Computer Information Security

(CS-2106)

Introduction to Course
12 September, 2025

Prof. Dr. Atif Jamil

Professor
Computer Science Department,
Dawood UET Karachi
1
Course Contents
• Introduction computer security concepts, OSI security
architecture, classical encryption techniques, Block
Ciphers and Stream cypher, Passive attacks, active
attacks, Symmetric Encryption, RC4, Public key
cryptography DES, Triple DES, AES, Key distribution and
user authentication, cryptographic hash functions MD5,
Digital signatures, Key management and distribution,
User authentication protocols, TLS, Malicious software,
Firewall, HTTPS, S/MIME, Security Attacks, DoS attacks,
Spoofing, Spams, Session Hijacking, Internet Security,
Antiviruses, Digital Immune System, Security in
databases, Cloud security tools and techniques. Real-
world scenarios-based case Studies.
2
Course Books
Recommended Books:
• William Stallings, “Cryptography and Network Security”,
5th/Latest edition, Pearson Prentice Hall
• Behrouz A. Forouzan, “Cryptography and Network
Security”, 2nd /Latest Edition, McGraw Hill.
• William Stallings, “Network Security Essentials:
Applications and Standards”, 4th edition, Pearson
Prentice Hall, or Latest Edition.
• Nader Badawy, “Cryptography and Network Security”,
4th edition or Latest Edition.

3
CLOs and PLO-mapping

Mapping of CLOs and PLOs

S. No. Course Learning outcomes PLOs Blooms Taxonomy

Understand the development of security, traditional

CLO 1 encryption, security attacks and the fundamental security PLO-1 C-2
objectives.
Analyze the security objectives, attacks, and models, so is
CLO 2 able to recognize the security requirements in real-life cases. PLO-2 C-4
.
Illustrate the design and implementation issues of a real-life
CLO 3 PLO-2 C-3
security solution.

4
Security
• The term “security” is used in the sense of
minimizing the vulnerabilities of assets and
resources.
• An asset is anything of value.
• A vulnerability is any weakness that could be
exploited to violate a system or the information it
contains.

5
Marks Distribution

Assessment tools CLO-1 CLO-2 CLO-3 Total

Assignment 1 2.5 2.5

Assignment 2 (CEP) 5 Marks 5

Quiz 01 1 Mark 1

Quiz 02 1.5 Marks 1.5

Mid Exam 5 Marks 10 Marks 15

Final Exam 5 Marks 10 Marks 10 Marks 25

Total 11 Marks 24 Marks 15 Marks

50

6
Information security
• The information stored in physical form requires
physical security mechanisms
— e.g. rugged filing cabinets for paper based filing systems
• With computers managing most of the information,
digital tools are required for ensuring security

7
Network security
• Network or Internet security consists of measures
to prevent, detect, and correct security violations
that involve the transmission of information

8
Security Goals
• Taxonomy of security goals

9
Security Goals
• Confidentiality
— Data Confidentiality: Assures that private or
confidential information is not made available or disclosed
to unauthorized individuals (Data/Information)
— e.g. Banks: hiding data of customers, Industry/Company:
hiding data from competitors etc.
— Confidentiality not only applies to the storage of the
information, it also applies to the transmission of
information
— Privacy: Assures that individuals control or influence
what information related to them may be collected and
stored and by whom and to whom that information may
be disclosed (Personals)

10
Security Goals
• Integrity
— Data Integrity: Assurance that data received is as sent
by an authorized entity
— It means that changes need to be done only by
authorized entities and through authorized mechanisms
— In a bank, when a customer deposits or withdraws
money, the balance of her account needs to be changed
— System Integrity: Assures that a system performs its
intended function in an unimpaired manner, free from
deliberate or inadvertent unauthorized manipulation

11
Security Goals
• Availability
— Assures that systems work promptly and service is not
denied to authorized users.
— The information created and stored by an organization
needs to be available to authorized entities.

• The three concepts (CIA) embody the fundamental

security objectives for both data and for information
and computing services

12
Security Attacks or Threats
• Confidentiality, integrity, and availability can be
threatened by security attacks
• An attack is an action that compromises the security
of information.
• A threat is a danger which could affect the security
of information, leading to potential loss or damage.
• Often attack & threat are used synonymously.

13
Security Attacks

14
Attacks Threatening
Confidentiality
• 2-types of attacks threaten the confidentiality of
information: snooping and traffic analysis.
• Unauthorized user intercept the data during
transmission

15
Attacks Threatening
Confidentiality
• Snooping –An unauthorized access to data or
interception of data
— A file transferred through the Internet may contain
confidential information.
— An unauthorized entity may intercept the transmission and
use the contents for her own benefit.
— To prevent snooping, the data can be made non-
intelligible to the interceptor by using encipherment

16
Attacks Threatening
Confidentiality
• Traffic Analysis – Obtain some information by
monitoring online traffic.
• Although encipherment of data may make it
nonintelligible for the intercepter
• can obtain some other type information by monitoring
online traffic.
— Can find the e-mail address of sender/receiver
— Can collect pairs of requests and responses

17
Attacks Threatening Integrity
• Data integrity can be threatened using Active
Attacks
• Active attacks involve some modification of the data
stream or the creation of a false stream
• Can be subdivided into four categories:
— Masquerade, Replay, modification of messages, and
denial of service

18
Attacks Threatening Integrity
• Modification – After intercepting information the
attacker intercepts the message and changes it.
• Attacker modifies information to make it beneficial
to herself
— For example, a customer sends a message to a bank to
do some transaction. The attacker intercepts the message
and changes the type of transaction to benefit herself.

19
Modification of messages
Attacks Threatening Integrity
• Masquerading or spoofing happens when the
attacker impersonates somebody else.
— For example, an attacker might steal the bank card and
PIN of a bank customer and pretend that she is that
customer.
— Masquerading can be done both at sender and receiver
sides.

20
Masquerade
Attacks Threatening Integrity
• Replaying – the attacker obtains a copy of a
message sent by a user and later tries to replay it.
— For example, a person sends a request to her bank to ask
for payment to the attacker, who has done a job for her.
The attacker intercepts the message and sends it again to
receive another payment from the bank.

21
Replay
Attacks Threatening Integrity
• Repudiation- This attack type is different from others
• Performed by one of the two parties in communication:
— Sender/Receiver of the message might later deny that
transmission of message
— e.g. A bank customer asking her bank to send some money to a
third party but later denying that she has made such a request.
— e.g. a person buys a product from a manufacturer and pays for it
electronically, but the manufacturer later denies having received
the payment and asks to be paid.

22
Attacks Threatening Availability
• Denial of service (DoS) – Attacker seeks to make
information, a machine/network resource unavailable
to its intended users temporarily indefinitely
• Slow down/totally interrupt the service of a system
• Send so many bogus requests to a server that the
server crashes because of the heavy load

23
Passive vs. Active Attacks
• Passive attack:
— Attacker’s goal is just to obtain information
— Attack does not modify data or harm the system, system
continues with its normal operation
— The attack may harm the sender or the receiver
— Attacks that threaten confidentiality -- snooping and traffic
analysis -- are passive attacks
— Difficult to detect, but prevented by data encipherment

24
Passive vs. Active Attacks
• Active attack:
— May change the data or harm the system
— Active Attacks threaten the integrity and availability
— Easier to detect than to prevent, because an attacker can
launch them in a variety of ways

25
Passive vs. Active Attacks

26
OSI Security Architecture
• ITU-T X.800 “Security Architecture for OSI”
• defines a systematic way of defining and providing
security requirements
• Specially, it defines security services related to
security goals, and security mechanisms to provide
these security services

27
Security Services and
Mechanisms
• Security Service
— A service that enhances the security of data processing
systems & information transfers.
• Security Mechanism
— A mechanism that is designed to detect, prevent or
recover from a security attack.
— A mechanism or combination of mechanisms are used to
provide a service.
— A mechanism can be used in one or more services.

28
Security Services
• ITU-T X.800 has defined five common services
related to security goals:

29
Security Services
• Data Confidentiality – designed to protect data
from disclosure attack
— Encompasses confidentiality of the whole message or
part of a message
• Data Integrity – designed to protect data from
modification, insertion, deletion and replaying by
an adversary
— May protect the whole message or part of the message.
• Authentication – This service provides the
authentication of the party at the other end of the
line
— Connection-oriented: Authentication of source &
destination and connection-less: Only source node 30
Security Services
• Nonrepudiation – Service protects against
repudiation by either sender/receiver of the data
— Proof of origin: Receiver of the data can later prove the
identity of the sender if denied
— Proof of delivery: Sender of data can later prove that data
were delivered to the intended recipient

• Access Control – provides protection against

unauthorized access to data
— The term access can involve reading, writing, modifying,
executing programs, and so on.

31
Security Mechanisms
ITU-T X.800 also defines some security mechanisms
to provide the security services.

32
Security Mechanisms
• Encipherment – Hiding or covering data, can
provide confidentiality.
— Two techniques – cryptography and steganography
• Data Integrity – Mechanism appends to the data
a short checkvalue (created by a specific process
from the data itself)
— The receiver receives the data and the checkvalue.
— Creates a new checkvalue from the received data
— Compares newly created checkvalue with one received
— If the two checkvalues are the same, the integrity of data
has been preserved.

33
Security Mechanisms
• Digital signature c A means by which the sender
can electronically sign the data and the receiver can
electronically verify the signature

• Authentication exchange–Two entities exchange

some messages to prove their identity to each other

• Traffic padding –Inserting some bogus data into

the data traffic to thwart the adversary’s attempt to
use the traffic analysis

34
Security Mechanisms
• Routing control means selecting and continuously
changing different available routes between the
sender and the receiver to prevent the opponent
from eavesdropping on a particular route

• Notarization means selecting a third trusted party

to control the communication between two entities
— This can be done, for example, to prevent repudiation.

• Access control uses methods to prove that a user

has access right to the data or resources owned by
a system
35
— Examples of proofs are passwords and PINs
Relationship between Services
and Mechanisms

36
Relationship between Services &
Mechanisms

37
Relationship btw Services & OSI
Layers

38
Techniques
• Mechanisms discussed so far are only theoretical
recipes to implement security.
• The actual implementation of security goals needs
some techniques.
• Two techniques are prevalent today:
— Cryptography  Focus of this course
— Steganography

39
Cryptography
• Cryptography, a word with Greek origins, means
“secret writing.”
• However, we use the term to refer to the science
and art of transforming messages to make them
secure and immune to attacks.

40
Steganography

• The word steganography, with origin in Greek,

means “covered writing,” in contrast with
cryptography, which means “secret writing.”

Example: covering data under color image

41