COMPUTER SECURITY

Instructor: Mr. Mleli

What is computer security?
Computer security basically is the protection of computer
systems and information from harm, theft, and unauthorized
use. It is the process of preventing and detecting unauthorized
use of your computer system.
Computer hardware is typically protected by the same means
used to protect other valuable or sensitive equipment namely,
serial numbers, doors and locks, and alarms. The protection of
information and system access, on the other hand, is achieved
through other tactics, some of them quite complex.
Security for information technology (IT) refers to the methods,
tools and personnel used to defend an organization's digital
assets. The goal of IT security is to protect these assets,
devices and services from being disrupted, stolen or exploited
by unauthorized users, otherwise known as threat actors. These
threats can be external or internal and malicious or accidental in
both origin and nature.
An effective security strategy uses a range of approaches to
minimize vulnerabilities and target many types of cyberthreats.
Detection, prevention and response to security threats involve
the use of security policies, software tools and IT services.
Unfortunately, technological innovation benefits both IT
defenders and cybercriminals. To protect business assets,
companies must routinely review, update and improve security
to stay ahead of cyberthreats and increasingly sophisticated
cybercriminals.
IT security consists of two areas: physical and information.
Physical security
It is the protection of people, hardware, software, network
information and data from physical actions, intrusions and other
events that could damage an organization and its assets.
Safeguarding the physical security of a business means protecting it
from threat actors, as well as accidents and natural disasters, such
as fires, floods, earthquakes and severe weather. A lack of physical
protection could risk the destruction of servers, devices and utilities
that support business operations and processes. That said, people
are a large part of the physical security threat.
Theft and vandalism are examples of human-initiated threats that
require physical security solutions. A physical security breach
doesn't necessarily require technical knowledge, but it can be just as
dangerous as a data breach.
There are three parts to physical security:
I. Access control
II. Surveillance
III. Testing

The success of an organization's physical security program

depends on effectively implementing, maintaining and updating
each of these components.
Access control
Controlling access to office buildings, research centers, laboratories,
data centers and other locations is vital to physical security. An
example of a physical security breach is an attacker gaining entry to
an organization and using a Universal Serial Bus (USB) flash drive to
copy and steal data or put malware on the systems.
The goal of access control is to record, monitor and limit the number
of unauthorized users interacting with sensitive and confidential
physical assets. Access control can be as simple as barriers like
walls, fences and locked doors. Identification badge and keycodes
are also part of an effective physical access system. Physical
identification is a great way to authenticate the identity of users
attempting to access devices and areas reserved for authorized
personnel.
Surveillance
Surveillance involves the technologies and tactics used
to monitor activity in and around facilities and equipment. Many
companies install closed-circuit television (CCTV) cameras to
secure the perimeter of their buildings. These cameras act as
both a preventive to intruders and a tool for incident response
and analysis. Cameras, thermal sensors, motion detectors and
security alarms are only some examples of surveillance
technology.
Testing
Testing is a reliable way to increase physical security.
Companies that have strong security protocols test their policies
to see if they need to be updated or changed. Such tests can
include red teaming, where a group of ethical hackers try to
infiltrate a company's cybersecurity protocols.
Information security
Information security it includes strategies used to manage the
processes, tools and policies that protect both digital and
nondigital assets. When implemented effectively, infosec can
maximize an organization's ability to prevent, detect and
respond to threats.
Information security, sometimes it is abbreviated to INFOSEC, is a set
of practices intended to keep data secure from unauthorized access
or alterations.
This is both when data is being stored and when it's being
transmitted from one machine or physical location to another.
You will sometimes see information security and cybersecurity used
interchangeably.
Strictly speaking, cybersecurity is the broader practice of defending IT
assets from attack, and information security is a specific discipline
under the cybersecurity umbrella.
Cybersecurity is concerned with protecting electronic devices
and mobile devices against attacks in cyberspace. Information
security (Info Sec) is concerned with protecting the
confidentiality, integrity, and availability of information.
CIA Triad
The three letters in "CIA triad" stand for Confidentiality, Integrity,
and Availability. The CIA triad is a common model that forms the
basis for the development of security systems. They are used
for finding vulnerabilities and methods for creating solutions.
The confidentiality, integrity, and availability of information is
crucial to the operation of a business, and the CIA triad
segments these three ideas into separate focal points. This
differentiation is helpful because it helps guide security teams
as they pinpoint the different ways in which they can address
each concern.
Computer security is mainly concerned with three main areas;
When we discuss data and information, we must consider the
CIA triad. The CIA triad refers to an information security model
made up of the three main components: confidentiality, integrity
and availability. Each component represents a fundamental
objective of information security.
I. Confidentiality is ensuring that information is available only
to the intended audience.
II. Integrity is protecting information from being modified by
unauthorized parties.
III. Availability is protecting information from being modified by
unauthorized parties.
Confidentiality: This component is often associated with secrecy
and the use of encryption. Confidentiality in this context means
that the data is only available to authorized parties. When
information has been kept confidential it means that it has not
been compromised by other parties; confidential data are not
disclosed to people who do not require them or who should not
have access to them. Ensuring confidentiality means that
information is organized in terms of who needs to have access,
as well as the sensitivity of the data. A breach of confidentiality
may take place through different means, for instance hacking or
social engineering.
Integrity: Data integrity refers to the certainty that the data is not
tampered with or degraded during or after submission. It is the
certainty that the data has not been subject to unauthorized
modification, either intentional or unintentional. There are two
points during the transmission process during which the integrity
could be compromised: during the upload or transmission of data
or during the storage of the document in the database or
collection.
Availability: This means that the information is available to
authorized users when it is needed. For a system to demonstrate
availability, it must have properly functioning computing systems,
security controls and communication channels. Systems defined
as critical (power generation, medical equipment, safety systems)
often have extreme requirements related to availability. These
systems must be resilient against cyber threats, and have
safeguards against power outages, hardware failures and other
events that might impact the system availability.
Information security principles
The basic components of information security principles:
I. Confidentiality
II. Integrity, and
III. Availability
IV. Authentication
V. Non-repudiation
Confidentiality
I. Confidentiality is perhaps the element of the list that most
immediately comes to mind when you think of information
security.
Data is confidential when only those people who are authorized
to access it can do so.
To ensure confidentiality, you need to be able to identify who
is trying to access data and block attempts by those without
authorization.
• Passwords, encryption, authentication, and defense
against penetration attacks are all techniques designed to
ensure confidentiality.
Integrity
II. Integrity It involves the maintenance of Consistency,
accuracy, and trustworthiness of data over its entire life
cycle. It also ensures that data can't be altered by
unauthorized persons.
Many of the techniques that ensure confidentiality will also
protect data integrity after all, a hacker can't change data
they can't access.
There are other tools that help provide a defense of integrity
in depth:
i. Version control software and
ii. Frequent backups
Availability
III. Availability While you need to make sure that your data can't
be accessed by unauthorized users, you also need to ensure
that it can be accessed by those who have the proper
permissions.
It is partly ensured by maintaining all hardware, operating
system, and associated software.
Ensuring data availability means matching network and
computing resources to the volume of data access you
expect and implementing a good backup policy for disaster
recovery purposes.
Authentication
IV. Authentication It is one of the most important aspects of
Information Security for an Organization.
It helps an organization to allow only authorized persons to
access the organization confidential data.
To make authentication stronger, you can combine methods,
often referred to as multifactor authentication.
The most common type is two-factor authentication, such
as using a PIN code as well as a SecurID token to log on to
your network.
Nonrepudiation
V. Nonrepudiation is the assurance that someone cannot deny
something.
Typically, nonrepudiation refers to the ability to ensure that a
party to a contract or a communication cannot deny the
authenticity of their signature on a document or the sending of a
message that they originated.
It refers to a service, which provides proof of the origin of data
and the integrity of the data.
Nonrepudiation Cont.….
In digital security, non-repudiation means:
i. A service that provides proof of the integrity and origin of data.
ii. An authentication that can be said to be genuine with high
confidence.
To mitigate the risk of people repudiating their own signatures, the
standard approach is to involve a trusted third party.
i. In digital era, the Certificate Authority is the trusted third part. It
issues a public key certificate.
ii. A public key certificate can be used by anyone to verify digital
signatures without a shared secret between the signer and the
verifier.
Measures to ensure information security
I. Technical measures include the hardware and software that
protects data, everything from encryption to firewalls
II. Organizational measures include the creation of an internal unit
dedicated to information security, along with making infosec part
of the duties of some staff in every department
III. Human measures include providing awareness training for users on
proper infosec practices
IV. Physical measures include controlling access to the office locations
and, especially, data centers
Types of Attacks
Types of Computer Security
I. Application Security: Application security is the introduction
of security features in applications during their development
process. This actively helps prevent potential cyber threats
such as data breaches, denial-of-service attacks (DoS), SQL
injection, and many others. Some examples of application
security tools are antivirus software, firewalls, web application
firewalls, encryption, etc.
II. Information Security: Information security is a set of
practices that aim to protect the confidentiality, integrity, and
availability (known as the CIA triad) of data from unauthorized
access and misuse.
III. Network Security: Network security is any activity that aims
to protect the integrity and usability of a network and data. It
consists of both hardware and software technologies that are
specifically designed to prevent unauthorized intrusion into
computer systems and networks.
Types of Computer Security Cont..
IV. Endpoint Security: End-users are increasingly becoming the
biggest security risk unintentionally. With no-fault from their
end, exempting the lack of awareness, the virtual gates of an
organization are open to hackers and attacks. Most of the
end-users are unaware of the ICT policy, and therefore, it is
imperative that the users who handle sensitive information on
a regular basis understand and be knowledgeable about all
comprehensive security policies, protocols, and procedures.
V. Internet Security: Internet security is one of the most
important types of computer security that come with a set of
rules and protocols that focus on specific threats and
activities that happen online. It provides protection against
hacking, DoS attacks, computer viruses, and malware
Computer security threats / Attacks
I. Malware: It is Short for malicious software, malware is a class
of computer software designed to disrupt a computer system
in order to gain access to, take control over, steal or damage
digital assets. This cyber threat includes computer viruses,
worms, trojan horses, ransomware and many other malicious
programs. These types of computer threats require ongoing
vigilance on the part of computer security professionals to
keep systems safe, and to adjust as new types of malware
constitute new computer security threats.
II. Backdoors: A backdoor attack is a way to access a computer
system or encrypted data that bypasses the system's
customary security mechanisms. A developer may create a
backdoor so that an application, operating system (OS) or
data can be accessed for troubleshooting or other purposes.
III. Denial of Service: Denial of Service (DoS) attacks aim to
shut down a machine or network with a flood of traffic to make
service unavailable for targeted users. Along the same line,
Distributed Denial of Service (DDoS) attacks are another
common cybersecurity threat in which multiple systems
arrange an attack on a single target. These cyber threats are
very common and can be used to take down servers or
render services inaccessible.
IV. Phishing: Is the attempt of acquiring sensitive information
such as usernames, passwords, and credit card details
directly from users by deceiving the [Link] is typically
carried out by email spoofing or instant messaging, and it
often directs users to enter details at a fake website
whose look and feel are almost identical to the legitimate one.
The fake website often asks for personal information, such as
login details and passwords. This information can then be
used to gain access to the individual's real account on the
real website.
V. Botnet
A botnet is a network of connected computers that have been
compromised by hackers without the knowledge of the users.
Each of the infected computers in the network is called a ‘zombie
computer.’ The infected computer, which now is the bot, is used
for carrying out malicious activities in larger-scale attacks like
DDoS.
For example, an ad fraud botnet infects a user's PC with
malicious software that uses the system's web browsers to divert
fraudulent traffic to certain online advertisements. However, to
stay concealed, the botnet won't take complete control of the
operating system (OS) or the web browser, which would alert the
user.
VI. Identity theft
Identity theft is the crime of obtaining the personal or financial
information of another person to use their identity to commit
fraud, such as making unauthorized transactions or purchases.
Identity theft is committed in many different ways and its victims
are typically left with damage to their credit, finances, and
reputation. How do they do it?
Phishing – Criminals pose as ‘legitimate companies’.
Email hundreds of people from the Suckers List. people reply
criminals now have everything they need to steal your identity.
VII. Cyberstalking
Is the use of the Internet messaging services or other electronic
means to stalk someone (repeated harassment or other forms of
invasion of a person's privacy in a manner that causes fear to its
target).
This term is used interchangeably with online harassment and online
abuse.
This online harassment, which is an extension
of cyberbullying and in-person stalking, can take the form of e-
mails, text messages, social media posts, and more and is often
methodical, deliberate, and persistent.
[Link] fraud
Fraud occurs when someone knowingly lies to obtain benefit or
advantage or to cause some benefit that is due to be denied.
Click fraud can occur when individuals click on Web site click
through advertisements (either banner ads or paid text links) to
increase the payable number of click throughs to the advertiser.
The illegal clicks could either be performed by having a person
manually click the advertising hyperlinks or by using automated
software or Online bots that are programmed to click these
banner ads and pay per click text ad links.
Research has indicated that click fraud is perpetrated by
individuals who use click fraud to increase their own personal
banner ad revenues and also by companies who use click fraud
as a way to deplete a competitor's advertising budget.
IX. Salami slicing
The illegal practice of stealing money repeatedly.
In extremely small quantities, usually by taking advantage of
rounding to the nearest cent (or other monetary unit) in financial
transactions.
Salami slicing is most often performed by employees of the
corporation that handles those transactions, and, if not guarded
against, it can be difficult to detect.
Domain Name
• A domain name is the unique name of a computer on the Internet
that distinguishes it from the other systems on the network.
• Example: [Link]
• InterNIC registers domain names for a fee and keeps people from
registering the same name
• Is like trade mark or trade license
• They correspond to the numeric IP address of a computer on the
Internet.
• The text names are used because are easy to remember than
numbers
• The conversion between text and numeric names is done by Domain
name server (DNS)
Parts and uses of Domain Names
The parts identified from right to left
1. Top level: The text at the end that indicates the type of organization
E.g.: In [Link]
Top level is com means the business organization
Parts of Domain Names
• First level level Can be of more than one text,
Example: [Link]:
Top level = [Link] where gov indicates the government and ng
stands for Nigeria
country.
Parts of Domain Names
2. Second level: Indicates the name of organization or/and computer. In
[Link], second level = universityofnigeria
3. Third level domain: Indicates the branch/department/category of the
organization. In our case zango is among the campuses of Nigeria
university.
Abuse of Domain Names
Violation of the structure of the Hierarchy
• site operators frequently wish to have top level names, regardless of
whether they fit properly in the structure. Example: Since .com is
popular, even non-commercial organizations tend to use it.
• The subsites tend to register as large sites. E.g [Link] instead
of [Link]
Cybersquating
• cybersquatting is registering, trafficking in, or using a domain name
with bad-faith intent to profit from the goodwill of a trademark
belonging to someone else.
• Use of generic domain names like [Link], [Link] etc.
Aspects of Bad Faith:
• If a domain name owner has obtained a domain name primarily for
the purposes of selling, renting or otherwise transferring it to a party
who owns the registered trademark or to a competitor of that
trademark owner.

• Registering a domain name in order to prevent the owner of a

registered trademark from protecting that trademark in the form of a
domain name.
Aspects of Bad Faith
• Adopting a domain name primarily for the purpose of disrupting the
business of a competitor.

• Intentionally attempting to draw visitors to the web site of the

domain by creating a likelihood of confusion between the domain and
the trademark
Reverse Domain Hijacking
• Is the practice where one party try to take generic domain names
away from their owners by making false claims of trademark
violation.
Which one is fake?
Dashes not
used

1. [Link]
2. [Link]
"HTTPS" Periods
S = Secure are used