■ Lecture 1 — Study Guide
Introduction to Malware Analysis / Network Security
1. Course Overview
Three Parts:
Part Topics Covered
Part 1 – Network Security Network vulnerabilities, security tools & applications
Part 2 – Cryptography Cryptographic algorithms & protocols for network security
Part 3 – System Security Firewalls, IDSs, IPSs, malware types, malware analysis
Assessment:
• Final Written Exam: 70 marks
• Midterm Exam + Coursework: 30 marks
2. Computer Security — Definition
NIST definition: The protection afforded to an automated information system in order to attain the objectives of
preserving the integrity, availability, and confidentiality of information system resources (hardware, software,
firmware, data, and telecommunications).
3. The CIA Triad (Core Security Objectives)
Pillar Sub-concept Meaning
Data Confidentiality Private info not disclosed to unauthorized individuals
Confidentiality
Privacy Individuals control what info about them is collected/shared
Data Integrity Info & programs changed only in authorized manner
Integrity
System Integrity System performs intended function, free from unauthorized manipulation
Availability — Systems work promptly; service not denied to authorized users
Additional Concepts (beyond CIA):
• Authenticity — Verifying the identity of a user/system/device before granting access.
• Accountability — Actions of an entity can be traced uniquely back to that entity.
4. Key Security Terminology
Vulnerability: A flaw/weakness in a system's design, implementation, or management that could be
exploited to violate security policy.
Threat: A potential for violation of security — a possible danger that might exploit a vulnerability.
Countermeasure: An action, device, or technique that reduces a threat/vulnerability by eliminating,
preventing, or minimizing harm.
Security Attack: Any action that compromises the security of information owned by an organization.
Security Mechanism: A process designed to detect, prevent, or recover from a security attack.
Security Service: A service that enhances security of data processing systems; uses one or more
security mechanisms.
Security Policy: A set of rules/practices that specify how a system provides security services.
Risk: Probability that a particular threat will exploit a particular vulnerability with a harmful result.
System Resource (Asset): Data, services, capabilities, or system equipment that must be protected.
5. Security Attacks
Two Main Categories (X.800 / RFC 4949):
Type Goal Examples
Passive Attack Learn/use information without affecting system resources • Release of message contents
(eavesdropping) • Traffic analysis
Active Attack Alter system resources or affect operation
• Masquerade (impersonation)
(modification) • Replay
• Modification of messages
• Denial of Service (DoS)
Active Attack Sub-types:
• Replay — Passive capture of a data unit then retransmission to produce unauthorized effect.
• Modification of Messages — Part of a legitimate message is altered, delayed, or reordered.
• Denial of Service (DoS) — Prevents/inhibits normal use of communication facilities.
• Masquerade — One entity pretends to be a different entity.
Tip: Passive attacks are hard to detect (no data is changed). Active attacks are hard to prevent due to the wide
variety of attack surfaces.
6. X.800 Security Services
Service What it Does
Authentication Assures that the communicating entity is who it claims to be
Access Control Limits/controls access to resources via communication links; requires authentication first
Data Confidentiality Protects transmitted data from passive attacks; prevents traffic analysis
Data Integrity Assures data received is exactly as sent (no modification, replay, reordering)
Non-Repudiation Prevents sender or receiver from denying a transmitted message
Availability Ensures systems are accessible and usable by authorized users on demand; counters DoS
7. Data Integrity — Two Service Types
• Connection-oriented integrity — Deals with a stream of messages; assures no duplication,
insertion, modification, reordering, or replays.
• Connectionless integrity — Deals with individual messages in isolation; generally protects only
against message modification.
8. Unwanted Access — Program Threats
Placement of malicious logic in a system can exploit vulnerabilities and affect both application and utility
programs.
• Information Access Threats — Intercept or modify data on behalf of unauthorized users.
• Service Threats — Exploit service defects to inhibit use by legitimate users.
9. Computer Security Challenges
• Security is not simple — requires holistic design, not just one algorithm.
• Must consider all potential attack vectors on security features.
• Security mechanisms involve more than a single algorithm or protocol.
• Must decide where to apply security mechanisms in the system.
• Requires constant monitoring — threats evolve over time.
• Strong security is often seen as an impediment to usability.
10. Model for Network Security (Fig 1.2)
The basic model involves:
• Sender and Recipient communicating over an information channel.
• A Security-related transformation applied using Secret Information (keys).
• A Trusted Third Party (e.g., arbiter, key distributor) facilitating secure communication.
• An Opponent who may intercept, modify, or disrupt the communication.
■ Quick Recall — Key Definitions
Term One-Line Definition
CIA Triad Confidentiality + Integrity + Availability
Vulnerability Weakness that can be exploited
Threat Possible danger that might exploit a vulnerability
Risk Probability that threat exploits vulnerability
Passive Attack Eavesdrop/monitor — no change to data
Active Attack Modify/disrupt data or systems
Non-Repudiation Neither sender nor receiver can deny a message
Authentication Proving identity before access is granted
Good luck on your exam! ■