EE 8084
Cyber Security
Course Information
Contact Information
Lecturer: Dr Chan Chee Keong
School: EEE
Office: S1-B1b-51
Office Phone: 6790 5377
Email: eckchan@ntu.edu.sg
2
Consultations
Monday
13:30 15:30
Friday
13:30 14:30
Or by appointment
Or just drop by at any time
Your suggestions/comments are always welcome!
3
Textbook
Principles of Information
Security, 5th Edition
Michael E. Whitman and
Herbert J. Mattord
2015
4
Continuous Assessment (CA)
Group Assignment
50%
6 students per group
Compulsory
Project team meetings: Tutorial time slots
Additional project time
5
Final Exam
Closed-book
50 multiple choice questions
2 hours
50%
All materials discussed in my lectures
6
Principles of
Information Security
Introduction to Information Security
7
Learning Objectives
Recount the history of computer security and how it
evolved into information security
Define information security
Define key terms and critical concepts of information
security
Describe the information security roles of professionals
within an organization
8
Definition
Information security: defending information from
unauthorized access, use, disclosure, disruption,
modification, or destruction
9
The History of Information Security
Computer security began immediately after the first
mainframes were developed.
Groups developing code-breaking computations during
World War II created the first modern computers.
Multiple levels of security were implemented.
Physical controls limiting access to sensitive military
locations to authorized personnel
Rudimentary in defending against physical theft,
espionage, and sabotage
10
Figure 1-1 The Enigma
11
The 1960s
Advanced Research Project Agency (ARPA) began
to examine the feasibility of redundant networked
communications.
Larry Roberts, founder of the Internet, developed
the ARPANET
12
The 1970s and 80s
ARPANET grew in popularity, so did the potential for
abuse
Fundamental problems with ARPANET
No safety procedures for dial-up connections to
ARPANET
Nonexistent user identification and authorization to system
Late 1970s: microprocessor expanded computing
capabilities and security threats
13
The 1970s and 80s (contd)
The Rand Report R-609 - paper that started the study of
computer security and identified the role of management
and policy issues in it
The scope of computer security grew from physical
security to include:
Securing the data
Limiting random and unauthorized access to data
Involving personnel from multiple levels of the
organization in information security
14
15
MULTICS
Early research focus - Multiplexed Information and Computing
Service (MULTICS).
First operating system was created with security integrated into
core functions.
Mainframe, time-sharing OS was developed in the mid-1960s by
General Electric (GE), Bell Labs, and Massachusetts Institute of
Technology (MIT).
Several MULTICS key players created UNIX.
Primary purpose of UNIX was text processing
16
The 1990s
Networks of computers became prevalent in response to
the need to connect them to one another
Internet became the first global network of computers
In early Internet deployments, security was treated as a
low priority.
17
2000 to Present
The Internet brings millions of computer networks into
communication with each othermany of them
unsecured
The security of data in a computer was affected by the
security of every computer to which it is connected.
There is a growing threat of cyber attacks
increased the awareness of need for improved security.
Nation-states engaging in information warfare
18
Computer 'Nerd' Jailed in Jan. 2003
for Global Virus Attack
Simon Vallor, a Welsh Web designer and hacker, created one of the most
widespread viruses.
Vallor admitted releasing Gokar
Gokar: the third most prevalent virus, at one point infecting hundreds of thousands
of computers in 46 countries. It clogged networks and crashed computers.
All were in the form of email attachments.
When the email was opened, Gokar sent itself to addresses in the user's email
directory.
Crime: violating Computer Misuse Act.
His plea: guilty.
His sentence: 2 years in jail.
Reason for his capture: He boasted in an chat room that "at last there's a Welsh
virus" and used his traceable Internet name Gobo.
Like many hackers, he craved fame, which helps law enforcement capture these
criminals.
19
Components of an Information System
Information system (IS) is an entire set of components
necessary to use information as a resource in the
organization
Software
Hardware
Data
People
Procedures
Networks
20
Security Layers
A successful organization should have multiple layers
of security in place to protect:
Operations
Physical infrastructure
People
Functions
Communications
Information
21
Definition of Security
Protection of information and its critical elements,
including systems and hardware that use, store, and
transmit that information
Covers information security management, data security,
and network security
C.I.A. triangle
Is a standard based on confidentiality, integrity, and
availability, now viewed as inadequate.
Expanded model consists of a list of critical
characteristics of information.
22
The protection afforded to an automated
information system connected to internet in C. I. A
order to attain the applicable objectives of
preserving the:
Confidentiality
Integrity
Availability
of information system resources
Software
Firmware
Information/data
Telecommunications
Examples of Security Requirements
Confidentiality student grades
Integrity patient information
Availability authentication services
23
Critical Characteristics of Information(1)
The value of information comes from the
characteristics it possesses:
Availability
Accuracy
Authenticity
Confidentiality
Integrity
Utility
Possession
24
Critical Characteristics of Information (2)
Availability enables users who need to access information to do so
without interference or obstruction and to retrieve that information in the
required format.
Accuracy occurs when information is free from mistakes or errors and has
the value that the end user expects. If information contains a value
different from the users expectations due to the intentional or
unintentional modification of its content, it is no longer accurate.
Authenticity is the quality or state of being genuine or original, rather than
a reproduction or fabrication. Information is authentic when it is the
information that was originally created, placed, stored, or transferred.
25
Critical Characteristics of Information (3)
Confidentiality is the quality or state of preventing disclosure or
exposure to unauthorized individuals or systems.
Integrity is the quality or state of being whole, complete, and
uncorrupted. The integrity of information is threatened when the
information is exposed to corruption, damage, destruction, or other
disruption of its authentic state.
Utility is the quality or state of having value for some purpose or end.
Information has value when it serves a particular purpose. This means
that if information is available, but not in a format meaningful to the end
user, it is not useful.
Possession is an attribute of information that describes how the datas
ownership or control is legitimate or authorized
26
Key Information Security Concepts
Access Protection profile or
Asset security posture
Attack Risk
Control, safeguard, or
countermeasure
Subjects and objects
Exploit Threat
Exposure Threat agent
Loss Vulnerability
27
Key Information Security Concepts
(contd)
A computer can be the subject of an attack and/or the
object of an attack.
When the subject of an attack, the computer is used as
an active tool to conduct attack.
When the object of an attack, the computer is the entity
being attacked.
28
Threats and Attacks
Can be:
Intentional (by hackers) OR
Unintentional (eg., lightning strike)
Passive (snooping/eavesdropping or traffic analysis) OR
Active (modification, masquerading, replaying or repudiation)
Direct (by hacker pc) OR
Indirect (via compromised computers, eg., distributed Denial of Services)
29
30
Threats and Attacks
SNOOPING/EAVESDROPPING
The interception of information intended for someone else during its
transmission over a communication channel.
Alice Bob
Eve
31
Threats and Attacks
TRAFFIC ANALYSIS
Observe patterns of message
32
Threats and Attacks
ALTERATION OR MODIFICATION
Unauthorized modification of information.
Example: The man-in-the-middle attack, where a network stream is
intercepted, modified, and retransmitted.
Communication
Sender Recipient
channel
encrypt decrypt
plaintext M plaintext M
shared shared
secret ciphertext C ciphertext C secret
key key
Attacker
(intercepting)
33
Threats and Attacks
MASQUERADING
The fabrication of information that is
purported to be from someone who is not
actually the author.
From: Alice
(really is from Eve)
34
Threats and Attacks
REPLAYING
Capture message then replay later
35
Threats and Attacks
REPUDIATION
The denial of a commitment or data receipt.
This involves an attempt to back out of a
contract or a protocol that requires the
different parties to provide receipts
acknowledging that data has been received.
36
Threats and Attacks
DENIAL-OF-SERVICE
The interruption or degradation of a data service or information access.
Example: Email spam, to the degree that it is meant to simply fill up a mail
queue and slow down an email server.
Alice
37
Threats and Attacks
DISTRIBUTED DENIAL-OF-SERVICE
38
storage
The Internet
servers
user
user user
39
The Internet users and servers
40
Server-Client internet/intranet
41
The World Wide Web
TRANSFER-AND-STORE PROCESS
Entire document is transferred and then stored on
the local computer before the browser displays it
Creates opportunities for sending different types
of malicious code to the users computer
42
Web page programming
Security (Java, )
43
Downloaded JavaScript Code
44
Downloaded Java Applet
45
Balancing Information Security and
Access
Impossible to obtain perfect information security - it is a
process, not a goal
It is a balance between protection and availability
The level of security must balance against reasonable
access, yet offer adequate protection against threats
46
Impossible to obtain perfect
Information Security
47
Information Security Implementation
Bottom-Up Approach
Begins at grassroots level where systems administrators
attempt to improve security of their systems.
Main advantage is the ability to tap on the technical
expertise of individual administrators
Seldom works because it did not have the following
Participant support
Organizational staying power
48
Information Security Implementation
Top-Down Approach
Begins at upper management level
Issue policy, procedures, and processes
Dictate goals and expected outcomes of project
Determine accountability for each required action
A preferred approach
49
50
Security Professionals and the
Organization
Diverse group of professionals are required
Senior/upper management is a very important
component.
Additional staffs are needed to offer administrative
support and technical expertise - to implement the
details of an IS program.
51
Senior Management
Chief information officer (CIO)
Senior technology officer
Advise the senior executives on strategic planning
Chief information security officer (CISO)
Performs assessment, management, and
implementation of IS in the organization
Reports directly to the CIO
52
Information Security Project Team
A team of people who are experienced in one or
multiple aspects of technical and nontechnical
areas:
Champion
Team leader
Security policy developers
Risk assessment specialists
Security professionals
Systems administrators
End users
53
Data Responsibilities
Data owners: senior management responsible for
the security and use of a particular set of
information
Data custodian: responsible for information and
systems that process, transmit, and store it
Data users: individuals with an information security
role
54
Communities of Interest
Group of individuals united by similar
interests/values within an organization
Information security management and professionals
Information technology management and
professionals
Organizational management and professionals
55
Information Security: Is It an Art or a
Science?
Implementation of information security is often
described as a combination of art and science.
Security artisan idea: based on the way
individuals perceive system technologists and their
abilities
56
Security as Art
No hard and fast rules nor many universally
accepted complete solutions
No manual for implementing security through entire
system
57
Security as Science
Dealing with technology designed for rigorous
performance levels
Specific conditions cause virtually all actions in
computer systems.
Almost every fault, security hole, and systems
malfunction is a result of interaction of specific
hardware and software.
If developers had sufficient time, they could resolve
and eliminate faults.
58
Security as a Social Science
Social science examines the behavior of individuals
interacting with systems.
Security begins and ends with the people that
interact with the system, intentionally or otherwise.
Security administrators can greatly reduce the
levels of risk caused by end users and create
more acceptable and supportable security profiles.
59
Summary
A short history
Components and layers
CIA
Characteristics of Information
Threats and attacks
A fine balance
Bottom up vs top-down
IS professionals and roles
Art, Science or Social Science
60
