CHAPTER 1: OVERVIEW

LEARNING OBJECTIVES
• Define confidentiality, integrity, and
availability (CIA triad)
• Identify major threats, attacks, and assets
• Summarize security functional requirements
• Explain fundamental design principles
• Understand attack surfaces and attack trees
• Outline a computer security strategy
 WHAT IS COMPUTER SECURITY?

• NIST DEFINITION:
“The protection afforded to an automated information
system in order to attain the applicable objectives of
preserving the integrity, availability, and confidentiality
of information system resources (includes hardware,
software, firmware, information/data, and
telecommunications).”
 THE CIA TRIAD
The NIST standard FIPS 199 (standards for security categorization
of federal information and information systems) lists following
as the three security objectives for information and for
information systems:
1) Confidentiality – prevent unauthorized disclosure
2) Integrity – prevent unauthorized modification
3) Availability – ensure reliable access to resources
 ADDITIONAL SECURITY CONCEPTS
Beyond the CIA Triad
1. Authenticity: The property of being genuine and verifiable.
2. Verifying that users are who they claim to be and that
information comes from a trusted source.
3. Accountability: The ability to trace the actions of an entity
uniquely back to that entity.
4. Essential for nonrepudiation, deterrence, and forensic analysis
after a security breach.
 EXAMPLES OF SECURITY REQUIREMENTS
(FIPS 199) - CONFIDENTIALITY
High confidentiality:
• Student grade information
• Protected by FERPA (family educational rights and privacy
act).
• If leaked, it can cause serious harm to students’ privacy,
trust, and potentially legal consequences.
• Only authorized students, parents, and necessary staff
should see it.
EXAMPLES OF SECURITY REQUIREMENTS
(FIPS 199) - CONFIDENTIALITY
Moderate confidentiality:
• Student enrollment information
• Still regulated by FERPA, but accessed by more people (administrators,
registrars).
• Less sensitive than grades. Breach causes some damage but not catastrophic.
Low/no confidentiality:
• Directory information (e.G., Student/faculty lists, departmental lists).
• Often publicly available on websites.
• Disclosure causes little or no harm.
EXAMPLES OF SECURITY REQUIREMENTS
(FIPS 199) - INTEGRITY
High integrity:
• Hospital patient allergy information
• Must be accurate — errors could cause serious harm or even death.
• If falsified (malicious nurse/attacker), hospital faces life -threatening risks and legal liability.
• Integrity here is critical.
Moderate integrity:
• Online discussion forum
• Posts could be falsified or defaced.
• Damage: loss of trust, some financial/time costs, but no serious harm.
Low integrity:
• Anonymous online poll (e.G., On news websites)
• Poll results may be manipulated.
• But since polls are informal and unscientific, inaccurate data doesn’t matter much.
EXAMPLES OF SECURITY REQUIREMENTS
(FIPS 199) - AVAILABILITY
High availability:
• Authentication service for critical systems
• If unavailable, employees/customers cannot access systems.
• Results in major financial loss and operational breakdown.
Moderate availability:
• University public website
• If it goes down, it’s embarrassing and inconvenient for students and donors.
• But the university’s core operations continue.
Low availability:
• Online telephone directory lookup
• If it’s offline temporarily, people can use hardcopy directories or call an operator.
• Low impact.
CHALLENGES OF COMPUTER SECURITY
1. Not as simple as it looks:
 Security requirements sound straightforward (confidentiality,
integrity, authentication, nonrepudiation).
 But the mechanisms (e.G., Encryption, signatures, protocols) are
mathematically and technically complex.
2. Attackers think differently:
 Attackers exploit weaknesses by looking at problems from new
angles.
 A system may look secure, but an attacker might bypass it in
unexpected ways.
CHALLENGES OF COMPUTER SECURITY
3. Counterintuitive mechanisms
 Security measures often feel excessive at first glance.
 Example: using multi-step authentication for a simple login.
 Once you understand threats, the complexity becomes justified.
4. Placement of security mechanisms
 Must decide where to apply security:
 Physical (e.G., Firewalls at network entry points).
 Logical (e.G., TCP/IP layers: encryption at application vs. Transport
layer).
CHALLENGES OF COMPUTER SECURITY
5. Secret management
 Security often relies on secret information (like encryption keys).
 Big challenges: key creation, secure distribution, and protection.
 Communication protocols (e.G., Delays, packet loss) can interfere with security
mechanisms.
6. Battle of wits
 Security = attackers vs. Defenders.
 Attackers need to find just one weakness, while defenders must secure all
possible weaknesses.
7. Security investment paradox
 Users/managers see little benefit in security until a breach happens.
 Leads to underinvestment until it’s too late.
 CHALLENGES OF COMPUTER SECURITY
8. Constant monitoring
 Security isn’t “set and forget.”
 Requires ongoing monitoring, updates, and vigilance, which is difficult in busy
organizations.
9. Security as an afterthought
 Too often added after a system is built.
 Retrofitting security is harder and less effective than designing with security in
mind.
10. Usability vs. Security
 Strong security can reduce convenience and efficiency.
 Example: strict password policies frustrate users → they write passwords on sticky
notes, weakening security.
COMPUTER SECURITY TERMINOLOGIES
1. Adversary (threat agent): an entity that attacks, or is a threat to, a system.
2. Attack: an assault on system security that derives from an intelligent threat;
that is, an intelligent act that is a deliberate attempt (especially in the sense
of a method or technique) to evade security services and violate the
security policy of a system.
3. Countermeasure: an action, device, procedure, or technique that reduces a
threat, a vulnerability, or an attack by eliminating or preventing it, by
minimizing the harm it can cause, or by discovering and reporting it so that
corrective action can be taken.
4. Risk: an expectation of loss expressed as the probability that a particular
threat will exploit a particular vulnerability with a particular harmful result.
5. Security policy: a set of rules and practices that specify or regulate how a
system or organization provides security services to protect sensitive and
COMPUTER SECURITY TERMINOLOGIES
6. System resource (asset): data contained in an information system; or a
service provided by a system; or a system capability, such as processing
power or communication bandwidth; or an item of system equipment ( i.E.,
A system component— hardware, firmware, software, or documentation);
or a facility that houses system operations and equipment.
7. Threat: a potential for violation of security, which exists when there is a
circumstance, capability, action, or event, that could breach security and
cause harm. That is, a threat is a possible danger that might exploit a
vulnerability.
8. Vulnerability: a flaw or weakness in a system’s design, implementation, or
operation and management that could be exploited to violate the system’s
security policy.
 ASSETS OF A COMPUTER SYSTEM
Hardware
• Threat: availability
• Example: theft, accidental damage, deliberate sabotage.
• Countermeasures: physical security, administrative controls.
Software
• Threats:
 Availability – program deletion/alteration makes software unusable.
 Integrity – malicious modification (viruses, trojans).
 Confidentiality – piracy, unauthorized copying.
• Countermeasures: backups, configuration management, anti-malware tools.
 ASSETS OF A COMPUTER SYSTEM
Data
• Threats:
 Availability – deletion or corruption of files.
 Confidentiality – unauthorized reads, leakage from statistical databases.
 Integrity – modification or fabrication of records.
• Countermeasures: access control, encryption, auditing, error detection.
Communication lines & networks
• Threats:
 Availability – messages destroyed, network disabled.
 Confidentiality – eavesdropping, traffic analysis.
 Integrity – message modification, replay, fabrication.
• Countermeasures: encryption, authentication protocols, intrusion detection.
 VULNERABILITIES OF ASSETS
Each resource can be vulnerable in three ways, which map to the CIA triad:
Corrupted (integrity issue):
 Data or programs are modified improperly → wrong results.
 Example: a database record is altered maliciously.
Leaky (confidentiality issue):
 Unauthorized disclosure of data.
Example: hackers steal private student information.
Unavailable (availability issue):
 System becomes unusable or too slow.
 Example: a denial-of-service attack prevents access to a website.
 THREATS, ATTACKS, AND ATTACKERS
• Threat: potential harm that could exploit a vulnerability.
• Attack: when a threat is actually carried out.
• Attacker/threat agent: the entity performing the attack.
Types of attacks:
1. Active attack
2. Passive attack
Origin of attacks:
1. Inside attack: from an authorized insider misusing access.
2. Outside attack: from an unauthorized outsider (hackers,
cybercriminals, terrorists, governments).
 THREATS, ATTACKS, AND ATTACKERS
Active attacks (modification / disruption)
Goal: alter or disrupt system resources.
Types:
• Replay – capture and resend old messages.
• Masquerade – pretending to be another entity.
• Modification of messages – altering data (e.G., Changing
permissions).
• Denial of service (dos) – disrupting service, flooding network.
Characteristics:
• Hard to prevent absolutely, since physical protection of all paths is
impossible.
 THREATS, ATTACKS, AND ATTACKERS
Passive attacks (eavesdropping / monitoring)
Goal: learn information, without altering system resources.
Types:
• Release of message contents – attacker reads sensitive data (email,
files).
• Traffic analysis – attacker studies communication patterns
(frequency, size, timing).
Characteristics:
• Hard to detect, since system appears normal.
• Defense = prevention (encryption, secure channels).
 COUNTERMEASURES
Ways to respond to attacks:
• Prevention – stop the attack before it happens (e.G., Firewalls,
access control).
• Detection – identify an attack in progress (e.G., Intrusion detection
systems).
• Recovery – restore normal operations after an attack (e.G.,
Backups, patches).
Note:
• Countermeasures can introduce new vulnerabilities.
• Even after defenses, some residual risk always remains.
• Security is about minimizing that risk to an acceptable level.
FUNCTIONAL REQUIREMENTS FOR COMPUTER
SECURITY (FIPS 200)
FIPS 200 (minimum security requirements for federal information and
information systems) defines 17 areas where organizations must
implement safeguards to protect confidentiality, integrity, and
availability.
1. Access control
Restrict access only to authorized users, processes, and devices —
and limit what actions they can perform.
2. Awareness & training
Ensure users and managers understand security risks, policies, and
responsibilities, and that staff are trained.
3. Audit & accountability
Keep audit logs to detect and investigate unauthorized or
FUNCTIONAL REQUIREMENTS FOR COMPUTER
SECURITY (FIPS 200)
4. Certification, accreditation, & security assessments
Regularly test, evaluate, and authorize systems to ensure
security controls work effectively.
5. Configuration management
Maintain baseline configurations and enforce secure
settings throughout system life cycles.
6. Contingency planning
Have plans for emergency response, backup, and disaster
recovery to maintain availability.
FUNCTIONAL REQUIREMENTS FOR COMPUTER
SECURITY (FIPS 200)
7. Identification & authentication
Verify identities of users, processes, and devices before
granting access.
8. Incident response
Prepare for and handle security incidents: detect, analyze,
contain, recover, and report them.
9. Maintenance
Ensure timely and secure maintenance of systems,
controlling tools and personnel involved.
FUNCTIONAL REQUIREMENTS FOR COMPUTER
SECURITY (FIPS 200)
10. Media protection
Safeguard paper/digital media, limit access, and
sanitize/destroy before reuse/disposal.
11. Physical & environmental protection
Protect physical access and environment — facilities,
utilities, and equipment — against unauthorized access
and hazards.
12. Planning
Document, update, and enforce security plans describing
controls and user responsibilities.
FUNCTIONAL REQUIREMENTS FOR COMPUTER
SECURITY (FIPS 200)
13. Personnel security
Ensure staff and third parties are trustworthy, handle terminations/transfers
securely, and apply sanctions for violations.
14. Risk assessment
Regularly evaluate risks to operations, assets, and individuals, considering new
threats.
15. Systems & services acquisition
Integrate security into the system development life cycle, ensure resources, and
require vendors to use strong security.
16. System & communications protection
Protect data in transit and system boundaries, using secure architectures,
protocols, and design principles.
17. System & information integrity
Detect and fix system flaws, defend against malicious code, and respond to alerts.
 FUNDAMENTAL SECURITY DESIGN PRINCIPLES
(NCAE/NSA/DHS)
1. Economy of Mechanism
• Keep security designs simple and small.
• Simple systems are easier to test, verify, and maintain.
• Complex systems = more chances of hidden vulnerabilities.
2. Fail-Safe Defaults
• Default = deny access until explicitly granted.
• Safer failure mode: if something goes wrong, access is refused (not accidentally granted).
• Example: File systems often use this principle.
3. Complete Mediation
• Every access request must be checked against authorization rules.
• Avoid cached permissions unless authority changes are carefully propagated.
• Example: File reads/writes should always re-check access rights.
 FUNDAMENTAL SECURITY DESIGN PRINCIPLES
(NCAE/NSA/DHS)
4. Open Design
• Security mechanisms should be open to scrutiny.
• Algorithms = public, keys = secret.
• Example: AES encryption algorithm (open, widely reviewed).
5. Separation of Privilege
• Require multiple conditions/credentials for access.
• Example: Multi-factor authentication (password + smart card).
• Also applied by splitting high-privilege tasks into isolated processes.
6. Least Privilege
• Users and processes get only the minimum rights needed.
• Privileges should be temporary (granted only when needed).
• Example: Role-Based Access Control (RBAC).
7. Least Common Mechanism
• Minimize shared resources across users.
• Reduces unintended communication paths and dependencies.
• Example: Separate memory spaces for different processes.
8. Psychological Acceptability
• Security should not make systems too hard to use.
• If mechanisms are intrusive, users may bypass them.
• Good security = intuitive, aligned with user expectations.
 FUNDAMENTAL SECURITY DESIGN PRINCIPLES (NCAE/NSA/DHS)
9. Isolation
• Keep critical resources separate from public ones.
• Apply to:
• Public systems vs. critical data.
• User processes separated.
• Security mechanisms protected from tampering.
10. Encapsulation
• Use object-oriented style: procedures + data objects hidden inside secure modules.
• Internal details accessible only through controlled interfaces.
11. Modularity
• Build security as separate modules.
• Easier to test, update, and upgrade without redesigning the whole system.
• Example: Cryptographic services as reusable modules.
12. Layering (Defense in Depth)
• Use multiple overlapping defenses.
• Even if one control fails, others still protect.
• Example: Firewall + Intrusion Detection + Antivirus.
13. Least Astonishment
• User interfaces should behave in ways that are predictable and intuitive.
• Prevents mistakes and reduces frustration.
• Example: A login system should clearly explain password rules rather than rejecting input unexpectedly.
 ATTACK SURFACES
• All the reachable and exploitable vulnerabilities in a system.
• Basically: every point where an attacker can try to get in.
Examples:
1. Open ports on public servers
2. Services running inside a firewall
3. Software that processes untrusted input (email, XML,
office docs, custom formats)
4. Web interfaces, SQL queries, form fields
5. Employees who can be tricked via social engineering
 CATEGORIES OF ATTACK SURFACES
Network Attack Surface
• Vulnerabilities exposed through networks (LAN, WAN, Internet).
• Includes protocol flaws, DoS attacks, communication disruptions,
intrusions.
Software Attack Surface
• Weaknesses in apps, operating systems, or utilities.
• Focus: Web server software, since it’s a common entry point.
Human Attack Surface
• Vulnerabilities from people (employees, contractors, users).
• Includes social engineering, insider threats, and human errors.
 WHY ATTACK SURFACE ANALYSIS IS IMPORTANT
• Helps measure the scale and severity of threats.
• Guides developers and security analysts in identifying where protections are needed.
• Can help in reducing the surface (fewer exposed services, stricter access).
• Supports defense in depth: multiple protective layers + smaller surface = harder for
attackers.
 ATTACK TREES
• A hierarchical, branching model of possible attacks.
• Root node = attacker’s main goal (e.G., Compromise bank account).
• Branches/subnodes = subgoals or steps needed to reach that goal.
• Leaf nodes = actual attack actions (e.G., Brute force password, steal
smartcard).
Node types:
• And-node → all child conditions must be met.
• Or-node → at least one child condition is enough.
Labels:
branches can include values like cost, difficulty, time, probability → helps
compare different attack strategies.
EXAMPLE: INTERNET BANKING AUTHENTICATION
Root goal: compromise a user ’s bank account.
Attack targets:
• User terminal/user (UT/U) – attacks on user device, credentials, behavior.
• Communication channel (cc) – attacks on network traffic.
• Internet banking server (ibs) – attacks on backend systems.
Five overall attack strategies:
1. User credential compromise
• Stealing pins, tokens, passwords, handwritten notes.
• Malware or phishing to capture login details.
• Sniffing credentials in transit.
2. Injection of commands
• Man-in-the-middle attack between user terminal and server.
• Impersonates user to gain access.
3. User credential guessing
• Brute force login attempts using automated bots.
• Distributed zombie pcs attempt random username/password combos.
4. Security policy violation
• Insider attacks (e.G., Bank employee misusing privileges).
• Weak access controls or poor logging.
5. Use of known authenticated session
• Attacker tricks user into connecting with a preset session ID.
• After authentication, attacker hijacks session to impersonate user.
OVERALL STRATEGY FOR COMPUTER SECURITY
Security is not just about adding technical mechanisms — it’s a three-part process:
1. Specification / policy – what should security achieve?
• A security policy defines rules and practices for protecting assets.
• Can be informal (general desired behavior like confidentiality, integrity, availability) or formal (specific
rules enforceable by technical, managerial, or operational controls).
Security managers must consider:
1. Asset value (what is being protected).
2. System vulnerabilities (weak spots).
3. Threats and likelihood of attacks.
Trade-offs to balance:
• Ease of use vs. Security → stronger security often makes systems less convenient.
• Cost of security vs. Cost of failure/recovery → too little investment may lead to expensive breaches.
Bottom line: security policy is ultimately a business decision, influenced by legal requirements and risk
appetite.
OVERALL STRATEGY FOR COMPUTER SECURITY
2. Implementation / Mechanisms – How does security work?
Security implementation involves four approaches:
• Prevention → stop attacks before they succeed.
Example: encryption prevents eavesdropping if keys are well protected .
• Detection → identify when an attack is happening.
Example: intrusion detection systems, DDoS detection.
• Response → take action once an attack is detected.
Example: block attacker’s IP, shut down compromised accounts .
• Recovery → restore systems after damage.
• Example: backups, restoring correct data, system reinstallation .
3. Correctness / Assurance – Does it really work?
• Assurance → the degree of confidence that security measures work as intended.
o Answers: Does the design meet requirements? Does the implementation match the design?
o Not absolute proof, but confidence supported by models, testing, and analysis.
• Evaluation → testing and analyzing systems against security criteria.
o Ensures mechanisms meet standards.
o Allows comparison between products or systems.
o Uses formal methods (mathematics, logic) plus practical tests.
 SUMMARY
• CIA Triad → Confidentiality, Integrity, Availability
🔹 Assets → Hardware, Software, Data, Networks
🔹 Threats → Corruption, Leakage, Unavailability
• Passive (eavesdropping, traffic analysis)
• Active (replay, masquerade, modification, DoS)
🔹 Security Requirements (FIPS 200) → Access control, Training, Audit, Contingency, Risk
assessment, etc.
🔹 Design Principles → Economy, Fail-safe defaults, Complete mediation, Open design,
Separation/Least Privilege, Isolation, Layering, Psychological acceptability
🔹 Attack Models →
• Attack Surfaces (network, software, human)
• Attack Trees (hierarchical attack strategies)
🔹 Strategy → Policy (what), Mechanisms (how), Assurance (works?)