Definition of Network Security The NIST Computer Security Handbook [NIST95] defines the term computer security as follows: “The protection afforded to an automated information system in order to attain the applicable objectives of preserving the integrity, availability, and confidentiality of information system resources (including hardware, software, firmware, information/data, and telecommunications)”. This definition introduces three key objectives that are at the heart of computer security. Confidentiality Integrity Availability What is Security? According to Dictionary.com, security is: Freedom from risk or danger; safety. Freedom from doubt, anxiety, or fear; confidence. Something that gives or assures safety, as: A group or department of private guards: Call building security if a visitor acts suspicious. Measures adopted by a government to prevent attack. Measures adopted, as by a business or homeowner, to prevent a crime such as burglary or assault.…etc. “A System is secure if resources are used and accessed as intended under all circumstances” (Silberschatz, Galvin and Gagne) What is Network Security? Network Security is the process of taking physical and software preventative measures to protect the underlying networking infrastructure from unauthorized access, misuse, malfunction, modification, destruction, or improper disclosure, thereby creating a secure platform for computers, users and programs to perform their permitted critical functions within a secure environment. Networking infrastructure: Servers Databases/Information (files, data, communication media) User accounts/passwords Configurations/setting Some Examples User A transmits a file (containing sensitive information) to user B. User C, who is not authorized to read the file, is able to monitor the transmission. Administrator D sends a message to computer E for updating an authorization file. User F intercepts the message, alters its contents to add or delete entries, and then forwards the message to computer E. User E accepts the message and update the authorization file Rather than intercept, User F constructs its own message and send it to E. Security Attack Categories Security attacks can be categorized into the following categories: Interruption (attack on availability) Interception ( attack on confidentiality) Modification ( attack on integrity) Fabrication (Attack on authenticity) Interruption Attack on availability An asset of the system is destroyed or becomes unavailable or unusable. Examples: The destruction of hardware (disk or wire), The cutting of a communication line, or swamping/flooding of a computer communication link with packets. Interception Attack on confidentiality This term covers two related concepts: Data Confidentiality: Assures that private or confidential information is not made available or disclosed to unauthorized individuals or groups. Privacy: Assures that individuals control or influence what information related to them may be collected and stored and by whom and to whom that information may be disclosed. Examples: Wiretapping to capture data in a network and the unauthorized copying of files or programs Modification Attack on integrity This term covers two related concepts: Data integrity: Assures that information and programs are changed only in a specified and authorized manner. System integrity: Assures that a system performs its intended function in an unimpaired or normal manner, free from deliberate or inadvertent unauthorized manipulation of the system. Examples: Changing data files, altering a program so that it performs differently, modifying the contents of a message Fabrication Attack on authenticity If an unauthorized party gains access to the asset and insert a counterfeit/fake object into the system Examples: The insertion of spurious/deceiving messages in a network or the insertion of records in data files. Security Violation Categories Breach of confidentiality: (If unauthorized users read personal data, this breach is the breach of confidentiality). Or unauthorized reading of data Breach of integrity: Unauthorized modification of data Breach of availability: Unauthorized destruction of data Theft of service: Unauthorized use of resources. (when unauthorized users access resources) Denial of service (DOS): Prevention of legitimate use (A server is attacked with so many fake requests that the server becomes irresponsive to the legitimate users, thus there becomes denial or refusal of server to the authorized or genuine users) Security Measure Levels It is impossible to have absolute security, but make sure to be prepared enough to detect most of the intruders. Security must occur at four levels to be effective: Physical : Locks, Security Cameras, doors, Data centers, servers, connected terminals Human: Avoid social engineering, phishing, dumpster diving Operating System: Protection mechanisms, debugging Network: Intercepted communications, interruption, DOS (Since most of the computers are connected to the networks or Internet, there are so many attacks coming from this side. Hence, the networks need to be secured with appropriate solutions). Note Phishing: Phishing is a fraudulent attempt, usually made through email, to steal your personal information. Phishing emails usually appear to come from a well-known organization and ask for your personal information — such as credit card number, social security number, account number or password. Dumpster or Dumpster Diving: is a technique used to retrieve information that could be used to carry out an attack on a computer network. Dumpster diving isn't limited to searching through the trash for obvious treasures like access codes or passwords written down on sticky notes