Fundamentals of Computer Security

Course Code: 20B12CS332

Prof. Charu Gandhi

Lecture 1
 Course Outcome

After completion of the course, you will be able to

• Explain the fundamental concepts of computer security
and malware types
• Identify types of cryptographic techniques and working
of classical cryptosystems
• Describe authentication and access control paradigms
• Apply proactive solutions to security like Firewalls and
IDS
• Describe legal and ethical issues with respect to
information security

Lecture 1
Course Description(Module-wise)

Module Title of Module

No
1 Security basics
2 Introduction to Malware
3 Threats to network communications and basics
of Cryptography
4 Authentication
5 Access control
6 Intrusion detection and response
7 Firewalls
8 Legal and Ethical Issues

Lecture 1
 Recommended Reading Material

 Text Books:
Security in Computing (5th edition), Pfleeger, Pfleeger and
1.
Margulies, Pearson.
Computer Security: Art and Science by Matt Bishop, Addison-
2.
Wesley Educational Publishers Inc
 Reference Books:
Computer Security Fundamentals, (4th Edition), Chuck Easttum,
1.
Pearson Ed.
2. Foundations of Computer Security, David Salomon, Springer
Introduction to Modern Cryptography (2nd edition), Katz and
3.
Lindell, Chapman & Hall/CRC
4. Elements of Computer Security, David Salomon, Springer
Cryptography Theory and Practice (3rd edition), Stinson,
5.
Chapman & Hall/CRC
Lecture 1
Evaluation Criteria

Compone Maximum Marks

nts
T1 20
T2 20
End Term 35
TA 25 (Attendance-10, Quiz -10, Project-05)
Total 100

Lecture 1
What “Security” is all about?

 The “Secure” word was added in English dictionary

in 16th century which is derived from Latin securus
meaning freedom from anxiety.
 Security is about protection of assets
D. Gollmann, Computer Security, Wiley
 Prevention
take measures that prevent your assets from being
damaged/stolen
 Detection
take measures so that you can detect when, how,
and by whom an asset has been damaged/stolen
 Reaction
take measures so that you can recover your assets
Lecture 1
Real World example

 Prevention
Locks at doors, windows, hire a security guard
 Detection
Burglar alarms, missing items, damages items,
closed circuit TV.
 Reaction
Attack on burglar(not recommended ), Call
the police, replace stolen items, make an
insurance claim.

Lecture 1
What is Computer Security?

 It is the protection of assets in computer

Lecture 1
Source: Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by
Pearson Education, Inc. All rights reserved.
Essential Security Objectives

Confidentiality
• Ability of a system to ensure that an asset is viewed
only by authorized user
• Existence of asset
• Access Control
• Resource Hiding
Integrity
• Ability of a system to ensure that an asset is modified
only by authorized user
• Data integrity and Source integrity
• Needs prevention and detection mechanisms
• Correctness and trustworthyness
Availability

• Ability of a system to ensure that an asset can be used

by any authorized user at the desired time
Lecture 1
Additional/Desirable Security Objectives

Authenticity

• Ability of a system to confirm the identity of user

Non Repudiation/
Accountability

• Ability of a system to confirm that a user cannot

convincingly deny when a security breach occurs

Lecture 1
Security Objectives

Lecture 1
Terminologies in security
 Assets
o Items which has some values e.g. hardware, software, data
etc.
o Asset’s values are personal, time dependent and often
imprecise
 Vulnerabilities
o It is a weakness in the system that could be exploited to
cause harm e.g. a server that doesn’t authenticate user
 Threats
o It is a set of circumstances that could cause harm.
o Unintentional human errors, hardware design faults, and
software failures, natural disasters
 Adversary/Threat Agent/Attacker
o An entity that attacks or is a threat to a system (human or
system)
Lecture 2
Terminologies in security
 Attack
o It is an action that exploits a vulnerability.
o Active and passive attacks
o Inside and outsider attacks

 Control/Countermeasures
o It prevent threats from exercising vulnerabilities .
o An action, device, procedure, or technique to remove or
reduce a vulnerability.
 Security Policy
o A set of rules and practices that specify or regulate how a
system or organization provides security services to
protect sensitive and critical system resources.

Lecture 2
Types of harms
 Interception
(confidentiality)
an unauthorized party
(human or not) gains
access to an asset
 Interruption (Availability)
an asset becomes lost,
unavailable, or unusable
 Modification (Integrity)
an unauthorized party
changes the state of an
asset
 Fabrication (Integrity)
an unauthorized party
counterfeits an asset
Lecture 2
From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson
Education, Inc. All rights reserved.
Threats and attacks
• Disclosure : A circumstance or event where an entity gains
access to data for which it is not authorized. (Confidentiality)
Exposure, Interception, Inference, Intrusion
• Deception : A circumstance or event in which an authorized
entity receiving false data and believing it to be true. (Integrity)
Masquerade, Falsification, Repudiation
• Disruption: It effects the availability or system
integrity
Incapacitation, Corruption, Obstruction
• Usurpation : It is seizure. illegal seizure  of resources
(system integrity)
Misappropriation, Misuse
Lecture 2
Types of Threats

Lecture 2
From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson
Education, Inc. All rights reserved.
Types of Attacks

Types of attack

Active Attack Passive Attack

Interrup Modifica Fabricati

tion tion on Interception

Lecture 2
From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson
Education, Inc. All rights reserved.
Types of Attacks based on origin
Inside Attack
 Initiated by an entity inside the
security parameter . Types of attack
 The insider is authorised to
access system resources but uses
them in a way not approved by Inside Outside
Attack Attack
those who granted the
authorisation.
Outside Attack
 Initiated from outside the
perimeter by an unauthorised or
illegitimate user.
 On the Internet, Potential
outside attacker range
Lecture 2
from
From William Stallings and Lawrie Brown. 2007. Computer Security: Principles and Practice (3rd. ed.). Prentice Hall Press,
USA.
Some Common Attacks
Masquerade Attack:
 When an unauthorized entity pretends to be another entity.
 A masquerade attack is any cyber attack that involves the use of a
manipulated, spoofed or stolen user identifier – device, digital
signature, network address etc
 For example, identity theft in financial transaction systems .

Man in the Middle Attack

Attacker monitors the communication between two parties.
A perpetrator positions himself in a conversation between a user and
an application—either to eavesdrop or to impersonate one of the
parties, making it appear as if a normal exchange of information is
underway.
 Attacker can interrupt, modify, fabricate or intercept in the
communication.

Lecture 2
 Denial of Service(DoS) Attack:
Attacker sends large number of requests to a system/server resulting in crashing or inability to perform
ordinary functions or preventing legitimate user from accessing some services which they are eligible for.

 Distributed Denial of Service (DDoS) Attack

When multiple attackers/System generate DoS attack.

Packet Sniffing Attack:

– Attackers only listen to the communication between two legitimate entities for some specific
purpose.

– Sniffing attacks are data thefts perpetrated by capturing network traffic with packet sniffers,
which can illegally access and read unencrypted data. 

 Packet Spoofing/IP Spoofing Attack:

The attacker conceals the source address of the packet and impersonate another
computing system.

Replay Attack:
– When a malicious user captures a sequence of events or some data units and re-sends them for
some specific purpose.  

– The main objective is to trick the system into accepting the retransmission of the data as a legitimate one.

Lecture 1
Some Common Attacks
Phishing Attack:
 Attacker pose as a trusted individual and trick the
legitimate user to open a text, email etc. for stealing
the credentials.

SQL Injection Attack:

 Attacker executes SQL query to manipulate backend
databases to access information that was not
intended for display.

 Brute Force Attack:

 Attacker tries to log into account by trying all possible
passwords until finding the correct login.
Lecture 2
Types of Attackers

Lecture 3
From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson
Education, Inc. All rights reserved.
Method-Opportunity-Motive
Method:
 It answers “how” to accomplish the attack
 the skills, knowledge, tools, and other things with which
to be able to pull off the attack
 Knowledge of systems are widely available

Opportunity:
 It answers “When” to accomplish the attack
 the time and access to accomplish the attack
 Systems available to the public are accessible to them

Motive:
 It answers “Why” to accomplish the attack
 a reason to perform this attack against this system

“Deny the attacker any of these three and the attack will not
succeed”
Lecture 3
From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson
Education, Inc. All rights reserved.
Principles of Computer Security
 Principle of Easiest Penetration:
 An intruder must be expected to use any available means of
penetration.
 This principle implies that computer security specialists must
consider all possible means of penetration
 Principle of Adequate Protection:
 Computer items must be protected to a degree consistent with
their value and only until they loose their value.
 Principle of Effectiveness:
 Controls must be used and used properly to be effective.
 They must be efficient, easy to use, and appropriate.
 Principle of Weakest Link:
 Security can be no stronger than its weakest link.
Lecture 3
From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson
Education, Inc. All rights reserved.
Security Policy
 It defines “Secure” for a system or a set of systems.
 It can be informal or highly mathematical in nature.
 If we consider a computer system as finite state automaton then a
security policy partitions the state of a system into a set of
authorized/secure(s1, s2) and unauthorized/insecure states(s3, s4) with ti
transitions.

 A secure system starts in an authorized state and cannot enter an

unauthorized state.
 A breach of security occurs when a system enters an unauthorized state.
 If we remove the transition t3 from s1-s3 then the system is secure.
Lecture 3
Access Control
 Subject
 Person
 Process
 Program
 Object
 System
 Files
 Emails
 Programs
 Processes
 Access Mode
 Read
 Write
 Execute
Lecture 4
From Security in Computing, Fifth Edition, by Charles P. Pfleeger, et al. (ISBN: 9780134085043). Copyright 2015 by Pearson
Education, Inc. All rights reserved.
Security Policy : Types of Access Control

Discretionary Access Control/

Identity based Access Control (IBAC)

Mandatory Access Control

Originator Controlled Access Control

Lecture 4
Discretionary Access Control
 Also known as Identity based access control
 An individual user can set an access control
mechanism to allow or deny access to an object.
 Identity of subject and object are keys.
 Example:
You are owner of a book. You control the access to the
book because you can allow someone to read it or
not allow to read it. You allow your father to read it but
no one else. It is discretionary access control because
access to book is based on the identity of the
subject(father) requesting read access to the
object(diary). Lecture 4
Mandatory Access Control
 Also known as Rule based access control
 System mechanism controls access to an object.
 An individual user cannot alter the access.
 Rules describe the conditions under which access is
allowed.
 Operating system enforces mandatory access control.
 Example:
You have a driving license and your records are kept in
Transport authority/Traffic Police. Our law allows a court to
access our driving records without the owner’s permission.
It is a mandatory control because the owner of the record
has no control over the court’s accessing the information .
Lecture 4
Originator Access Control
 Based on access rights to the creator of the object.
 Allows the originator to control dissemination of
information.
 The owner of the file has no control over who may
access the file.
 Example:
You have created a file which has some important
code(i.e. you are originator of the file). It is password
protected. You gave this code to a team for completing a
project(team is now owner of the code). Team now owns
the code but cannot access the code without your
password.
Lecture 4