Presentation is loading. Please wait.

Presentation is loading. Please wait.

CHAPTER 2 Laws of Security. Introduction Laws of security enable user make the judgment about the security of a system. Some of the “laws” are not really.

Published bySilvester Snow Modified over 8 years ago

Similar presentations

Presentation on theme: "CHAPTER 2 Laws of Security. Introduction Laws of security enable user make the judgment about the security of a system. Some of the “laws” are not really."— Presentation transcript:

1 CHAPTER 2 Laws of Security

2 Introduction Laws of security enable user make the judgment about the security of a system. Some of the “laws” are not really laws, but rather behaviors that happen so often that be regarded as laws

3 First Law Client-site Security Doesn’t Work What is client-site? The computer that the user (or attacker) has control over. What is client-site security? Some sort of mechanism that is being enforced solely on the client. Reason It not possible to keep software secure from the person sitting in front the computer

4 First Law Exceptions Disk Encryption – the product must require the user to enter a password for decryption when the machine is booted. Problems 1. It doesn’t stop the user from being deprived of the data. 2. It doesn’t stop replace the hardware. 3. It doesn’t stop the information from being erased if the attacker want to format the hard drive.

5 First Law Defense 1. Always validate data at the server in a client- site system. 2. Treat the information received as suspect.

6 Second Law User Can’t Exchange Encryption Keys without Shared Piece of Information In life scenario: the telemarketer begins tell us about product X. we would like to purchase the product and telemarketer need our credit card number. For verifying, we need some extra info. But how do we trust? In Encryption scenario: how do we know what computer we exchanged keys with? It might be the right person or it might be an attacker.

7 Second Law Reasons It is difficult to make sure we are exchanging keys with the right party and not falling victim to a man-in-the-middle (MITM) attack. Exceptions Using SSL (Secure Socket Layer) – provide nothing to go to a secure Web page. It is not really an exception but its really need “the root certificate’s public key”. Defense We must have good key management.

8 Third Law Viruses and Trojans Cannot Be 100 Percent Protected Reasons 1. Even a slight change can be done in the virus code, the antivirus software won’t be able to spot it any longer. 2. The most recent set of viruses propagate so much and more quickly. It can spread via any method – web pages, e-mail and downloads.

9 Third Law Exceptions Modifying our behavior. How? 1. We have to install software only from a trusted vendor. 2. We must never exchange information with anyone when using a network. 3. Our computer would have to be physically secure.

10 Third Law Defense 1. Employing the standard antivirus tools at a minimum. 2. Make sure we know how to configure mail server, firewalls or IDS (Intrusion Detection System).

11 Fourth Law Firewalls Cannot Protect 100 Percent from Attack Reasons 1. There are so many threats – malicious employees, physical security, modems and infected floppies. 2. Firewall are designed to permit some types of traffic while denying other traffics. 3. What is permitted or denied should reflect a written security that exist in certain organization.

12 Fourth Law Exceptions No exceptions, only can defense. Defense Using IDS – designed to spot bad traffic through some mechanisms: 1. Match against known bad pattern. 2. Check for compliance against written standards. 3. Profile normal traffic and flag it that varies. IDS also have key in collecting information about new attacks.

13 Fifth Law In Order for A System To Be Secure, It Must Undergo An Independent Security Audit Reason Most programmers only doing functionally testing but doesn’t doing security testing. Functionally Testing – to ensure that the users will be able to use the product without complaining. Security Testing – mush more in-depth analysis including checking the source code.

14 Fifth Law One of the most secure operating system is OpenBSD. A couple of years, OpenBSD team have done independent auditing: 1. Audit the source code for bugs and fixing them. 2. Fixed any bugs that found whether security related or not. 3. Search all source code to see whether that type of bug had been made anywhere else.

15 Fifth Law Exceptions Using NSA rules – software have been rated as A1 for designing secure computer systems, especially operating system. Defense 1. Use purchasing dollars to encourage vendors to do better work 2. Give training to employees to contribute security reviews for the system.

16 End of Chapter 2 Thank You

Download ppt "CHAPTER 2 Laws of Security. Introduction Laws of security enable user make the judgment about the security of a system. Some of the “laws” are not really."

Similar presentations

Thank you to IT Training at Indiana University Computer Malware.

Thank you to IT Training at Indiana University Computer Malware.
Information Security 1 Information Security: Security Tools Jeffy Mwakalinga.

Information Security 1 Information Security: Security Tools Jeffy Mwakalinga.
E-Commerce Security Issues. General E-Business Security Issues Any E-Business needs to be concerned about network security. The Internet is a “ public.

E-Commerce Security Issues. General E-Business Security Issues Any E-Business needs to be concerned about network security. The Internet is a “ public.
Chapter 9: Privacy, Crime, and Security

Chapter 9: Privacy, Crime, and Security
Telnet and FTP. Telnet Lets you use the resources of some other computer on the Internet to access files, run programs, etc. Creates interactive connection.

Telnet and FTP. Telnet Lets you use the resources of some other computer on the Internet to access files, run programs, etc. Creates interactive connection.
HIPAA Security Standards What’s happening in your office?

HIPAA Security Standards What’s happening in your office?
19.1 Silberschatz, Galvin and Gagne ©2003 Operating System Concepts with Java Chapter 19: Security The Security Problem Authentication Program Threats.

19.1 Silberschatz, Galvin and Gagne ©2003 Operating System Concepts with Java Chapter 19: Security The Security Problem Authentication Program Threats.
Security A system is secure if its resources are used and accessed as intended under all circumstances. It is not generally possible to achieve total security.

Security A system is secure if its resources are used and accessed as intended under all circumstances. It is not generally possible to achieve total security.
Lesson 14-Desktop Protection. Overview Protect against malicious code. Use the Internet. Protect against physical tampering.

Lesson 14-Desktop Protection. Overview Protect against malicious code. Use the Internet. Protect against physical tampering.
Security Awareness: Applying Practical Security in Your World

Security Awareness: Applying Practical Security in Your World
Exam ● On May 15, at 10:30am in this room ● Two hour exam ● Open Notes ● Will mostly cover material since Exam 2 ● No, You may not take it early.

Exam ● On May 15, at 10:30am in this room ● Two hour exam ● Open Notes ● Will mostly cover material since Exam 2 ● No, You may not take it early.
Network Security. Network security starts from authenticating any user. Once authenticated, firewall enforces access policies such as what services are.

Network Security. Network security starts from authenticating any user. Once authenticated, firewall enforces access policies such as what services are.
Silberschatz, Galvin and Gagne  2002 19.1 Operating System Concepts Module 19: Security The Security Problem Authentication Program Threats System Threats.

Silberschatz, Galvin and Gagne  Operating System Concepts Module 19: Security The Security Problem Authentication Program Threats System Threats.
S EC (4.5): S ECURITY 1. F ORMS OF ATTACK There are numerous way that a computer system and its contents can be attacked via network connections. Many.

S EC (4.5): S ECURITY 1. F ORMS OF ATTACK There are numerous way that a computer system and its contents can be attacked via network connections. Many.
Chapter 9 Security 9.7 - 9.8 Malware Defenses. Malware Can be used for a form of blackmail. Example: Encrypts files on victim disk, then displays message.

Chapter 9 Security Malware Defenses. Malware Can be used for a form of blackmail. Example: Encrypts files on victim disk, then displays message.
Department Of Computer Engineering

Department Of Computer Engineering
SSL (Secure Socket Layer) and Secure Web Pages Rob Sodders, University of Florida CIS4930 “Advanced Web Design” Spring 2004

SSL (Secure Socket Layer) and Secure Web Pages Rob Sodders, University of Florida CIS4930 “Advanced Web Design” Spring 2004
SHASHANK MASHETTY Email security. Introduction Electronic mail most commonly referred to as email or e- mail. Electronic mail is one of the most commonly.

SHASHANK MASHETTY security. Introduction Electronic mail most commonly referred to as or e- mail. Electronic mail is one of the most commonly.
Computer security virus, hacking and backups. Computer viruses are small software programs that are designed to spread from one computer to another.

Computer security virus, hacking and backups. Computer viruses are small software programs that are designed to spread from one computer to another.
1 Chapter 8 Securing Information Systems. Outline Security Threats (External: malware, spoofing/phishing, sniffing, & data theft: Internal: unauthorized.

1 Chapter 8 Securing Information Systems. Outline Security Threats (External: malware, spoofing/phishing, sniffing, & data theft: Internal: unauthorized.

Similar presentations

Ads by Google