Security at a Glance

1. Computer Security

• Secure: Free from danger, free from risk of loss, affording safety, trustworthy, dependable
• What are we securing in a computer system?
  • Data (information)
  • Hardware/software systems (that store, manage, manipulate, and transfer data)
• Confidentiality
• Authenticity
• Integrity
• Non-repudiation
• Access control

• Availability

• Confidentiality
  • Keep your data private and only accessible by authorized person
• Authenticity
  • The origin of information is correctly identified
• Integrity

• Only authorized parties can change information

• Non-repudiation
  • Neither sender nor receiver can deny that they performed a transaction
• Access control
  • Access to information is controlled and limited to authorized parties
• Availability
  • User should have access to information assets as needed

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
 
## Computer Security: Additional attributes


- Reliability
- Availability
- Safety
- Liveness
- Self-stabilization



- Expected time to system failure
  - Mean time to failure (MTTF)
  - Mean time between failures (MTBF)
 


- Percentage of time that a system is operational
 


- A condition where a predefined set of error conditions never occurs



- A condition where a system always returns to a predefined set of desirable states (aspect of fault-tolerance)



- The ability of a system to recover from any possible fault condition
 
 

Vulnerabilities and Attacks

• Architecture/Design:
  • directly related to system design
• Behavioral Complexity:
  • how system interacts to its environment
• Adaptability and Manipulation:
  • how a system’s flexibility can impact its responsiveness to attacks
• Operation/Configuration:
  • how systems can be used in an attacks
• Non-physical Exposure:
  • vulnerabilities come from non-physical access to the systems (remote access)
• Physical Exposure:
  • vulnerabilities come from direct access to the systems
• Dependency on Supporting Infrastructure:
  • lack of power, air conditioning, network connections .. that causes the systems to fail

A Common Language for Computer Security Incidents - John Howard and Thomas

• The number of components that an attacker can access
  • Number of open sockets
  • Number of open pipes
  • Number of open remote procedure call endpoints
  • Number of services
  • Number of services running with elevated privileges
  • Number of web server scripts, filters, and applications
  • Number of accounts with elevated privilege
  • Number of files, directories, etc. with weak access control
• Interruption
• Interception
• Modification
• Fabrication

1
2
3
4
5
6
7
8
9
 
## Security Skills


- System knowledge (technical knowledge)
- Organizational knowledge (political/policy knowledge) 
- Sense of Security
- Security principles knowledge