1. Computer Security Define a computer systemDefine a computer system –web server, cable box, ATM, etc. Security policy (a set of desired goals) varies in each computer systemSecurity policy (a set of desired goals) varies in each computer system Security mechanisms = tools that make sure that the desired goals are metSecurity mechanisms = tools that make sure that the desired goals are met Vulnerabilities = weaknesses in the system that leave it open to attacks (threats)Vulnerabilities = weaknesses in the system that leave it open to attacks (threats) Countermeasure or safeguard is designed to eliminate the weaknessesCountermeasure or safeguard is designed to eliminate the weaknesses

2. Security Goals ConfidentialityConfidentiality –Assets of the computer system should not be accessible by unauthorized parties IntegrityIntegrity –Assets of the computer system should not be modified by unauthorized parties AvailabilityAvailability –Assets should be available to authorized users

3. Security Mechanisms User awarenessUser awareness Physical protectionPhysical protection –Locks and keys –Paper shredding CryptographyCryptography Access control e.g. user rights in Unix systemsAccess control e.g. user rights in Unix systems Auditing: Activity recordingAuditing: Activity recording

4. Principles Principle of least privilegePrinciple of least privilege Minimize amount of trusted componentsMinimize amount of trusted components Do not aim for perfectionDo not aim for perfection Any idea?Any idea?

5. Physical Security Natural risksNatural risks –Power shortage –Fire, Flood –Communication interruption –Operator error Electromagnetic radiationElectromagnetic radiation –CRT signals can be picked up from afar –Communication cables can be tapped

6. Physical Security (2) Malicious attacksMalicious attacks –Masquerading (e.g. use forged ID, pretend to be a repairman) –Piggy-backing –Lock-picking –Visual/auditory access –Dumpster diving –Reading deleted information from magnetic media * Physical protection is at the foundation of computer and network security

7. Software Protection and Piracy Choose at least 1 method of software protection techniques and research on how to counter itChoose at least 1 method of software protection techniques and research on how to counter it Reports must be typed only. No written submission will be accepted.Reports must be typed only. No written submission will be accepted. Acceptable formats: hardcopy onlyAcceptable formats: hardcopy only Delivery method: by person onlyDelivery method: by person only Due date: next classDue date: next class