Module:2 – Information and Network Security (6

Hrs)
– Introduction – Computer Security – Information
Security – Security Threats and Vulnerabilities –
Security Services – Security Mechanisms – Model
for Network Security

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 1

 Computer Security
• National Institute of Standards and Technology
• NIST Definition of Computer Security
– The protection afforded to an automated information
system in order to attain the applicable objectives of
preserving the integrity, availability, and confidentiality of
information system resources (includes hardware,
software, firmware, information/data, and
telecommunications).
• Three Key Objectives
– Confidentiality
– Integrity CIA Triad
– Availability

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 2

 Confidentiality
• Preserving authorized restrictions on
information access and disclosure, including
means for protecting personal privacy and
proprietary information.
• A loss of confidentiality is the unauthorized
disclosure of information.
• Two Concepts
– Data Confidentiality
• Assures that private or confidential information is not
made available or disclosed to unauthorized individuals.
– Privacy
• Assures that individuals control or influence what
information related to them may be collected and stored
and by whom and to whom that information may be
disclosed.
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 3
 Integrity
• Guarding against improper information modification or
destruction, including ensuring information
nonrepudiation and authenticity.
– Non-repudiation is the assurance that someone cannot deny
the validity of something.
• Eg: Signing a document
– Authenticity is the quality of being true.
• A loss of integrity is the unauthorized modification or
destruction of information.
• Two Concepts
– Data Integrity
• Assures that information and programs are changed only in a
specified and authorized manner.
– System Integrity
• Assures that a system performs its intended function in an
unimpaired manner, free from deliberate or inadvertent
unauthorized manipulation of the system.
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 4
 Availability
• Assures that systems work promptly and
service is not denied to authorized users.
• Ensuring timely and reliable access to and use
of information.
• A loss of availability is the disruption of
access to or use of information or an
information system.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 5

 Additional Objectives of Security
• Authenticity
– The property of being genuine and being able to be
verified and trusted;
– Confidence in the validity of a transmission, a message,
or message originator.
– According to FIPS 199 includes authenticity under integrity.
[Federal Information Processing Standards]
• Accountability
– The security goal that generates the requirement for
actions of an entity to be traced uniquely to that entity.
– This supports nonrepudiation, deterrence, fault isolation,
intrusion detection and prevention, and after-action
recovery and legal action.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 6

Examples for CIA Triad
 Levels of impact
Low Medium High
The loss could be The loss could be The loss could be
expected to have a expected to have a expected to have a
limited adverse effect. serious adverse effect. severe or catastrophic
adverse effect.
Cause a degradation in Cause a significant Cause a severe
mission capability. degradation in mission degradation in or loss of
capability mission capability
Result in minor damage Result in significant Result in major damage
to organizational assets damage to to organizational assets
organizational assets
Result in minor financial Result in significant Result in major financial
loss financial loss loss
Result in minor Result in significant Result in severe or
harm to individuals. harm catastrophic harm to
to individuals that does individuals involving loss
not involve loss of life or of life or serious life-
serious, life-threatening threatening injuries.
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 8
injuries.
 Examples for Confidentiality
• Student Grade Information
– Only Students, Parents and staff must access the
information.
– High Confidentiality is required.
• Student Enrolment
– Results in less damage if disclosed.
– Moderate Confidentiality
• List of Faculty, List of departments in Web Site
– Low Confidentiality
– This information has to be known by a vast range of
people to increase the credits of the university.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 9

 Examples for Integrity
• Patient Allergy information
– If a non authorized person changes this information it results
in a huge damage to the individual and the hospital.
– High need of data Integrity
• Web site that offers a forum for discussion
– A hacker can falsify the data put up as a part of the forum
– When the site is only for entertainment purpose then it only
brings in a small loss of data and time.
– Moderate need of data Integrity
• Anonymous online poll
– Just used as statistics
– Inaccuracy and unscientific nature of these polls are well
known
– Low need of data Integrity
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 10
 Examples of Availability
• Authentication services for critical systems, applications, and
devices
– Interruption of service results in the inability for customers to access
computing resources and staff to access the resources they need to
perform critical tasks.
– Leads to a large financial loss.
– High level of Availability is required.
• Public Website for a University
– Not a critical part of universities information system.
– But unavailability causes embarrassment
– Moderate level of Availability
• Online telephone directory lookup
– There are other ways to access the information.
– Low level of availability.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 11

 Challenges in Computer Security
• Mechanisms used to meet the CIA requirements can be quite complex, and
understanding them may involve rather subtle reasoning.
• In developing a particular security mechanism or algorithm, one must always
consider potential attacks on those security features which is complex.
• It is not obvious from the statement of a particular requirement that such
elaborate measures are needed.
– It is only when the various aspects of the threat are considered that elaborate
security mechanisms make sense.
• Deciding where to use the security mechanisms is complex. (Both physical
placement and logical sense)
• Security mechanisms typically involve more than a particular algorithm or
protocol.
– Participants might be involved with some secret information.
– So transmission and holding this secret information is questionable.
• It is the duty of the designer to identify and eliminate all the weakness in the
system which is again complex.
• Security requires regular, even constant, monitoring, and this is difficult in
today’s short-term, overloaded environment.
• Security is not made as the integral part of the design which makes it even
more challenging.
• Many users and even security administrators view strong security as an
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 12
impediment to efficient and user-friendly operation of an information system.
 Computer Security Terminology
Terminology Description
Adversary An entity that attacks, or is a threat to, a system.
Attack An intelligent act that is a deliberate attempt to evade security services and
violate
the security policy of a system.
Countermeasure An action, device, procedure, or technique that reduces a threat, a vulnerability,
or an attack by eliminating or preventing it, by minimizing the harm it can cause,
or by discovering and reporting it so that corrective action can be taken.
Risk An expectation of loss expressed as the probability that a particular threat will
exploit a particular vulnerability with a particular harmful result.
Security Policy A set of rules and practices that specify or regulate how a system or organization
provides security services to protect sensitive and critical system resources.
System Resource Data contained in an information system; or a service provided by a system; or a
(Asset) system capability, such as processing power or communication bandwidth; or an
item of system equipment (i.e., a system component— hardware, firmware,
software, or documentation); or a facility that houses system operations and
equipment.
Threat A threat is a possible danger that might exploit a vulnerability.
Vulnerability A flaw or weakness in a system’s design, implementation, or operation and
management that could be exploited to violate the system’s security policy.
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 13
 Difference between Risk, Threat, Vulnerability
Vulnerability Threat Risk

The weakness in hardware, Take advantage of vulnerabilities The potential for loss or
software, or designs in the system and have the destruction of data is caused by
potential to steal and damage cyber threats.
data.

Can be controlled. Generally, can’t be controlled. Can be controlled.

Vulnerability management is a Can be blocked by managing the Reducing data transfers,

process of identifying the vulnerabilities. downloading files from reliable
problems, then categorizing sources, updating the software
them, prioritizing them, and regularly, hiring a professional
resolving the vulnerabilities in cybersecurity team to monitor
that order. data, developing an incident
management plan, etc. help to
lower down the possibility of
cyber risks.

Penetration testing and Anti-virus software and threat Identifying mysterious emails,
Vulnerability Scanners detection logs. suspicious pop-ups, observing
unusual password activities, a
slower than normal network

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 14

 A Model for Computer Security
• Assets
– Hardware
• Including computer systems and other
data processing, data storage, and data
communications devices.
– Software
• System Software + Application
Software
– Data
• Including files and databases, as well
as security-related data, such as
password files.
– Communication Facilities and
Networks
• Local and wide area network
communication links, bridges, routers,
and so on.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 15

 A Model for Computer Security
• General categories of Vulnerabilities
– Corrupted
• It does the wrong thing or gives wrong
answers.
• Eg: Stored data values may differ from
what they should be because they
have been improperly modified.
– Leaky
• Eg: Someone who should not have
access to some or all of the
information available through the
network obtains such access.
– Unavailable
• Eg: Using the system or network
becomes impossible or impractical.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 16

 A Model for Computer Security
• Corresponding to the
various types of
vulnerabilities to a system
resource are threats that
are capable of exploiting
those vulnerabilities.
• A threat represents a
potential security harm to
an asset.
• General caused by a Threat
Agent.
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 17
 A Model for Computer Security
• An attack is a threat that is carried out.
• If successful, leads to an undesirable
violation of security, or threat
consequence.
• Two types of attacks
– Active attack
• An attempt to alter system resources or
affect their operation.
– Passive attack
• An attempt to learn or make use of
information from the system that does not
affect system resources.
• Origin of the attack
– Inside attack
• The insider is authorized to access system
resources but uses them in a way not
approved by those who granted the
authorization.
– Outside attack
• Done by an unauthorized or illegitimate user
of the system

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 18

 A Model for Computer Security
• Countermeasure is any means taken
to deal with a security attack.
• A countermeasure can be devised to
prevent a particular type of attack
from succeeding.
• When prevention is not possible, or
fails in some instance, the goal is to
detect the attack and then recover
from the effects of the attack.
• A countermeasure may itself
introduce new vulnerabilities.
• In any case, residual vulnerabilities
may remain after the imposition of
countermeasures.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 19

 OSI Security Architecture
• ITU-T3 Recommendation X.800, Security Architecture for OSI, defines such
a systematic approach.
• Computer and communications vendors have developed security features
for their products and services that relate to this structured definition of
services and mechanisms.
• The OSI security architecture focuses on security attacks, mechanisms,
and services.
– Security attack
• Any action that compromises the security of information owned by an organization.
– Security mechanism
• A process (or a device incorporating such a process) that is designed to detect, prevent,
or recover from a security attack.
– Security service
• A processing or communication service that enhances the security of the data
processing systems and the information transfers of an organization.
• The services are intended to counter security attacks, and they make use of one or more
security mechanisms to provide the service.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 20

 Threats and Attacks
Threat Consequences Attack
Unauthorized 1. Exposure
disclosure • Sensitive data are directly released to an
• threat to unauthorized entity by an authorized person.
confidentiality 2. Interception
• An unauthorized entity directly accesses
sensitive data traveling between authorized
sources and destinations.
• Using LAN
3. Inference
• Adversary is able to gain information from
observing the pattern of traffic on a network.
• Gets useful information from the analysis.
4. Intrusion
• An unauthorized entity gains access to sensitive
data by circumventing a system’s security
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 21
protections.
 Threats and Attacks
Threat Consequences Attack
Deception [Link]
• A circumstance or • An unauthorized entity gains access to a
event that may system or performs a malicious act by posing as
result in an an authorized entity.
authorized entity • Eg: Unauthorized user has learned another
receiving false user’s logon ID and password
data and believing 2. Falsification
it to be true. • This refers to the altering or replacing of valid
• Threat to Integrity data or the introduction of false data into a file
or database.
• For example, a student may alter his or her
grades on a school database.
3. Repudiation
• A user either denies sending data or a user
denies receiving or possessing the data.
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 22
 Threats and Attacks
Threat Consequences Attack
Disruption [Link]
• A circumstance or • Prevents or interrupts system operation by
event that disabling a system component.
interrupts or • Attack on system availability.
prevents the • Physical destruction of or damage to system
correct operation hardware
of system services • Trojan horses, viruses, or worms
and functions. [Link]
• Threat to • Undesirably alters system operation by
availability or adversely modifying system functions or data.
system integrity • Attack on system integrity
3. Obstruction
• A threat action that interrupts delivery of
system services by hindering system operation.
• Eg: By disabling communication links or altering
Monday, February 6, 2023
communication control information.
Instructor: Dr. Kovendan AKP 23
 Threats and Attacks
Threat Consequences Attack
Usurpation [Link]
• Unauthorized • This can include theft of service.
entity controls the • The malicious software makes unauthorized
system use of processor and operating system
functionality resources.
• Threat to system 2. Misuse
integrity • Misuse can occur by means of either malicious
logic or a hacker that has gained unauthorized
access to a system.
• In either case, security functions can be
disabled or thwarted.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 24

 Threats and Assets – Hardware
• Major threat is threat to availability
– Accidental and deliberate damage to equipment
– Theft
• Theft of CD-ROMs, DVDs, Pendrives and other
storage devices can lead to loss of
confidentiality.
• Physical and administrative security
measures are needed to deal with these
threats.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 25

 Threats and Assets - Software
• System Software + Application Software
• A key threat to software is an attack on availability.
– Application software, is often easy to delete.
– Software can also be altered or damaged to render it useless.
– Careful software configuration management, which includes
making backups of the most recent version of software, can
maintain high availability.
• Threat to integrity
– Software modification that results in a program that still
functions but that behaves differently than before.
– Computer viruses and related attacks fall into this category
• Protection against software piracy

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 26

 Threats and Assets - Data
• Availability
– Destruction of data files, which can occur either
accidentally or maliciously.
• Confidentiality
– Unauthorized reading of data files or databases.
• Summary or aggregate information
– Leakage in personal information
• Integrity
– Modifications to data files can have consequences
ranging from minor to disastrous.
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 27
 Threats and Assets - Communication Lines
and Networks
• Active Attack
– Modification in the Data Stream
– Types
• Replay
– Passive capture of a data unit and its subsequent retransmission to produce an
unauthorized effect.
• Masquerade
– One entity pretends to be a different entity (Impersonation)
• Modification of messages
– Some portion of a legitimate message is altered.
• Denial of service
– Inhibits the normal use or management of communication facilities.
– Disabling the network or by overloading it with messages so as to degrade
performance.
• Passive Attack
– Eavesdropping on, or monitoring of, transmissions.
– Goal: Obtain the information that is being transmitted
– Types:
• Release of message contents
• Traffic analysis
– Gathering the data from the packet
– Very difficult to detectInstructor:
Monday, February 6, 2023
the attack.
Dr. Kovendan AKP 28
 Active Attacks - Illustration

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 29

 Active Attacks - Illustration

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 30

 Passive Attacks - Illustration

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 31

 Taxonomy of Service Attacks

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 32

 Summary of Attacks

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 33

 Common Types of Attacks
1. Malware
2. Phishing
3. Man-in-the-Middle (MitM) Attacks
4. Denial-of-Service (DOS) Attack
5. SQL Injections
6. Zero-day Exploit
7. Password Attack
8. Cross-site Scripting
9. Rootkits
10. Internet of Things (IoT) Attacks
11. DNS Tunneling

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 34

 [Link]
• Malware uses a vulnerability to breach a network -> install malicious software
– Deny access to the critical components of the network
– Obtain information by retrieving data from the hard drive
– Disrupt the system or even render it inoperable
• Common Types of Malware
– Viruses
• Infect applications attaching themselves to the initialization sequence
• Replicates itself, infecting other code in the computer system
– Trojans
• Program hiding inside a useful program with malicious purposes
• Trojan doesn’t replicate itself and it is commonly used to establish a backdoor to be exploited
– Worms
• Self-contained programs that propagate across networks and computers
• installed through email attachments, sending a copy of themselves to every contact in the
infected computer email list
• DoS Attack
– Ransomware
• Denies access to the victim data, threatening to publish or delete it unless a ransom is paid.
– Spyware
• Program installed to collect information about users, their systems or browsing habits, sending
the data to a remote user.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 35

 2. Phishing
• Phishing is the practice of sending fraudulent communications that
appear to come from a reputable source, usually through email.
• Link -> appears to be legit -> once clicked, the personal data
(Authentication information is extracted)
• Types
– Email Phishing
• Register a fake domain that mimics a genuine organization and sends thousands of
generic requests.
– Spear phishing
• Targeted attacks directed at specific companies and/or individuals. (Some
information about the victim is already with them)
– Whaling
• Attacks targeting senior executives and stakeholders within an organization.
– Smishing and vishing
• Smishing involves criminals sending text messages
• Vishing involves telephonic conversations
– Angler phishing
• Fake URLs; cloned websites, posts, and tweets; and instant messaging
– Pharming
• Capture user credentials through a fake login landing page

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 36

 3. Man-in-the-Middle (MitM) Attacks

• Also known as eavesdropping attacks

• Occur when attackers insert themselves
into a two-party transaction.
• Two common points of entry for MitM
attacks:
– On unsecure public Wi-Fi, attackers can
insert themselves between a visitor’s
device and the network. Without
knowing, the visitor passes all
information through the attacker.
– Once malware has breached a device,
an attacker can install software to
process all of the victim’s information.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 37

 4. Denial-of-Service (DOS) Attack
• DoS attacks work by flooding systems, servers,
and/or networks with traffic to overload
resources and bandwidth.
• The system will be unable to process and fulfill
legitimate requests.
• Types
– Application-layer Flood
• An attacker simply floods the service with requests
from a spoofed IP address in an attempt to slow or
crash the service
– Distributed Denial of Service Attacks (DDoS)
• Requests are sent from many clients.
• DDoS attacks often involve many "zombie" machines
which send massive amounts of requests to a service
to disable it.
• Once service is disabled another attack to steal the
data can be initiated.
• Other Attacks
– TCP SYN flood attack, teardrop attack, smurf attack,
DOS Attack
ping-of-death attack, and botnets.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 38

5. SQL Injections
• Attacker inserts malicious code
into a server using server query
language (SQL) forcing the
server to deliver protected
information.
• An attacker could carry out a
SQL injection simply by
submitting malicious code into a
vulnerable website search box.

[Link]-day exploit
• A zero-day exploit hits after a
network vulnerability is
announced but before a patch
or solution is implemented.
• Attackers target the disclosed
vulnerability during this
window of time.
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 39
 7. Password Attack
• By accessing a person’s password, an attacker
can gain entry to confidential or critical data
and systems, including the ability to
manipulate and control said data/systems.
• Password attackers use a myriad of methods
to identify an individual password,
– Social engineering
– Gaining access to a password database
– Testing the network connection to obtain
unencrypted passwords
– Simply by guessing
– Brute-force attack – All possible combinations
– Dictionary attack - When the attacker uses a list
of common passwords to attempt to gain access
to a user’s computer and network.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 40

 8. Cross-site Scripting
• A cross-site scripting
attack sends malicious
scripts into content
from reliable websites.
• The malicious code
joins the dynamic
content that is sent to
the victim’s browser.
• Usually, this malicious
code consists of
Javascript code
executed by the victim’s
browser, but can
include Flash, HTML,
and XSS.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 41

 [Link]
• Rootkits are installed inside legitimate software, where
they can gain remote control and administration-level
access over a system.
• The attacker then uses the rootkit to steal passwords,
keys, credentials, and retrieve critical data.

10. IOT Attacks

• The interconnectedness of things makes it
possible for attackers to breach an entry point and
use it as a gate to exploit other devices in the
network.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 42

 11. DNS Tunneling
• DNS is like a phonebook for the internet, helping
to translate between IP addresses and domain
names.
• DNS tunneling takes advantage of this fact by
using DNS requests to implement a command
and control channel for malware.
• Inbound DNS traffic can carry commands to the
malware, while outbound traffic can exfiltrate
sensitive data or provide responses to the
malware operator’s requests.
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 43
 Security Services
• International Telecommunication Union-Telecommunication
Standardization Sector (ITU-T) provides security services and
mechanism for implementing them.
• Security services and mechanisms are closely related because a
mechanism or combination of mechanisms are used to provide a
service.
• A mechanism can be used in one or more services.
• Types
– X.800
• Service provided by a protocol layer of communication
– RFC 2828
• Communication service that is provided by a system to give a specific kind of
protection to system resources.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 44

 Security Services (Contd…)
• ITU-T (X.800) has defined five services related to the security goals and
attacks we defined in the previous sections.

Protection
against
unauthorized
access to
• Protect data from data.
disclosure attack,
snooping and • Designed to • Peer entity Proof of the origin:
traffic analysis protect data from authentication: The receiver of the data can
attack. modification, Authentication of the
insertion, later prove the identity of the
• Defined by X.800 sender or receiver - sender if denied.
deletion, and
-encompasses replaying. connection Proof of delivery:
confidentiality of • Protect the whole establishment. Sender of data can later prove
the whole message or part • Data origin that data were delivered to
message or part
of the message. authentication: the intended recipient.
Authenticates the
of a message.
Monday, February 6, 2023 source
Instructor: [Link] the data
Kovendan AKP 45
 Security
Services
(Contd…)

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 46

 Security Mechanism
Incorporated into the appropriate Mechanisms that are not specific
protocol layer in order to provide some Security to any particular
of the OSI security services. OSI security service or protocol
Mechanism
layer.
Specific Security Pervasive Security
Mechanism Mechanism
Encipherment: Mathematical
algorithms to transform data. Trusted Functionality: That which is
Digital Signature: To prove the source perceived to be correct with respect to
and integrity of the data unit and protect some criteria.
against forgery Security Label: Designates the security
Access Control: Enforce access rights to
resources. attributes of that resource.
Data Integrity: Assure the integrity of a
data unit or stream of data units. Event Detection: Detection of security-
Authentication Exchange: Ensure the relevant events.
identity of an entity by means of Security Audit Trail: Data collected
information exchange.
Traffic Padding: The insertion of bits and potentially used to facilitate a
into gaps in a data stream. security audit, which is an independent
Routing Control: Selection of particular review and examination of system
physically secure routes. records and
Security [Link] with
Recovery:
Notarization: Trusted third party to requests from mechanisms, such as
assure event handling and management
Monday,certain
February 6,properties
2023 of a dataInstructor: Dr. Kovendan AKP 47
exchange functions, and takes recovery actions.
 Relationship between Security
Services and Security Mechanism

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 48

 Fundamental Security Design Principle
Design Principle Description
Economy of mechanism The design of security measures embodied in both hardware and software should be as simple and small as
possible. -> This makes testing easier.

Fail-safe defaults The default situation is lack of access, and the protection scheme identifies conditions under which access is
permitted.
Complete mediation Every access must be checked against the access control mechanism. Systems should not rely on access decisions
retrieved from a cache.

Open design The design of a security mechanism should be open rather than secret. Eg: Encryption Algorithm must be kept
open to public scrutiny.

Separation of privilege Practice in which multiple privilege attributes are required to achieve access to a restricted resource.

Least privilege Each permission specifies a permitted access to a particular resource. Unless permission is granted explicitly, the
user or process should not be able to access the protected resource.

Least common mechanism The design should minimize the functions shared by different users, providing mutual security.

Psychological acceptability Security mechanisms should be transparent to the users of the system or at most introduce minimal obstruction.

Isolation Public access systems should be isolated from critical resources; Processes and files of individual users should be
isolated from one another; Security mechanisms should be isolated in the sense of preventing access to those
mechanisms.
Encapsulation Specific form of isolation based on object oriented functionality.

Modularity Refers both to the development of security functions as separate, protected modules and to the use of a modular
architecture for mechanism design and implementation.

Layering Multiple, overlapping protection approaches addressing the people, technology, and operational aspects of
information systems.
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 49
Least astonishment Program or user interface should always respond in the way that is least likely to astonish the user.
 Computer Security Strategy
• Comprehensive security strategy involves
three aspects,
– Specification/policy: What is the security scheme
supposed to do?
– Implementation/mechanisms: How does it do it?
– Correctness/assurance: Does it really work?

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 50

 1. Security Policy
• The first step in devising security services and
mechanisms is to develop a security policy.
• Security policy is an informal description of desired
system behavior.
• A security policy is a formal statement of rules and
practices that specify or regulate how a system or
organization provides security services to protect
sensitive and critical system resources.
• Factors involved in development of a security policy,
– The value of the assets being protected
– The vulnerabilities of the system
– Potential threats and the likelihood of attacks

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 51

 1. Security Policy (Contd…)
• Trade-off to be considered for security policy
formulation,
– Ease of use versus security
• All security measures involve some penalty in the area of ease of
use.
• Eg: Remembering of passwords; Firewall -> slow response time;
Virus-checking -> reduces the available processing power or
system crash may occur.
– Cost of security versus cost of failure and recovery
• Direct monetary costs in implementing and maintaining security
measures.
• All of these costs must be balanced against the cost of security
failure and recovery if certain security measures are lacking.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 52

 Categories of Security Policies
Security
Limit of the users towards Policy
the computer resources in a
workplace.
User Policy IT Policy

Rights of the staff and access level to the General

systems Policies
Who should have access to the Server
specific server and with what rights. Policies
Firewall Access
Who should have access to the and
firewall and what type of access Configuration
Policies
Backup
Who is the responsible person for
backup, what should be the backup, Policies
where should be backed up
Users who should have a VPN VPN Policies
access and with what rights.
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 53
 Types of Security Policies
Policy Description
Permissive Policy Medium restriction policy where we as an administrator block just some well-
known ports of malware regarding internet access
Prudent Policy High restriction policy where everything is blocked regarding the internet
access, just a small list of websites are allowed
Acceptance User Policy Regulates the behavior of the users towards a system or network or even a
webpage, so it is explicitly said what a user can do and cannot in a system.
User Account Policy Defines what a user should do in order to have or maintain a specific system. Eg:
Password Rules.
Information Protection Regulates access to information
Policy
Remote Access Policy The user and their branches are outside their headquarters.
Firewall Management Which ports should be blocked, what updates should be taken, how to make
Policy changes in the firewall
Special Access Policy Monitor the special privileges in their systems and the purpose as to why they
have it.
Network Policy Restrict the access of anyone towards the network resource
Email Usage Policy Restrictions in utilization of Email
Software Security
Monday, Policy
February 6, 2023 Software’s installed in the
Instructor: user computer
Dr. Kovendan AKP and what they should have. 54
Types of Security Policies (Contd…)
Policy Description
Virus and Spyware Detect, removes, and repairs the side effects of
Protection policy viruses and security risks by using signatures.
Intrusion Prevention policy Automatically detects and blocks the network attacks
and browser attacks
Application and Device This policy protects a system's resources from
Control applications and manages the peripheral devices that
can attach to a system.
Exceptions policy Ability to exclude applications and processes from
detection by the virus and spyware scans.
Host Integrity policy This policy provides the ability to define, enforce, and
restore the security of client computers to keep
enterprise networks and data secure.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 55

 2. Security Implementation
• Four complementary courses of action
– Prevention
• Wide range of threats in which prevention is a reasonable goal.
• For example, consider the transmission of encrypted data. If a
secure encryption algorithm is used, and if measures are in place
to prevent unauthorized access to encryption keys, then attacks
on confidentiality of the transmitted data will be prevented.
– Detection
• Absolute protection is not feasible, but it is practical to detect
security attacks.
• Eg: Intrusion detection systems designed to detect the presence
of unauthorized individuals logged onto a system.
– Response
• If security mechanisms detect an ongoing attack, such as a denial
of service attack, the system may be able to respond in such a way
as to halt the attack and prevent further damage.
– Recovery
• Use of backup systems, so that if data integrity is compromised, a
prior, correct copy of the data can be reloaded.
Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 56
 3. Assurance and Evaluation
• Assurance
– The degree of confidence one has that the security
measures, both technical and operational aspects, to
protect the system and the information it processes.
– The state of the art in proving designs and
implementations is such that it is not possible to
provide absolute proof.
• Evaluation
– The process of examining a computer product or
system with respect to certain criteria.
– Evaluation involves testing and may also involve
formal analytic or mathematical techniques.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 57

 Security Control
• Security controls are countermeasures or
safeguards used to reduce the chances that a
threat will exploit a vulnerability.
• For example, implementing company-wide
security awareness training.
• The act of reducing risk is also called risk
mitigation.
• The Goals Of Security Controls
– Reduce risks in an organization
– Prevent or reduce the impact of a security incident.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 58

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 59
 Common classifications types of
Security Control functions
• Preventive controls
– Attempt to prevent an incident from occurring.
• Detective controls
– Attempt to detect incidents after they have occurred.
• Corrective controls
– Attempt to reverse the impact of an incident.
• Deterrent controls
– Attempt to discourage individuals from causing an
incident.
• Compensating controls
– Alternative controls used when a primary control is not
feasible.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 60

 Preventative Controls
Preventive Controls Description
Hardening Reducing security exposure and tightening security controls.
Security Awareness The process of providing formal cybersecurity education to
Training your workforce about a variety of information security
threats and your company’s policies and procedures for
addressing them.
Security Guards A person employed by a public or private party to protect
an organization’s assets.
Change Management The methods and manners in which a company describes
and implements change within both its internal and
external processes.
Account Disablement A policy that defines what to do with user access accounts
Policy for employees who leave voluntarily, immediate
terminations, or on a leave of absence.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 61

 Detective Controls
Detective Controls Description
Log Monitoring Diagnostic method used to analyze real-time events or stored
data to ensure application availability and to access the impact of
the change in state of an application’s performance.
SIEM Security Information and Event Management (SIEM) is a set of
tools and services offering a holistic view of an organization’s
information security by of operational logs from various systems.
Trend Analysis The practice of gathering information and attempting to identify
a pattern in the information gathered from an application’s log
output.
Security Audits A measurement that focuses on cyber security standards,
guidelines, and procedures; as well as the implementation of
these controls.
Video Surveillance A system that is capable of capturing digital images and videos
that can be compressed, stored or sent over communication
networks for onsite or remote monitoring.
Motion Detection A device that utilizes a sensor to detect nearby motion. Such a
device is often integrated as a component of a surveillance
system that automatically performs a task or alerts a monitoring
Monday, February 6, 2023 analyst of detected movement.
Instructor: Dr. Kovendan AKP 62
 Corrective Controls
• IPS – Intrusion Prevention System
– A network security technology that monitors
network traffic to detect anomalies in traffic flow.
– IPS security systems intercept network traffic and
can quickly prevent malicious activity by dropping
packets or resetting connections.
• Backups and System Recovery
– Backups and system recovery is the process of
creating and storing copies of data that can be
used to protect organizations against data loss.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 63

 Deterrent Controls
• Deterrent controls reduce the likelihood of a
deliberate attack and is usually in the form of
a tangible object or person.
• Eg:
– Cable Locks
– Hardware Locks
– Video surveillance & guards

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 64

 Compensating Controls
• An alternative method that is put in place to
satisfy the requirement for a security
measure that cannot be readily implemented
due to financial, infrastructure, or simply
impractical to implement at the present time.
• Eg: Encryption, OTP

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 65

 Types of Security Control
• Technical Security Controls
• Administrative Security Controls
• Physical Security Controls

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 66

 Technical Security Controls
• Also known as logic controls
• Use technology to reduce vulnerabilities in hardware
and software.
• Automated software tools are installed and configured
to protect these assets.
• Eg: Encryption; Antivirus And Anti-Malware Software;
Firewalls
• Technical Control Types And Implementation Methods
– Access Control Lists (ACL)
– Configuration Rules

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 67

 Administrative Security Controls
• Administrative security controls refer to policies,
procedures, or guidelines that define personnel
or business practices in accordance with the
organization’s security goals.
• The processes that monitor and enforce the
administrative controls are:
– Management controls: The security controls that
focus on the management of risk and the
management of information system security.
– Operational controls: The security controls that are
primarily implemented and executed by people (as
opposed to systems).

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 68

 Physical Security Controls
• Physical controls are the implementation of security
measures in a defined structure used to deter or
prevent unauthorized access to sensitive material.
• Eg:
– Closed-circuit surveillance cameras
– Motion or thermal alarm systems
– Security guards
– Picture IDs
– Locked and dead-bolted steel doors
– Biometrics (includes fingerprint, voice, face, iris,
handwriting, and other automated methods used to
recognize individuals)

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 69

 Layering Security Controls
• Layering is an approach that combines
multiple security controls to develop what’s
called a defense-in-depth strategy.
• By combining controls into multiple layers of
security you ensure that if one layer fails to
counteract a threat that other layers will help
to prevent a breach in your systems.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 70

 Access Control
• NIST IR 7298
– Defines access control as the process of granting or
denying specific requests to:
– (1) Obtain and use information and related
information processing services; and
– (2) Enter specific physical facilities.
• RFC 4949
– Defines access control as a process by which use of
system resources is regulated according to a security
policy and is permitted only by authorized entities
(users, programs, processes, or other systems)
according to that policy.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 71

 Access Control Principles
Access Control Context
• Authentication:
– Verification that the credentials of a user or other system
entity are valid.
• Authorization:
– The granting of a right or permission to a system entity to
access a system resource.
– This function determines who is trusted for a given
purpose.
• Audit:
– An independent review and examination of system
records and activities in order to test for adequacy of
system controls.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 72

 Access Control Principles
Access Control Policies
• What types of access are permitted, under what circumstances, and by
whom.
• Discretionary access control (DAC)
– Controls access based on the identity of the requestor and on access rules.
• Mandatory access control (MAC)
– Controls access based on comparing security labels (which indicate how
sensitive or critical system resources are) with security clearances (which
indicate system entities are eligible to access certain resources).
• Role-based access control (RBAC)
– Controls access based on the roles that users have within the system and on
rules stating what accesses are allowed to users in given roles.
• Attribute-based access control (ABAC)
– Controls access based on attributes of the user, the resource to be accessed,
and current environmental conditions.

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 73

 Basic Elements of Access Control
• Subject
– Entity capable of accessing objects
– Three classes of subject
• Owner: Creator of a resource – Administrator
• Group: Collection of members who are assigned with access rights.
• World: The least amount of access is granted to users who are able to
access the system but are not included in the categories owner and
group.
• Object
– Resource to which access is controlled.
• Access Right
– The way in which a subject may access an object.
– Read; Write; Execute; Delete; Create; Search

Monday, February 6, 2023 Instructor: Dr. Kovendan AKP 74