What is Security?
the state of being free from danger or threat.
synonyms: certainty, safe future, assured future, safety, reliability, dependability, solidness, soundness
A successful organization should have multiple layers of security in place:
Physical security: to protect the physical items, objects, or areas of an organization from unauthorized access and misuse.
Personal security: to protect the (group of) authorized individual.
Operations security: to protect the details of a particular operation or series of activities.
Communications security: to protect an organization’s communications media, technology, and content.
Network security: to protect networking components, connections, and contents.
An Information System is secure if it supports CIA:
a good example is cryptography, which traditionally is used to protect secret messages. But cryptography is traditionally used to protect data, not resources. Resources are protected by limiting information, for example by using firewalls or address translation mechanisms.
a good example here is that of an interrupted database transaction, leaving the database in an inconsistent state (this foreshadows the Clark-Wilson model). Trustworthiness of both data and origin affects integrity, as noted in the book’s example. That integrity is tied to trustworthiness makes it much harder to quantify than confidentiality. Cryptography provides mechanisms for detecting violations of integrity, but not preventing them (e.g., a digital signature can be used to determine if data has changed).
this is usually defined in terms of “quality of service,” in which authorized users are expected to receive a specific level of service (stated in terms of a metric). Denial of service attacks are attempts to block availability.
The History of Information Security
Began immediately following development first mainframes
Developed for code-breaking computations
During World War II
Multiple levels of security were implemented
Mainly composed of simple document classification
Defending against physical theft, espionage, and sabotage
The need for computer security, or the need to secure the physical location of hardware from outside threats, began almost immediately after the first mainframes were developed.
Groups developing code-breaking computations during World War II created the first modern computers .
Badges, keys, and facial recognition of authorized personnel controlled access to sensitive military locations.
In contrast, information security during these early years was elementary and mainly composed of simple document classification schemes.
There were no application classification projects for computers or operating systems at this time, because the primary threats to security were physical theft of equipment, espionage against the products of the systems, and sabotage.
Original communication by mailing tapes
Advanced Research Project Agency (ARPA)
Examined feasibility of networked communications
Larry Roberts developed ARPANET
Link 17 Computer Research Centers
Cost 3.4M $
ARPANET is predecessor to the Internet
During the 1960s, the Department of Defence’s Advanced Research Procurement Agency (ARPA) began examining the feasibility of a redundant networked communications system designed to support the military’s need to exchange information.
Larry Roberts, known as the founder of the Internet, developed the project from its inception.
The 1970s and 80s
ARPANET grew in popularity
Potential for misuse grew
Fundamental problems with ARPANET security
Individual remote sites were not secure from unauthorized users
Vulnerability of password structure and formats
No safety procedures for dial-up connections to ARPANET
Non-existent user identification and authorization to system
Rand Report R-609
Paper that started the study of computer security
Information Security as we know it began
Scope of computer security grew from physical security to include:
Safety of data
Limiting unauthorized access to data
Involvement of personnel from multiple levels of an organization
During the next decade, the ARPANET grew in popularity and use, and so did its potential for misuse.
In December of 1973, Robert M. Metcalfe indicated that there were fundamental problems with ARPANET security.
Individual remote users’ sites did not have sufficient controls and safeguards to protect data against unauthorized remote users.
There were no safety procedures for dial-up connections to the ARPANET.
User identification and authorization to the system were non-existent.
Phone numbers were widely distributed and openly publicized on the walls of rest rooms and phone booths, giving hackers easy access to ARPANET.
Much of the focus for research on computer security centered on a system called MULTICS (Multiplexed Information and Computing Service).
In mid-1969, not long after the restructuring of the MULTICS project, several of the key players created a new operating system called UNIX.
While the MULTICS system had planned security with multiple security levels and passwords, the UNIX system did not.
In the late 1970s the microprocessor brought in a new age of computing capabilities and security threats as these microprocessors were networked.
It began with Rand Report R-609, sponsored by the Department of Defence, which attempted to define multiple controls and mechanisms necessary for the protection of a multilevel computer system.
The scope of computer security grew from physical security to include:
• Safety of the data itself
• Limiting of random and unauthorized access to that data
• Involvement of personnel from multiple levels of the organization
At this stage, the concept of computer security evolved into the more sophisticated system we call information security.
• Networks of computers became more common
• Need to interconnect networks grew
• Internet became first demonstration of a global network of networks
• Initially based on de facto standards
• In early Internet deployments, security was treated as a low priority
At the close of the 20th century, as networks of computers became more common, so too did the need to connect the networks to each other.
This gave rise to the Internet, the first manifestation of a global network of networks.
There has been a price for the phenomenal growth of the Internet, however. When security was considered at all, early Internet deployment treated it as a low priority.
As the requirement for networked computers became the dominant style of computing, the ability to physically secure that physical computer was lost, and the stored information became more exposed to security threats.
2000 to Present
• Millions of computer networks communicate
• Many of the communication unsecured
• Ability to secure a computer’s data influenced by the security of every computer to which it is connected
• Growing threat of cyber attacks has increased the need for improved security
Today, the Internet has brought millions of unsecured computer networks into communication with each other.
Our ability to secure each computer’s stored information is now influenced by the security on each computer to which it is connected.
Key Information Security Concepts
Access – a subject or object’s ability to use, manipulate, modify, or affect another subject or object.
Asset – the organizational resource that is being protected.
Attack – an act that is an intentional or unintentional attempt to cause damage or compromise to the information and/or the systems that support it.
Control, Safeguard, or Countermeasure – security mechanisms, policies, or procedures that can successfully counter attacks, reduce risk, resolve vulnerabilities, and otherwise improve the security within an organization.
Exploit – to take advantage of weaknesses or vulnerability in a system.
Exposure – a single instance of being open to damage.
Hack – Good: to use computers or systems for enjoyment; Bad: to illegally gain access to a computer or system.
Object – a passive entity in the information system that receives or contains information.
Subject – an active entity that interacts with an information system and causes information to move through the system for a specific end
Risk – the probability that something can happen.
Threats – a category of objects, persons, or other entities that represents a potential danger to an asset.
Threat Agent – a specific instance or component of a more general threat.
Vulnerability – weaknesses or faults in a system or protection mechanism that expose information to attack or damage.
Security Blueprint – the plan for the implementation of new security measures in the organization.
Security Model – a collection of specific security rules that represents the implementation of a security policy.
Security Posture or Security Profile – a general label for the combination of all policies, procedures, technologies, and programs that make up the total security effort currently in place.
An attack occurs when someone attempts to exploit a vulnerability
Type of attacks
Passive (e.g., eavesdropping)
Active (e.g., password guessing, DoS)
A compromise occurs when an attack is successful
Relationships of Security Concepts
Key Information Security Concepts
Computer can be subject or object of an attack
When the subject of an attack
An active tool to conduct attack
When the object of an attack
An entity being attacked
When considering the security of information systems components, it is important to understand the concept of the computer as the subject of an attack as opposed to the computer as the object of an attack.
When a computer is the subject of an attack, it is used as an active tool to conduct the attack. When a computer is the object of an attack, it is the entity being attacked.
Information Security vs. Access
• Perfect security is impossible
• Security is a process
• Security should be considered balance between protection and availability
• Must allow reasonable access, yet protect against threats
When considering information security, it is important to realize that it is impossible to obtain perfect security. Security is not an absolute; it is a process not a goal.
Security should be considered a balance between protection and availability.
To achieve balance, the level of security must allow reasonable access yet protect against threats.
A threat is a potential violation of security.
Classes of Threats
• interruption or prevention of correct operation
• DOS attack: Denial of Service
Interception / Disclosure
• Unauthorized access to information
• Snooping: the unauthorized interception of information
• An unauthorized party not only gains access to but modify an asset.
• Masquerading or spoofing: an impersonation of one entity by another.
• An unauthorized party inserts fake objects into the system.
The scope of computer security
As mentioned, the assets of a computer system can be categorized as hardware, software, data, and communication lines and networks. We briefly describe these four categories and relate these to the concepts of integrity, confidentiality, and availability, as illustrated here in Figure 1.3.
Hardware – A major threat = is the threat to availability. Hardware is the most vulnerable to attack and the least susceptible to automated controls. Threats include accidental and deliberate damage to equipment as well as theft. Theft of CDROMs and DVDs can lead to loss of confidentiality. Physical and administrative security measures are needed to deal with these threats.
Software – includes the operating system, utilities, and application programs. A key threat is an attack on availability. Software is often easy to delete. Software can also be altered or damaged to render it useless. Careful software configuration management can maintain high availability. A more difficult problem is software modification (e.g. from virus/worm) that results in a program that still functions but that behaves differently than before, which is a threat to integrity/authenticity.
Data – involves files and other forms of data controlled by individuals, groups, and business organizations. Security concerns with respect to data are broad, encompassing availability, secrecy, and integrity. In the case of availability, the concern is with the destruction of data files, which can occur either accidentally or maliciously. The obvious concern with secrecy is the unauthorized reading of data files or databases. A less obvious secrecy threat involves the analysis of data and manifests itself in the use of so-called statistical databases, which provide summary or aggregate information. Finally, data integrity is a major concern in most installations. Modifications to data files can have consequences ranging from minor to disastrous.
Some Threat Categories
Examples of threats
Challenges of computer security
1. Computer security is not as simple as it might first appear to the novice. The requirements seem to be straightforward, but the mechanisms used to meet those requirements can be quite complex and subtle.
2. In developing a particular security mechanism or algorithm, one must always consider potential attacks (often unexpected) on those security features.
3. Hence procedures used to provide particular services are often counterintuitive.
4. Having designed various security mechanisms, it is necessary to decide where to use them.
5. Security mechanisms typically involve more than a particular algorithm or protocol, but also require participants to have secret information, leading to issues of creation, distribution, and protection of that secret information.
6. Computer security is essentially a battle of wits between a perpetrator who tries to find holes and the designer or administrator who tries to close them.
7. There is a natural tendency on the part of users and system managers to perceive little benefit from security investment until a security failure occurs.
8. Security requires regular monitoring, difficult in today’s short-term environment.
9. Security is still too often an afterthought – incorporated after the design is complete.
10. Many users / security administrators view strong security as an impediment to efficient and user-friendly operation of an information system or use of information.
Policies and Mechanisms
Policy says what is, and is not, allowed
This defines “security” for the site/system/etc.
Mechanisms enforce policies
Composition of policies
If policies conflict, inconsistencies may create security vulnerabilities
Goals of Security
•Prevent attackers from violating security policy
• Detect attackers’ violation of security policy
• Stop attack, assess and repair damage
• Continue to function correctly even if attack succeeds
Trust and Assumptions
Underlie all aspects of security
• Unambiguously partition system states
• Correctly capture security requirements
• Assumed to enforce policy
• Support mechanisms work correctly
Assurance is a measure of how well the system meets its requirements
• Requirements analysis
• Statement of desired functionality
• How system will meet specification
• Programs/systems that carry out design
Assurance is a measure of how well the system meets its requirements; more informally, how much you can trust the system to do what it is supposed to do. It does not say what the system is to do; rather, it only covers how well the system does it.
Specifications arise from requirements analysis, in which the goals of the system are determined. The specification says what the system must do to meet those requirements. It is a statement of functionality, not assurance, and can be very formal (mathematical) or informal (natural language). The specification can be high-level or low-level (for example, describing what the system as a whole is to do vs. what specific modules of code are to do).
The design architects the system to satisfy, or meet, the specifications. Typically, the design is layered by breaking the system into abstractions, and then refining the abstractions as you work your way down to the hardware. An analyst also must show the design matches the specification.
The implementation is the actual coding of the modules and software components. These must be correct (perform as specified), and their aggregation must satisfy the design.
Note the assumptions of correct compilers, hardware, etc.
• Is it cheaper to prevent or recover?
• Should we protect something?
• How much should we protect this thing?
Laws and Customs
• Are desired security measures illegal?
• Will people do them?
Security does not end when the system is completed. Its operation affects security. A “secure” system can be breached by improper operation (for example, when accounts with no passwords are created). The question is how to assess the effect of operational issues on security.
Cost-Benefit Analysis: this weighs the cost of protecting data and resources with the costs associated with losing the data. Among the considerations are the overlap of mechanisms’ effects (one mechanism may protect multiple services, so its cost is amortized), the non-technical aspects of the mechanism (will it be impossible to enforce), and the ease of use (if a mechanism is too cumbersome, it may cost more to retrofit a decent user interface than the benefits would warrant).
Risk Analysis: what happens if the data and resources are compromised? This tells you what you need to protect and to what level. Cost-benefit analyses help determine the risk here, but there may be other metrics involved (such as customs).
Laws and Customs: these constrain what you can do. Encryption used to be the biggie here, as the text indicates. How much that has changed is anybody’s guess. Customs involve non-legislated things, like the use of urine specimens to determine identity. That is legal, at least in the US in some cases; but it would never be widely accepted as an alternative to a password.
• Power and responsibility
• Financial benefits
• Outsiders and insiders
• Social engineering
Organizations: the key here is that those responsible for security have the power to enforce security. Otherwise there is confusion, and the architects need not worry if the system is secure because they won’t be blamed if someone gets in. This arises when system administrators, for example, are responsible for security, but only security officers can make the rules. Preventing this problem (power without responsibility, or vice versa) is tricky and requires capable management. What’s worse is that security is not a direct financial incentive for most companies because it doesn’t bring in revenue. It merely prevents the loss of revenue obtained from other sources.
People problems are by far the main source of security problems. Outsiders are attackers from without the organization; insiders are people who have authorized access to the system and, possibly, are authorized to access data and resources, but use the data or resources in unauthorized ways. It is speculated that insiders account for 80-90% of all security problems, but the studies generally do not disclose their methodology in detail, so it is hard to know how accurate they are. (Worse, there are many slightly different definitions of the term “insider,” causing the studies to measure slightly different things!) Social engineering, or lying, is quite effective, especially if the people gulled are inexperienced in security (possibly because they are new, or because they are tired).
Matt Bishop, Computer Security: Art and Science, the author homepage, 2004.
Michael E. Whitman, Principles of Information Security: Chapter 1: Introduction to Information Security, 4/e, 2011.
Chris Clifton, CS 526: Information Security course, Purdue university, 2010.