persons, processes, or devices.†
white hat
black hat
attack
Shoulder Surfing
peeking at things others consider private
Network Sniffing
examining some else’s network transmissions
Vulnerability Scanning
running software that maliciously analyzes
another computing system
† Definition from National Information Systems Security

6. Integrity & Confidentiality are important first steps…
Sender
Receiver
…toward ensuring private communications.

7. Availability
Timely, reliable access to data and information services for
authorized users.†
attack
Denial of Service (DoS)
results from assets taxed beyond their capacity
examples:
 extreme levels of network traffic
 too many server transactions
 all memory or disk space exhausted
† Definition from National Information Systems Security

8. Common Attacks  spoofing  playback (replay) attack
 man in the middle attack
 dumpster diving
 war driving
 password cracking
 denial of service (DoS) attack
 shoulder surfing
 buffer overflow
 network infrastructure attack
 syn flood
 network scanning

9. How Systems Fail
Proper
Access
Attack
Security System
Asset

10. Trust At the root of all security is trust.
You trust that your software is (largely) correct.
You trust that messages haven’t been altered.
You trust that antivirus software keeps your system free of malware.
You trust that no one else has access to your user account.
You trust that your keyboard isn’t plugged into a key logger.
What don’t you (or shouldn’t you) trust??
Since we obviously can’t trust everything, we need to
develop and implement security policy...