Network and Information Security

Computer Security Definition

• Computer security also known as Cyber
security, is the protection of computer systems
and information from unauthorized use, theft
and harm.
 Need of computer Security:
• 1. For prevention of data theft such as bank
account numbers, credit card information,
passwords, work related documents or sheets,
etc.
• 2. To make data remain safe and confidential.
• 3. To provide confidentiality which ensures that
only those individuals should ever be able to view
data they are not entitled to.
 Continue…
4. To provide integrity which ensures that only
authorized individuals should ever be able
change or modify information.
5. To provide availability which ensure that the
data or system itself is available for use when
authorized user wants it.
6. To provide authentication which deals with the
desire to ensure that an authorized individual.
 1.2 Risk and Threat Analysis
• Assets: Any components of computer system
or data which is valuable.

• Vulnerability: A weakness or flaws in a system

that can be exploited by cybercriminals to gain
unauthorized access.
 Continue..
• Threat: It is malicious act (harmful activity) that
aims to corrupt or steal data or disrupt an
system.
• Risk: It involves the potential for loss or
damage to an assets, data.
• Counter Measures: Countermeasures are
strategies and techniques to protect systems
and networks from cyber threat.
 Basic principles of information Security

• Confidentiality-
Confidentiality determines the secrecy of the
information. The principle specifies that only the
sender and receiver will be able to access the
information shared between them.
Confidentiality compromises if an unauthorized
person is able to access a message.
 Confidentiality

For Example, let us consider sender A wants to share some

confidential information with receiver B and the information
gets intercepted by the attacker C. Now the confidential
information is in the hands of C.
 Integrity
• Integrity gives the assurance that the
information received is exact and accurate. If
the content of the message is changed after
the sender sends it but before reaching the
intended receiver, then it is said that the
integrity of the message is lost.
 Integrity

• For example, here user C tampers with a message originally sent

by user A, which is actually destined for user B. user C somehow
manages to access it, change its contents and send the changed
message to user B. user B has no way of knowing that the contents
of the message were changed after user A had sent it. User A also
does not know about this change.
 Availability

• Making sure data is accessible to those who need it.

The principle of availability states that the resources will be

available to authorize party at all times. Information will not
be useful if it is not available to be accessed. Systems
should have sufficient availability of information to satisfy the
user request.
Availability
 Non-Repudiation

• Non-repudiation is a mechanism that prevents the denial

of the message content sent through a network. In some
cases the sender sends the message and later denies it.
But the non-repudiation does not allow the sender to
refuse the receiver.
Non-Repudiation
 Authentication
• Authentication helps to establish proof of identities.
• The Authentication process ensures that the origin of a
message is correctly identified.
• For example, suppose that user C sends a message over the
internet to user B. however, the trouble is that user C had
posed as user A when he sent a message to user B. how
would user B know that the message has come from user C,
who posing as user A?
• This concept is shown in fig. below. This type of attack is called
as Fabrication.
Authentication
 Access Control

• The principle of access control is determined

by role management and rule management.
Role management determines who should
access the data while rule management
determines up to what extent one can access
the data. The information displayed is
dependent on the person who is accessing it.
 Accountability
• The tasks for which an individual is responsible
are part of the overall information security plan. It
is eagerly measurable by a person who has
managerial responsibility for information
assurance. E.g. the policy statements that all
employees must avoid installing outside software
on a company-owned information infrastructure.
The person in charge of information security
should perform periodic checks so that the policy
is being followed.
CIA model for computer security
CIA model for computer security
• Confidentiality – restrict access to un-
authorized individuals
• Integrity – data has not been altered in an
unauthorized manner
• Availability – information can be accessed and
modified by authorized individuals in an
appropriate timeframe
 Virus
• A computer virus is a type of malicious
software (malware) that can spread between
computers and damage data and software.
 Types of Virus…
• File Virus:
This type of virus infects the system by appending itself to the
end of a file. It changes the start of a program so that the
control jumps to its code. After the execution of its code, the
control returns back to the main program. Its execution is not
even noticed. It is also called a Parasitic virus.
• Boot sector Virus:
It infects the boot sector of the system, executing every time
system is booted and before the operating system is
loaded. These are also known as memory viruses as they do
not infect the file systems.
 Types of Virus…
• Source code Virus:
It looks for source code and modifies it to include virus and
to help spread it.
• Polymorphic Virus:
A virus signature is a pattern that can identify a virus(a
series of bytes that make up virus code). So in order to
avoid detection by antivirus a polymorphic virus changes
each time it is installed. The functionality of the virus
remains the same but its signature is changed.
 Types of Virus…
• Encrypted Virus:
In order to avoid detection by antivirus, this type of virus exists in
encrypted form. It carries a decryption algorithm along with it. So
the virus first decrypts and then executes.
• Macro Virus:
Unlike most viruses which are written in a low-level language(like
C or assembly language), these are written in a high-level
language like Visual Basic. These viruses are triggered when a
program capable of executing a macro is run. For example, the
macro viruses can be contained in spreadsheet files.
 Types of Virus…
• Stealth Virus:
It is a very tricky virus as it changes the code that can be used
to detect it. Hence, the detection of viruses becomes very
difficult. For example, it can change the read system call such
that whenever the user asks to read a code modified by a virus,
the original form of code is shown rather than infected code.
• Directory Virus:
This virus is also called File System Virus or Cluster Virus. It
infects the directory of the computer by modifying the path that is
indicating the location of a file.
 The phases of a virus
• Dormant phase: The virus is idle.
• Propagation phase: The virus copies itself into other
programs or system areas on the disk.
• Triggering phase: The virus is activated to perform its
intended function. This can be caused by a variety of
system events.
• Execution phase: The virus performs its function.
 Worm
• A computer worm is a type of malware that can
spread itself across a network without human
intervention.
 A Trojan horse

• A Trojan horse is a type of malware that disguises itself

as a legitimate program to trick users into downloading
and executing it on their systems.
Spyware and Adware (For SYIF)
• Spyware is a type of malicious software
(malware) that secretly collects and sends
a user's personal information to third parties
without their consent.
• Adware is a type of malware that displays
unwanted advertisements on a device, such as
a computer or mobile device.
 Ransomware, Logic Bombs (SYIF)

• A ransomware in cyber security is a payment demanded by

a cyber criminal in exchange for access to a victim's device
or data that has been encrypted or locked by ransomware.

• A logic bomb is a type of malicious code embedded in

software that remains dormant until specific conditions are
met. When triggered, a logic bomb virus executes a
destructive action, such as deleting files or disrupting critical
systems.
 Rootkit, Keylogger (SYIF)
• A rootkit is a type of malware that allows cybercriminals
to gain access to a computer or network without being
detected. Rootkits can be used to steal data, launch
attacks, and give attackers remote control of a machine.

• A keylogger capturing is a form of malware or hardware

that keeps track of and records your keystrokes as you
type.
 Difference Between Worms and Viruses

Basis of
Worms Viruses
Comparison
A Virus is a malicious
A Worm is a form of malware
executable code attached to
that replicates itself and can
Definition another executable file that
spread to different
can be harmless or can
computers via a Network.
modify or delete data.
The main objective of worms
is to eat the system’s
resources. It consumes
The main objective of
system resources such as
Objective viruses is to modify the
memory and bandwidth and
information.
makes the system slow in
speed to such an extent that
 It doesn’t need a host to
It requires a host is needed
Host replicate from one computer
for spreading.
to another.

It is less harmful as
Harmful It is more harmful.
compared.

Detection Worms can be detected and

Antivirus software is used for
and removed by the Antivirus
protection against viruses.
Protection and firewall.
 Worms are executed via Viruses are executed via
Execution
weaknesses in the system. executable files.

Worms generally come from

the downloaded files or Viruses generally come from
Comes from
through a network shared or downloaded files.
connection.
 1. Hampering computer 1. Pop-up windows linking to
performance by slowing malicious websites
down it 2. Hampering computer
Symptoms 2. Automatic opening and performance by slowing
running of programs down it
3. Sending of emails without 3. After booting, starting of
your knowledge unknown programs.
Internet worms, Instant Boot sector viruses, Direct
messaging worms, Email Action viruses, Polymorphic
worms, File sharing worms, viruses, Macro viruses,
Types
and Internet relay chat (IRC) Overwrite viruses, and File
worms are different types of Infector viruses are different
worms. types of viruses
 It does not need human It needs human action to
Interface
action to replicate. replicate.

Its spreading speed is

Its spreading speed is
Speed slower as compared to
faster.
worms.
Type of Attacks:
 Passive attack
• A passive attack is a cyber threat where an attacker
monitors and listens to data transmissions without
changing them.
 Release of message content
• In cybersecurity, the release of message content is a type
of passive attack where an attacker intercepts and
releases confidential information. This can happen when
an attacker monitors unprotected communication
mediums, such as emails, phone calls, or transferred files.
 Traffic Analysis
Traffic analysis is a cyber security technique that involves
analyzing network traffic to learn about the network and its
users.
In a traffic analysis attack, a hacker tries to access the same
network as you to listen all your network traffic. From there,
the hacker can analyse that traffic to learn something about
you. So, unlike with other, more popular attacks, a hacker is
not actively trying to hack into your systems or crack your
password.
Traffic Analysis
Active attack
Masquerade
 Masquerade
• Masquerade attacks are considered one type
of cyber attack in which the attacker disguises
himself to pose as some other person and
accesses systems or data. It could either be
impersonating a legal user or system and
demanding other users or systems to provide
information with sensitive content or access
areas that are not supposed to be accessed
normally.
 Replay Attack
• It is a passive capturing of a message with an objective to
transmit it for the production of an authorized effect. Thus,
in this type of attack, the main objective of an attacker is
saving a copy of the data that was originally present on
that particular network and later on uses it for personal
uses. Once the data gets corrupted or leaked it becomes
an insecure and unsafe tool for its users.
Modification of message
 Modification of message
• This is when someone changes parts of a message
without permission, or mixes up the order of messages, to
cause trouble. Imagine someone secretly changing a letter
you sent, making it say something different. This kind of
attack breaks the trust in the information being sent. For
example, a message meaning “Allow User A to read
confidential file” is modified as “Allow User B to read
confidential file”.
Denial of Service
 Denial of Service
• Denial of Service (DoS) is a form of
cybersecurity attack that involves denying the
intended users of the system or network
access by flooding traffic or requests. In this
DoS attack, the attacker floods a target system
or network with traffic or requests in order to
consume the available resources such as
bandwidth, CPU cycles, or memory and
prevent legitimate users from accessing them.
 Denial of Service
• Denial Of Service (DOS) attacks in which
attacker strive to prevent legal users from
accessing some services, which they are
permitted to or in simple words the attacker
gain access to the network and then lock the
authorized user out.
Man in the middle attack (MITM)
Man in the middle attack (MITM)
• A man-in-the-middle (MITM) attack is a
cyberattack where an attacker intercepts and
alters communications between two parties,
stealing sensitive information.
Man in the middle attack (MITM)
 Sniffing
• This is software or hardware that is used to observe
traffic as it passes through a network on shared
broadcast media.
• It can be used to view all traffic or target specific
protocol, service, or string of characters like logins.
• Some network sniffers are not just designed to
observe the all traffic but also modify the traffic.
• Network administrators use sniffers for monitoring
traffic.
Sniffing
 Sniffing
• A sniffing attack in system hacking is a form of
denial-of-service attack which is carried out by
sniffing or capturing packets on the network,
and then either sending them repeatedly to a
victim machine or replaying them back to the
sender with modifications.
 Spoofing
• Spoofing is a cyber security attack where a
cybercriminal impersonates a trusted entity to gain
access to sensitive information.

Spoofing is a type of cybercriminal activity where someone

or something forges the sender's information and pretends to
be a legal source or other trusted contact for the purpose of
gaining access to personal information, acquiring money,
spreading malware, or stealing data.
Spoofing
 TCP/IP Hacking (Hijack)
• TCP/IP Hijacking is when an authorized user gains access
to a genuine network connection of another user.
• In theory, a TCP/IP connection is established as shown
below
• To hijack this connection, there are two possibilities −
• Find the seq which is a number that increases by 1, but
there is no chance to predict it.
• The second possibility is to use the Man-in-the-Middle
attack which, in simple words, is a type of network sniffing.
For sniffing, we use tools like Wireshark or Ethercap.
•
 TCP/IP Hijacking Process:

• The first major goal of an attacker is to obtain the IPs of two

devices that communicate using the same network or
connection. To do this, the attacker monitors the data
transmission on the network until the IP of the device is
obtained.
• After successfully grabbing the user IP. Hackers can easily
attack the connection.
• In order to gain access to the connection, the hacker put
down the connection of another user through a DOS attack,
and the user’s connection waits for reconnection.
• By spoofing the disconnected user’s IP, hackers can easily
 Backdoor
• A backdoor is a covert way to gain unauthorized
access to a computer system, network, or product
by bypassing normal security measures. Backdoors
can be used to steal data, install malware, or take
control of a system

• Backdoors can be installed through malware,

phishing, or unpatched software. They can be
difficult to detect and may remain unnoticed for
months or years
 Trapdoor
• A trap door is a hidden backdoor in a system that
allows authorized access to specific functionality or
the entire system. Trap doors can be used for
legitimate purposes, such as system maintenance,
or they can be exploited by attackers
 Encryption Attack
• Cryptographic attacks are malicious attempts to
gain access to sensitive information by
compromising the security of cryptographic systems
Importance of Information Classification

• The main reason for classifying is that not all data/information

have the same level of importance or same level of relevance
to an organization.

• Some data are more valuable to the people who make

strategic decisions (senior management) because they aid
them in making long-range or short range business direction
decisions.

.
Importance of Information Classification

• Some data such as trade secrets, formulae (used by scientific or

research organizations) and new product information are so
valuable that their loss could create a significant problem for the
enterprise in the market.

• Classification of information is used to prevent the

unauthorized disclosure and the resultant failure of
confidentiality.
Criteria for information Classification

1. Value: It is the most commonly used criteria for classifying

data in private sector. If the Information is valuable to an
organization it needs to be classified.
2. Age: The classification of the information may be lowered
if the information value decreases over the time.
3. Useful Life: If the information has been made available to
new information, important changes to the information can
be often considered.
4. Personal association: If the information is personally
associated with specific individual or is addressed by a
privacy law then it may need to be classified.
 Classification levels of Information
• Top Secret: The most sensitive level of classification
• Secret: A less sensitive level of classification than Top
Secret
• Confidential: A less sensitive level of classification than
Secret
• Restricted: A level of classification that represents a
degree of sensitivity
• Internal: Data that is used within an organization and is
not intended for public access
• Public: Data that is intended for public access