IY2760/CS3760: Part 6. IY2760: Part 6

Size: px
Start display at page:

Download "IY2760/CS3760: Part 6. IY2760: Part 6"

Transcription

1 IY2760/CS3760: Part 6 In this part of the course we give a general introduction to network security. We introduce widely used security-specific concepts and terminology. This discussion is based primarily on ISO , the OSI security architecture. Chapter 2 (pages 13-36) of Warwick Ford s Computer Communications Security covers much of the same ground. All of these topics are addressed in the international standard ISO In fact the standard covers a much broader range of topics, including the management of security, which will not be discussed here. 1 2

2 ISO is intended to serve as a security-specific addition to ISO 7498, the OSI reference model. In doing so it defines many securityrelated terms and ideas which are of importance to a variety of application areas, including many not covered by the OSI model. Of particular importance is the terminology it introduces for the description of security services and mechanisms. In the context of this model, a security threat is something that poses a danger to a system s security (where the system incorporates a set of identifiable assets). A security service is selected to meet an identified threat, and a security mechanism is the means by which a service is provided. It is important to note the distinction between a security service, i.e. what is provided for a system, and a security mechanism, i.e. the means by which a service is provided. Hence confidentiality is a service, whereas encryption is a mechanism which can be used to provide confidentiality. In fact encryption can be used to provide other services, and data confidentiality can also be provided by means other than encryption (e.g. by physical protection of data). 3 4

3 A threat is a person, thing, event, or idea which poses some danger to an asset, in terms of that asset s Confidentiality, Integrity, Availability or Legitimate use (CIA + ). An attack is an actual realisation of a threat. Safeguards are measures to protect assets against threats, including: physical controls, mechanisms, policies and procedures. Vulnerabilities are weaknesses in a safeguard, or the absence of a safeguard. Threats can be classified into deliberate (e.g. hacker penetration) and accidental (e.g. a secret message being sent to the wrong address). Deliberate threats can be further sub-divided into passive or active. Passive threats involve monitoring but not alteration of information, e.g. wire-tapping. Active threats involve deliberate alteration of information, e.g. changing the value of a financial transaction. In general passive threats are easier to mount than active ones. There is no universally agreed way to identify or classify security threats. The relevance of different threats will vary from environment to environment. However, we can identify four fundamental threats, which directly relate to the four standard security goals of CIA together with the goal of legitimate use (i.e. ensuring that resources are not used by unauthorised persons or in unauthorised ways). Information leakage. Information is disclosed or revealed to unauthorised parties. Integrity violation. Data consistency is compromised. Denial of service. Legitimate access to resources (e.g. information or processing power) is deliberately impeded. Illegitimate use. A resource is used by an unauthorised person or in an unauthorised way. 5 6

4 We also consider five primary enabling threats, which are significant because a realisation of any of these threats can lead directly to a realisation of one of the four fundamental threats. These threats therefore make possible the fundamental threats. They can be sub-divided into penetration and planting threats; we start by looking at the three penetration threats: Masquerade, where an entity pretends to be a different entity, Bypassing controls, where an attacker exploits system flaws or security weaknesses, in order to acquire unauthorised rights, Authorised violation, where an entity authorised to use a system for one purpose uses it for another, unauthorised purpose. The two planting threats are: Trojan horse, where software contains an invisible part which, when executed, compromises the security of the system, Trapdoor, which is a feature built into a system such that the provision of specific input data allows the security policy to be violated. There are several categories of safeguard (or security control), i.e. a means of protecting resources. Communications security safeguards are another name for the security services we now discuss. Other categories of safeguard include the following. Computer security safeguards, e.g. operating system and database system security facilities. Physical security, e.g. locks or other physical controls, equipment tamper-proofing. Personnel security, e.g. employee screening for sensitive posts, security training and awareness. Administrative security, e.g. controlling the importation of software, procedures for investigating security breaches, audit trail analysis. Media security, e.g. protecting stored data, secure destruction of computer storage media, media scanning for viruses. Emanations security, e.g. radio frequency emanation controls (TEMPEST protection). Life cycle controls, e.g. trusted system design, implementation, evaluation and certification, programming standards and controls, documentation controls. 7 8

5 ISO defines five main categories of security service: authentication, which includes both entity authentication and origin authentication, access control, data confidentiality, data integrity, non-repudiation. There are specific security framework standards (ISO/IEC Parts 2 to 6) corresponding to each of these five categories of service. They give a much more detailed discussion of the general ways in which these services can be provided. One additional topic covered in the frameworks (ISO/IEC Part 7) is security audit. Entity authentication provides corroboration to one entity that another entity is as claimed. This service may be used at the establishment of (or during) a connection, to confirm the identities of one or more of the connected entities. This service provides confidence, at the time of usage only, that an entity is not attempting a masquerade or an unauthorised replay of a previous connection. Origin authentication provides corroboration to an entity that the source of received data is as claimed. However, the service does not, in itself, provide protection against duplication or modification of data units. 9 10

6 This service provides protection against unauthorised use of resources. This protection may be applied to various types of access to a resource, e.g. the use of a communications resource, the reading, writing, or deletion of an information resource, the execution of a processing resource. ISO defines four types of data confidentiality service; all these services provide for the protection of data against unauthorised disclosure. Connection confidentiality. This service provides for the confidentiality of all user data transferred using a connection. Connectionless confidentiality. This service provides for the confidentiality of all user data transferred in a single connectionless data unit (i.e. a packet). Selective field confidentiality. This service provides for the confidentiality of selected fields within user data transferred in either a connection or a single connectionless data unit. Traffic flow confidentiality. This service provides for the confidentiality of information which might be derived from observation of traffic flows

7 ISO defines five types of data integrity service; all these services counter active threats to the validity of transferred data. Connection integrity with recovery. This service provides for the integrity of all user data on a connection, and detects any modification, insertion, deletion or replay of data within an entire data unit sequence (with recovery attempted). Connection integrity without recovery. recovery attempted. As previously but with no Selective field connection integrity. This service provides for the integrity of selected fields within the user data of a data unit transferred over a connection. Connectionless integrity. This service provides integrity assurance to the recipient of a data unit. More specifically, it enables the recipient of a connectionless data unit to determine whether that data unit has been modified. Additionally, a limited form of replay detection may be provided. Selective field connectionless integrity. This service provides for the integrity of selective fields within a single connectionless data unit. ISO defines two types of non-repudiation service. Non-repudiation with proof of origin. The recipient of data is provided with proof of the origin of data. This will protect against any subsequent attempt by the sender to falsely deny sending the data. Non-repudiation with proof of delivery. The sender of data is provided with proof of delivery of data. This will protect against any subsequent attempt by the recipient to falsely deny receiving the data

8 Security mechanisms exist to provide and support security services. ISO divides mechanisms into two types: Specific security mechanisms, i.e. those specific to providing certain security services, and Pervasive security mechanisms, i.e. those not specific to the provision of individual security services. Eight types of specific security mechanism are listed: Encryption mechanisms, Digital signature mechanisms, Access control mechanisms, Data integrity mechanisms, which include Cryptographic check functions, Authentication exchange mechanisms, Traffic padding mechanisms, Routing control mechanisms, and Notarisation mechanisms. We now consider each of these eight classes in a little more detail. In doing so we give some general information about the progress in standardising specific security mechanisms. Specific standards have been developed (and continue to be developed) within ISO/IEC SC27 to provide examples of most of these different classes of mechanism. We do not discuss these standards in any detail in this course

9 Commonly known as encryption or cipher algorithms, these mechanisms can help provide confidentiality of either data or traffic flow information. They also provide the basis for some authentication and key management techniques. A digital signature mechanism consists of two procedures: a signing procedure, and a verifying procedure. Such mechanisms can be used to provide non-repudiation, origin authentication and/or integrity services, as well as being an integral part of some mechanisms to provide entity authentication. Signature mechanisms can be divided into two types: Digital signatures with message recovery, and Digital signatures with appendix

10 These mechanisms can be thought of as a means for using information associated with a client entity and a server entity to decide whether access to the server s resource is granted to the client. Examples of types of access control mechanisms include: access control lists, capabilities and security labels. Two types of data integrity mechanism exist: those concerned with the integrity of a single data unit, and those concerned with protecting the integrity of an entire sequence of data units. The first type of mechanism, e.g. a MAC, can be used to help provide both data origin authentication and data integrity (as well as being an integral part of some authentication exchange and key management mechanisms). Mechanisms of the second type, which must be used in conjunction with mechanisms of the first type, can be used to provide full connectionoriented integrity services. These mechanisms include sequence numbers and time stamps. These mechanisms are necessary since use of a MAC alone will not enable a recipient of data to detect replays of single data units, and, more generally, manipulation of a sequence of data units (including replay, selective deletion and re-ordering)

11 These mechanisms, otherwise known as authentication protocols, can be used to provide entity authentication (as well as being the basis of some key management mechanisms). The term traffic padding describes the addition of bogus data to conceal the volumes of real data traffic. It can be used to help provide traffic flow confidentiality. This mechanism can only be effective if the added padding is enciphered (or otherwise provided with confidentiality)

12 These mechanisms can be used to prevent sensitive data using insecure communications paths. For example, depending on the properties of the data, routes can be chosen so as to use only physically secure network components (sub-networks, relays or links). Data carrying certain security labels may be forbidden to enter certain network components. The integrity, origin and/or destination of transferred data can be guaranteed by the use of a notarisation mechanism. A third party notary, which must be trusted by the communicating entities, will provide the guarantee (typically by applying a cryptographic transformation to the transferred data)

13 ISO gives an indication of which mechanisms are appropriate to the provision of which services in the form of a table. It is important to note that this table is illustrative and not definitive. Obvious omissions include: the possible use of data integrity mechanisms to help provide peer entity authentication and data origin authentication services, and the possible use of encipherment to help provide non-repudiation services (as part of a notarisation mechanism). Part 1 of the ISO table

14 Part 2 of the ISO table. 27

Chap. 1: Introduction

Chap. 1: Introduction Chap. 1: Introduction Introduction Services, Mechanisms, and Attacks The OSI Security Architecture Cryptography 1 1 Introduction Computer Security the generic name for the collection of tools designed

More information

Cryptography and Network Security Sixth Edition by William Stallings

Cryptography and Network Security Sixth Edition by William Stallings Cryptography and Network Security Sixth Edition by William Stallings Chapter 1 Overview The combination of space, time, and strength that must be considered as the basic elements of this theory of defense

More information

Network Security. Network Security Hierarchy. CISCO Security Curriculum

Network Security. Network Security Hierarchy. CISCO Security Curriculum Network Security Network Security Hierarchy Material elaborat dupa: CISCO Security Curriculum Kenny Paterson s Lectures for: M.Sc. in Information Security, Royal Holloway, University of London 1 Objectives

More information

Advanced Topics in Distributed Systems. Dr. Ayman Abdel-Hamid Computer Science Department Virginia Tech

Advanced Topics in Distributed Systems. Dr. Ayman Abdel-Hamid Computer Science Department Virginia Tech Advanced Topics in Distributed Systems Dr. Ayman Abdel-Hamid Computer Science Department Virginia Tech Security Introduction Based on Ch1, Cryptography and Network Security 4 th Ed Security Dr. Ayman Abdel-Hamid,

More information

Cryptography and Network Security

Cryptography and Network Security Cryptography and Network Security Third Edition by William Stallings Lecture slides by Shinu Mathew John http://shinu.info/ Chapter 1 Introduction http://shinu.info/ 2 Background Information Security requirements

More information

SECURITY TRENDS-ATTACKS-SERVICES

SECURITY TRENDS-ATTACKS-SERVICES SECURITY TRENDS-ATTACKS-SERVICES 1.1 INTRODUCTION Computer data often travels from one computer to another, leaving the safety of its protected physical surroundings. Once the data is out of hand, people

More information

Notes on Network Security - Introduction

Notes on Network Security - Introduction Notes on Network Security - Introduction Security comes in all shapes and sizes, ranging from problems with software on a computer, to the integrity of messages and emails being sent on the Internet. Network

More information

Information System Security

Information System Security Information System Security Chapter 1:Introduction Dr. Lo ai Tawalbeh Faculty of Information system and Technology, The Arab Academy for Banking and Financial Sciences. Jordan Chapter 1 Introduction The

More information

Introduction to Internet Security

Introduction to Internet Security Module II. Internet Security Chapter 4 Introduction to Internet Security Web Security: Theory & Applications School of Software, Sun Yat-sen University Outline 4.1 Network Security Architectures Levels

More information

7. Public Key Cryptosystems and Digital Signatures, 8. Firewalls, 9. Intrusion detection systems, 10. Biometric Security Systems, 11.

7. Public Key Cryptosystems and Digital Signatures, 8. Firewalls, 9. Intrusion detection systems, 10. Biometric Security Systems, 11. Content 1.Introduction to Data and Network Security. 2. Why secure your Network 3. How Much security do you need, 4. Communication of network systems, 5. Topology security, 6. Cryptosystems and Symmetric

More information

COSC 472 Network Security

COSC 472 Network Security COSC 472 Network Security Instructor: Dr. Enyue (Annie) Lu Office hours: http://faculty.salisbury.edu/~ealu/schedule.htm Office room: HS114 Email: ealu@salisbury.edu Course information: http://faculty.salisbury.edu/~ealu/cosc472/cosc472.html

More information

Cryptography and Network Security Chapter 1

Cryptography and Network Security Chapter 1 Cryptography and Network Security Chapter 1 Acknowledgments Lecture slides are based on the slides created by Lawrie Brown Chapter 1 Introduction The art of war teaches us to rely not on the likelihood

More information

Table: Security Services (X.800)

Table: Security Services (X.800) SECURIT SERVICES X.800 defines a security service as a service provided by a protocol layer of communicating open systems, which ensures adequate security of the systems or of data transfers. Also the

More information

Security (II) ISO 7498-2: Security Architecture of OSI Reference Model. Outline. Course Outline: Fundamental Topics. EE5723/EE4723 Spring 2012

Security (II) ISO 7498-2: Security Architecture of OSI Reference Model. Outline. Course Outline: Fundamental Topics. EE5723/EE4723 Spring 2012 Course Outline: Fundamental Topics System View of Network Security Network Security Model Security Threat Model & Security Services Model Overview of Network Security Security Basis: Cryptography Secret

More information

Network Security 網 路 安 全. Lecture 1 February 20, 2012 洪 國 寶

Network Security 網 路 安 全. Lecture 1 February 20, 2012 洪 國 寶 Network Security 網 路 安 全 Lecture 1 February 20, 2012 洪 國 寶 1 Outline Course information Motivation Introduction to security Basic network concepts Network security models Outline of the course 2 Course

More information

Content Teaching Academy at James Madison University

Content Teaching Academy at James Madison University Content Teaching Academy at James Madison University 1 2 The Battle Field: Computers, LANs & Internetworks 3 Definitions Computer Security - generic name for the collection of tools designed to protect

More information

Introduction to Security

Introduction to Security 2 Introduction to Security : IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 25 October 2013 its335y13s2l01, Steve/Courses/2013/s2/its335/lectures/intro.tex,

More information

Network Security Essentials

Network Security Essentials Network Security Essentials Fifth Edition by William Stallings Chapter 1 Introduction On War The combination of space, time, and strength that must be considered as the basic elements of this theory of

More information

Cryptography and Network Security Overview & Chapter 1. Network Security. Chapter 0 Reader s s Guide. Standards Organizations.

Cryptography and Network Security Overview & Chapter 1. Network Security. Chapter 0 Reader s s Guide. Standards Organizations. Cryptography and Network Security Overview & Chapter 1 Fifth Edition by William Stallings Lecture slides by Lawrie Brown (with edits by RHB) Chapter 0 Reader s s Guide The art of war teaches us to rely

More information

CSCI 4541/6541: NETWORK SECURITY

CSCI 4541/6541: NETWORK SECURITY 1 CSCI 4541/6541: NETWORK SECURITY COURSE INFO CSci 4541/6541 Tuesdays 6:10pm 8:40pm Bell Hall 108 Office Hours: Tuesdays 2:30pm 4:30pm Dr. Nan Zhang Office: SEH 4590 Phone: (202) 994-5919 Email: nzhang10

More information

INTERNATIONAL TELECOMMUNICATION UNION $!4! #/--5.)#!4)/..%47/2+3 /0%. 3934%-3 ).4%2#/..%#4)/. /3) 3%#52)49 3425#452%!.$!00,)#!4)/.

INTERNATIONAL TELECOMMUNICATION UNION $!4! #/--5.)#!4)/..%47/2+3 /0%. 3934%-3 ).4%2#/..%#4)/. /3) 3%#52)49 3425#452%!.$!00,)#!4)/. INTERNATIONAL TELECOMMUNICATION UNION ##)44 8 THE INTERNATIONAL TELEGRAPH AND TELEPHONE CONSULTATIVE COMMITTEE $!4! #/--5.)#!4)/..%47/2+3 /0%. 3934%-3 ).4%2#/..%#4)/. /3) 3%#52)49 3425#452%!.$!00,)#!4)/.3

More information

INTERNATIONAL TELECOMMUNICATION UNION DATA COMMUNICATION NETWORKS: OPEN SYSTEMS INTERCONNECTION (OSI); SECURITY, STRUCTURE AND APPLICATIONS

INTERNATIONAL TELECOMMUNICATION UNION DATA COMMUNICATION NETWORKS: OPEN SYSTEMS INTERCONNECTION (OSI); SECURITY, STRUCTURE AND APPLICATIONS INTERNATIONAL TELECOMMUNICATION UNION CCITT X.800 THE INTERNATIONAL TELEGRAPH AND TELEPHONE CONSULTATIVE COMMITTEE DATA COMMUNICATION NETWORKS: OPEN SYSTEMS INTERCONNECTION (OSI); SECURITY, STRUCTURE AND

More information

Network Security. Introduction. Security services. Players. Conclusions. Distributed information Distributed processing Remote smart systems access

Network Security. Introduction. Security services. Players. Conclusions. Distributed information Distributed processing Remote smart systems access Roadmap Introduction Network services X.800 RFC 2828 Players Marco Carli Conclusions 2 Once.. now: Centralized information Centralized processing Remote terminal access Distributed information Distributed

More information

544 Computer and Network Security

544 Computer and Network Security 544 Computer and Network Security Section 1: Introduction Dr. E.C. Kulasekere Sri Lanka Institute of Information Technology - 2005 Background Information Security requirements have changed in recent times

More information

Information Security Basic Concepts

Information Security Basic Concepts Information Security Basic Concepts 1 What is security in general Security is about protecting assets from damage or harm Focuses on all types of assets Example: your body, possessions, the environment,

More information

Compter Networks Chapter 9: Network Security

Compter Networks Chapter 9: Network Security Goals of this chapter Compter Networks Chapter 9: Network Security Give a brief glimpse of security in communication networks Basic goals and mechanisms Holger Karl Slide set: Günter Schäfer, TU Ilmenau

More information

Cryptography and Network Security: Overview

Cryptography and Network Security: Overview Cryptography and Network Security: Overview Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/

More information

Introduction to Security. CSS 322 Security and Cryptography

Introduction to Security. CSS 322 Security and Cryptography Introduction to Security CSS 322 Security and Cryptography Contents Terminology and Trends Security Services, Mechanisms and Attacks Who s Who in Network Security CSS 322 - Introduction to Security 2 Computer

More information

TELECOMMUNICATION NETWORKS

TELECOMMUNICATION NETWORKS THE USE OF INFORMATION TECHNOLOGY STANDARDS TO SECURE TELECOMMUNICATION NETWORKS John Snare * Manager Telematic and Security Systems Section Telecom Australia Research Laboratories Victoria TELECOMMUNICATIONS

More information

MANAGEMENT OF SECURE SYSTEMS AND SECURITY WITHIN OSI 1

MANAGEMENT OF SECURE SYSTEMS AND SECURITY WITHIN OSI 1 MANAGEMENT OF SECURE SYSTEMS AND SECURITY WITHIN OSI 1 Chris J. Mitchell Computer Science Department Royal Holloway and Bedford New College University of London Egham Hill Egham Surrey TW20 0EX England

More information

1. Computer Security: An Introduction. Definitions Security threats and analysis Types of security controls Security services

1. Computer Security: An Introduction. Definitions Security threats and analysis Types of security controls Security services 1. Computer Security: An Introduction Definitions Security threats and analysis Types of security controls Security services Mar 2012 ICS413 network security 1 1.1 Definitions A computer security system

More information

Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur

Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Cryptography and Network Security Prof. D. Mukhopadhyay Department of Computer Science and Engineering Indian Institute of Technology, Kharagpur Module No. # 01 Lecture No. # 02 Overview on Modern Cryptography

More information

Security Requirements for Wireless Networks and their Satisfaction in IEEE 802.11b and Bluetooth

Security Requirements for Wireless Networks and their Satisfaction in IEEE 802.11b and Bluetooth Security Requirements for Wireless Networks and their Satisfaction in IEEE 802.11b and Bluetooth Henrich C. Poehls Master s Thesis M.Sc. in Information Security Information Security Group Royal Holloway,

More information

Overview of computer and communications security

Overview of computer and communications security Overview of computer and communications security 2 1 Basic security concepts Assets Threats Security services Security mechanisms 2 Assets Logical resources Information Money (electronic) Personal data

More information

Introduction. -- some basic concepts and terminology -- examples for attacks on protocols -- main network security services

Introduction. -- some basic concepts and terminology -- examples for attacks on protocols -- main network security services Introduction -- some basic concepts and terminology -- examples for attacks on protocols -- main network security services (c) Levente Buttyán (buttyan@crysys.hu) Attack, threat, and vulnerability security

More information

Lesson 4: Introduction to network security

Lesson 4: Introduction to network security Lesson 4: Introduction to network security Dr. Justo Carracedo Gallardo carracedo@diatel.upm.es Technical University of Madrid University Professor at the Telecommunication School (EUITT) What is Network

More information

Lecture II : Communication Security Services

Lecture II : Communication Security Services Lecture II : Communication Security Services Internet Security: Principles & Practices John K. Zao, PhD (Harvard) SMIEEE Computer Science Department, National Chiao Tung University 2 What is Communication

More information

Security Goals Services

Security Goals Services 1 2 Lecture #8 2008 Freedom from danger, risk, etc.; safety. Something that secures or makes safe; protection; defense. Precautions taken to guard against crime, attack, sabotage, espionage, etc. An assurance;

More information

ensure prompt restart of critical applications and business activities in a timely manner following an emergency or disaster

ensure prompt restart of critical applications and business activities in a timely manner following an emergency or disaster Security Standards Symantec shall maintain administrative, technical, and physical safeguards for the Symantec Network designed to (i) protect the security and integrity of the Symantec Network, and (ii)

More information

IC3 - Network Security. IC3 - Network Security. M.Sc. in Information Security Royal Holloway, University of London

IC3 - Network Security. IC3 - Network Security. M.Sc. in Information Security Royal Holloway, University of London IC3 - Network Security M.Sc. in Information Security Royal Holloway, University of London IC3 - Network Security Lecture 1, Part 1 Introduction to Networking 1 2 Objectives of Lecture Networking background

More information

Third Party Security Requirements Policy

Third Party Security Requirements Policy Overview This policy sets out the requirements expected of third parties to effectively protect BBC information. Audience Owner Contacts This policy applies to all third parties and staff, including contractors,

More information

Reference Guide for Security in Networks

Reference Guide for Security in Networks Reference Guide for Security in Networks This reference guide is provided to aid in understanding security concepts and their application in various network architectures. It should not be used as a template

More information

Data Security Incident Response Plan. [Insert Organization Name]

Data Security Incident Response Plan. [Insert Organization Name] Data Security Incident Response Plan Dated: [Month] & [Year] [Insert Organization Name] 1 Introduction Purpose This data security incident response plan provides the framework to respond to a security

More information

Cryptographic Modules, Security Level Enhanced. Endorsed by the Bundesamt für Sicherheit in der Informationstechnik

Cryptographic Modules, Security Level Enhanced. Endorsed by the Bundesamt für Sicherheit in der Informationstechnik Common Criteria Protection Profile Cryptographic Modules, Security Level Enhanced BSI-CC-PP-0045 Endorsed by the Foreword This Protection Profile - Cryptographic Modules, Security Level Enhanced - is issued

More information

Managing internet security

Managing internet security Managing internet security GOOD PRACTICE GUIDE Contents About internet security 2 What are the key components of an internet system? 3 Assessing internet security 4 Internet security check list 5 Further

More information

5.5. Penetration Tests. Report of the Auditor General of the Ville de Montréal to the City Council and to the Urban Agglomeration Council

5.5. Penetration Tests. Report of the Auditor General of the Ville de Montréal to the City Council and to the Urban Agglomeration Council Report of the Auditor General of the Ville de Montréal to the City Council and to the Urban Agglomeration Council 5.5 For the Year Ended December 31, 2013 Penetration Tests 5.5. Penetration Tests Table

More information

Chapter 6: Fundamental Cloud Security

Chapter 6: Fundamental Cloud Security Chapter 6: Fundamental Cloud Security Nora Almezeini MIS Department, CBA, KSU From Cloud Computing by Thomas Erl, Zaigham Mahmood, and Ricardo Puttini(ISBN: 0133387526) Copyright 2013 Arcitura Education,

More information

Part I. Universität Klagenfurt - IWAS Multimedia Kommunikation (VK) M. Euchner; Mai 2001. Siemens AG 2001, ICN M NT

Part I. Universität Klagenfurt - IWAS Multimedia Kommunikation (VK) M. Euchner; Mai 2001. Siemens AG 2001, ICN M NT Part I Contents Part I Introduction to Information Security Definition of Crypto Cryptographic Objectives Security Threats and Attacks The process Security Security Services Cryptography Cryptography (code

More information

Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle. Network Security. Chapter 1 Introduction

Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle. Network Security. Chapter 1 Introduction Chair for Network Architectures and Services Department of Informatics TU München Prof. Carle Network Security Chapter 1 Introduction Questions Who is studying? Bachelor Informatics? / Information Sciences

More information

IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:

IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225

More information

CMSC 421, Operating Systems. Fall 2008. Security. URL: http://www.csee.umbc.edu/~kalpakis/courses/421. Dr. Kalpakis

CMSC 421, Operating Systems. Fall 2008. Security. URL: http://www.csee.umbc.edu/~kalpakis/courses/421. Dr. Kalpakis CMSC 421, Operating Systems. Fall 2008 Security Dr. Kalpakis URL: http://www.csee.umbc.edu/~kalpakis/courses/421 Outline The Security Problem Authentication Program Threats System Threats Securing Systems

More information

HANDBOOK 8 NETWORK SECURITY Version 1.0

HANDBOOK 8 NETWORK SECURITY Version 1.0 Australian Communications-Electronic Security Instruction 33 (ACSI 33) Point of Contact: Customer Services Team Phone: 02 6265 0197 Email: assist@dsd.gov.au HANDBOOK 8 NETWORK SECURITY Version 1.0 Objectives

More information

Information Security Team

Information Security Team Title Document number Add document Document status number Draft Owner Approver(s) CISO Information Security Team Version Version history Version date 0.01-0.05 Initial drafts of handbook 26 Oct 2015 Preface

More information

SY0-201. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users.

SY0-201. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users. system so that an unauthorized individual can take over an authorized session, or to disrupt service to authorized users. From a high-level standpoint, attacks on computer systems and networks can be grouped

More information

Ohio Supercomputer Center

Ohio Supercomputer Center Ohio Supercomputer Center Intrusion Prevention and Detection No: Effective: OSC-12 5/21/09 Issued By: Kevin Wohlever Director of Supercomputer Operations Published By: Ohio Supercomputer Center Original

More information

Information Security

Information Security Information Security Dr. Vedat Coşkun Malardalen September 15th, 2009 08:00 10:00 vedatcoskun@isikun.edu.tr www.isikun.edu.tr/~vedatcoskun What needs to be secured? With the rapid advances in networked

More information

SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Telecommunication security. Framework of security technologies for home network

SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Telecommunication security. Framework of security technologies for home network International Telecommunication Union ITU-T X.1111 TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (02/2007) SERIES X: DATA NETWORKS, OPEN SSTEM COMMUNICATIONS AND SECURIT Telecommunication security Framework

More information

7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security?

7 Network Security. 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework. 7.5 Absolute Security? 7 Network Security 7.1 Introduction 7.2 Improving the Security 7.3 Internet Security Framework 7.4 Firewalls 7.5 Absolute Security? 7.1 Introduction Security of Communications data transport e.g. risk

More information

Network Security. Chapter 1 Introduction. Network Security IN2101. Georg Carle. Course organization

Network Security. Chapter 1 Introduction. Network Security IN2101. Georg Carle. Course organization Chair for Network Architectures and Services Institute for Informatics TU München Prof. Carle Network Security IN101 Prof. Dr.-Ing. Georg Carle Dipl.-Inform. Ali Fessi Institut für Informatik Technische

More information

Draft ITU-T Recommendation X.805 (Formerly X.css), Security architecture for systems providing end-to-end communications

Draft ITU-T Recommendation X.805 (Formerly X.css), Security architecture for systems providing end-to-end communications Draft ITU-T Recommendation X.805 (Formerly X.css), architecture for systems providing end-to-end communications Summary This Recommendation defines the general security-related architectural elements that

More information

Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session One Information Security and Challenges

Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session One Information Security and Challenges Joint Universities Computer Centre Limited ( JUCC ) Information Security Awareness Training- Session One Information Security and Challenges Agenda Overview of Information Security Management Information

More information

THE SECURITY ISSUE. Chris J Mitchell

THE SECURITY ISSUE. Chris J Mitchell THE SECURITY ISSUE Chris J Mitchell Foreword This paper is not intended to be a complete overview of its subject area. It is being prepared as a written accompaniment to a talk to be given at the Value

More information

Network Security. Computer Networking Lecture 08. March 19, 2012. HKU SPACE Community College. HKU SPACE CC CN Lecture 08 1/23

Network Security. Computer Networking Lecture 08. March 19, 2012. HKU SPACE Community College. HKU SPACE CC CN Lecture 08 1/23 Network Security Computer Networking Lecture 08 HKU SPACE Community College March 19, 2012 HKU SPACE CC CN Lecture 08 1/23 Outline Introduction Cryptography Algorithms Secret Key Algorithm Message Digest

More information

Skoot Secure File Transfer

Skoot Secure File Transfer Page 1 Skoot Secure File Transfer Sharing information has become fundamental to organizational success. And as the value of that information whether expressed as mission critical or in monetary terms increases,

More information

Why you need secure email

Why you need secure email Why you need secure email WHITE PAPER CONTENTS 1. Executive summary 2. How email works 3. Security threats to your email communications 4. Symmetric and asymmetric encryption 5. Securing your email with

More information

A Structured Approach to Computer Security *

A Structured Approach to Computer Security * 1 A Structured Approach to Computer Security * Tomas Olovsson Department of Computer Engineering Chalmers University of Technology S-412 96 Gothenburg SWEDEN Technical Report No 122, 1992 ABSTRACT Security

More information

Basics of Internet Security

Basics of Internet Security Basics of Internet Security Premraj Jeyaprakash About Technowave, Inc. Technowave is a strategic and technical consulting group focused on bringing processes and technology into line with organizational

More information

ETSI ETR 232 TECHNICAL November 1995 REPORT

ETSI ETR 232 TECHNICAL November 1995 REPORT ETSI ETR 232 TECHNICAL November 1995 REPORT Source: ETSI TC-NA/STAG Reference: DTR/NA-002507 ICS: 33.020 Key words: Security, terminology, vocabulary Security Techniques Advisory Group (STAG); Glossary

More information

TABLE OF CONTENT. Page 2 of 9 INTERNET FIREWALL POLICY

TABLE OF CONTENT. Page 2 of 9 INTERNET FIREWALL POLICY IT FIREWALL POLICY TABLE OF CONTENT 1. INTRODUCTION... 3 2. TERMS AND DEFINITION... 3 3. PURPOSE... 5 4. SCOPE... 5 5. POLICY STATEMENT... 5 6. REQUIREMENTS... 5 7. OPERATIONS... 6 8. CONFIGURATION...

More information

Security vulnerabilities in the Internet and possible solutions

Security vulnerabilities in the Internet and possible solutions Security vulnerabilities in the Internet and possible solutions 1. Introduction The foundation of today's Internet is the TCP/IP protocol suite. Since the time when these specifications were finished in

More information

Lecture 23: Firewalls

Lecture 23: Firewalls Lecture 23: Firewalls Introduce several types of firewalls Discuss their advantages and disadvantages Compare their performances Demonstrate their applications C. Ding -- COMP581 -- L23 What is a Digital

More information

EPASSPORT WITH BASIC ACCESS CONTROL AND ACTIVE AUTHENTICATION

EPASSPORT WITH BASIC ACCESS CONTROL AND ACTIVE AUTHENTICATION COMMON CRITERIA PROTECTION PROFILE EPASSPORT WITH BASIC ACCESS CONTROL AND ACTIVE AUTHENTICATION Draft Version 1.0 TURKISH STANDARDS INSTITUTION TABLE OF CONTENTS Common Criteria Protection Profile...

More information

Chapter 9: Transport Layer and Security Protocols for Ad Hoc Wireless Networks

Chapter 9: Transport Layer and Security Protocols for Ad Hoc Wireless Networks Chapter 9: Transport Layer and Security Protocols for Ad Hoc Wireless Networks Introduction Issues Design Goals Classifications TCP Over Ad Hoc Wireless Networks Other Transport Layer Protocols Security

More information

Course Content Summary ITN 261 Network Attacks, Computer Crime and Hacking (4 Credits)

Course Content Summary ITN 261 Network Attacks, Computer Crime and Hacking (4 Credits) Page 1 of 6 Course Content Summary ITN 261 Network Attacks, Computer Crime and Hacking (4 Credits) TNCC Cybersecurity Program web page: http://tncc.edu/programs/cyber-security Course Description: Encompasses

More information

Maruleng Local Municipality

Maruleng Local Municipality Maruleng Local Municipality. 22 November 2011 1 Version Control Version Date Author(s) Details 1.1 23/03/2012 Masilo Modiba New Policy 2 Contents ICT Firewall Policy 1 Version Control.2 1. Introduction.....4

More information

Weighted Total Mark. Weighted Exam Mark

Weighted Total Mark. Weighted Exam Mark CMP4103 Computer Systems and Network Security Period per Week Contact Hour per Semester Weighted Total Mark Weighted Exam Mark Weighted Continuous Assessment Mark Credit Units LH PH TH CH WTM WEM WCM CU

More information

Authentication requirement Authentication function MAC Hash function Security of

Authentication requirement Authentication function MAC Hash function Security of UNIT 3 AUTHENTICATION Authentication requirement Authentication function MAC Hash function Security of hash function and MAC SHA HMAC CMAC Digital signature and authentication protocols DSS Slides Courtesy

More information

9. Information Assurance and Security, Protecting Information Resources. Janeela Maraj. Tutorial 9 21/11/2014 INFO 1500

9. Information Assurance and Security, Protecting Information Resources. Janeela Maraj. Tutorial 9 21/11/2014 INFO 1500 INFO 1500 9. Information Assurance and Security, Protecting Information Resources 11. ecommerce and ebusiness Janeela Maraj Tutorial 9 21/11/2014 9. Information Assurance and Security, Protecting Information

More information

A centralized approach to computer network security*

A centralized approach to computer network security* A centralized approach to computer network security* by FRANK R. HEINRICH and DAVID J. KAUFMAN Sysiem Developmeni Corporaiion Santa Monica, California ABSTRACT This paper presents an approach to network

More information

AN OVERVIEW OF VULNERABILITY SCANNERS

AN OVERVIEW OF VULNERABILITY SCANNERS AN OVERVIEW OF VULNERABILITY SCANNERS February 2008 The Government of the Hong Kong Special Administrative Region The contents of this document remain the property of, and may not be reproduced in whole

More information

CNT5412/CNT4406 Network Security. Course Introduction. Zhenhai Duan

CNT5412/CNT4406 Network Security. Course Introduction. Zhenhai Duan CNT5412/CNT4406 Network Security Course Introduction Zhenhai Duan 1 Instructor Professor Zhenhai Duan (duan@cs.fsu.edu) Office: 162 LOV Office hours: 1:00PM to 2:00PM, T/Th Or by appointment Email: duan@cs.fsu.edu

More information

Data Management & Protection: Common Definitions

Data Management & Protection: Common Definitions Data Management & Protection: Common Definitions Document Version: 5.5 Effective Date: April 4, 2007 Original Issue Date: April 4, 2007 Most Recent Revision Date: November 29, 2011 Responsible: Alan Levy,

More information

Network Security. Chapter 1. Prof. Dr.-Ing. Georg Carle Dr. Heiko Niedermayer Cornelius Diekmann, M.Sc. Technische Universität München

Network Security. Chapter 1. Prof. Dr.-Ing. Georg Carle Dr. Heiko Niedermayer Cornelius Diekmann, M.Sc. Technische Universität München Network Security Chapter 1 Prof. Dr.-Ing. Georg Carle Dr. Heiko Niedermayer Cornelius Diekmann, M.Sc. Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik Version: June 13, 2015 IN2101,

More information

Information Technology Cyber Security Policy

Information Technology Cyber Security Policy Information Technology Cyber Security Policy (Insert Name of Organization) SAMPLE TEMPLATE Organizations are encouraged to develop their own policy and procedures from the information enclosed. Please

More information

Security Issues with Integrated Smart Buildings

Security Issues with Integrated Smart Buildings Security Issues with Integrated Smart Buildings Jim Sinopoli, Managing Principal Smart Buildings, LLC The building automation industry is now at a point where we have legitimate and reasonable concern

More information

INFORMATION TECHNOLOGY SECURITY STANDARDS

INFORMATION TECHNOLOGY SECURITY STANDARDS INFORMATION TECHNOLOGY SECURITY STANDARDS Version 2.0 December 2013 Table of Contents 1 OVERVIEW 3 2 SCOPE 4 3 STRUCTURE 5 4 ASSET MANAGEMENT 6 5 HUMAN RESOURCES SECURITY 7 6 PHYSICAL AND ENVIRONMENTAL

More information

Network Security. Dr. Ihsan Ullah. Department of Computer Science & IT University of Balochistan, Quetta Pakistan. March 19, 2015

Network Security. Dr. Ihsan Ullah. Department of Computer Science & IT University of Balochistan, Quetta Pakistan. March 19, 2015 Network Security Dr. Ihsan Ullah Department of Computer Science & IT University of Balochistan, Quetta Pakistan March 19, 2015 Network Security Reference Books Corporate Computer Security (3rd Edition)

More information

Threats and Attacks. Modifications by Prof. Dong Xuan and Adam C. Champion. Principles of Information Security, 5th Edition 1

Threats and Attacks. Modifications by Prof. Dong Xuan and Adam C. Champion. Principles of Information Security, 5th Edition 1 Threats and Attacks Modifications by Prof. Dong Xuan and Adam C. Champion Principles of Information Security, 5th Edition 1 Learning Objectives Upon completion of this material, you should be able to:

More information

E-commerce. Security. Learning objectives. Internet Security Issues: Overview. Managing Risk-1. Managing Risk-2. Computer Security Classifications

E-commerce. Security. Learning objectives. Internet Security Issues: Overview. Managing Risk-1. Managing Risk-2. Computer Security Classifications Learning objectives E-commerce Security Threats and Protection Mechanisms. This lecture covers internet security issues and discusses their impact on an e-commerce. Nov 19, 2004 www.dcs.bbk.ac.uk/~gmagoulas/teaching.html

More information

Please note this policy is mandatory and staff are required to adhere to the content

Please note this policy is mandatory and staff are required to adhere to the content Policy ICT Security Please note this policy is mandatory and staff are required to adhere to the content Summary DECD is committed to ensuring its information is appropriately managed according to the

More information

Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP

Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP Overview Securing TCP/IP Chapter 6 TCP/IP Open Systems Interconnection Model Anatomy of a Packet Internet Protocol Security (IPSec) Web Security (HTTP over TLS, Secure-HTTP) Lecturer: Pei-yih Ting 1 2

More information

Network Security Policy De Montfort University January 2006

Network Security Policy De Montfort University January 2006 Network Security Policy De Montfort University January 2006 Page 1 of 18 Contents 1 INTRODUCTION 1.1 Background... 1.2 Purpose and Scope... 1.3 Validity... 1.4 Assumptions... 1.5 Definitions... 1.6 References..

More information

Threat Modeling. Frank Piessens (Frank.Piessens@cs.kuleuven.be ) KATHOLIEKE UNIVERSITEIT LEUVEN

Threat Modeling. Frank Piessens (Frank.Piessens@cs.kuleuven.be ) KATHOLIEKE UNIVERSITEIT LEUVEN Threat Modeling Frank Piessens (Frank.Piessens@cs.kuleuven.be ) Secappdev 2007 1 Overview Introduction Key Concepts Threats, Vulnerabilities, Countermeasures Example Microsoft s Threat Modeling Process

More information

12 FAM 650 ACQUISITION SECURITY REQUIREMENTS FOR OPERATING SYSTEMS AND SUBSYSTEM COMPONENTS

12 FAM 650 ACQUISITION SECURITY REQUIREMENTS FOR OPERATING SYSTEMS AND SUBSYSTEM COMPONENTS 12 FAM 650 ACQUISITION SECURITY REQUIREMENTS FOR OPERATING SYSTEMS AND SUBSYSTEM COMPONENTS 12 FAM 651 GENERAL (CT:DS-180; 06-20-2012) (Office of Origin: DS/SI/CS) a. Acquisition authorities must follow

More information

Secure cloud access system using JAR ABSTRACT:

Secure cloud access system using JAR ABSTRACT: Secure cloud access system using JAR ABSTRACT: Cloud computing enables highly scalable services to be easily consumed over the Internet on an as-needed basis. A major feature of the cloud services is that

More information

Potential Targets - Field Devices

Potential Targets - Field Devices Potential Targets - Field Devices Motorola Field Devices: Remote Terminal Units ACE 3600 Front End Devices ACE IP Gateway ACE Field Interface Unit (ACE FIU) 2 Credential Cracking Repeated attempts to

More information

Wireless Network Security

Wireless Network Security Wireless Network Security Bhavik Doshi Privacy and Security Winter 2008-09 Instructor: Prof. Warren R. Carithers Due on: February 5, 2009 Table of Contents Sr. No. Topic Page No. 1. Introduction 3 2. An

More information

Understanding and evaluating risk to information assets in your software projects

Understanding and evaluating risk to information assets in your software projects Understanding and evaluating risk to information assets in your software projects ugh.. what a mouthful Dana Epp Windows Security MVP Who am I? Microsoft Windows Security MVP Information Security Professional

More information

UMHLABUYALINGANA MUNICIPALITY PATCH MANAGEMENT POLICY/PROCEDURE

UMHLABUYALINGANA MUNICIPALITY PATCH MANAGEMENT POLICY/PROCEDURE UMHLABUYALINGANA MUNICIPALITY PATCH MANAGEMENT POLICY/PROCEDURE Originator Patch Management Policy Approval and Version Control Approval Process: Position or Meeting Number: Date: Recommended by Director

More information

Introduction to Network Security, Authentication Applications

Introduction to Network Security, Authentication Applications Introduction to Network Security, Authentication Applications Information: is defined as knowledge obtained from investigation, Study or Instruction, Intelligence, news, facts, data, a Signature or Character

More information