introduction to cyber security cont. · security attack – an action that compromises security of...
TRANSCRIPT
Slide title
In CAPITALS
50 pt
Slide subtitle
32 pt
Muhammad Rizwan Asghar
July 25, 2019
INTRODUCTION TO
CYBER SECURITY CONT.
Lecture 3
COMPSCI 316
Cyber Security
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
2
FOCUS OF THIS LECTURE
We already discussed computer security
Understand network security
Then, building on these two, we can learn
cyber security
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
3
SCENARIOS WITH LOSS OF SECURITY
Confidentiality
– Low impact
– Medium impact
– High impact
Integrity
– Low impact
– Medium impact
– High impact
Availability
– Low impact
– Medium impact
– High impact
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
4
NETWORK SECURITY
“Network Security is the process of taking physical and
software preventative measures to protect the underlying
networking infrastructure from unauthorized access, misuse,
malfunction, modification, destruction, or improper disclosure,
thereby creating a secure platform for computers, users and
programs to perform their permitted critical functions within a
secure environment”
Source: SANS
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
5
THE OSI* SECURITY ARCHITECTURE
Security attack
– An action that compromises security of the system or
exchanged information
Security service
– A service that enhances security of the system or
exchanged information
Security mechanism
– A mechanism that is designed to detect, prevent, or recover
from a security attack
*OSI stands for Open Systems Interconnection
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
6
TYPES OF SECURITY ATTACKS
Passive
– Release of message content (disclosure)
– Traffic analysis
Active
– Masquerade
– Replay
– Message modification
– Denial of Service (DoS)
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
7
RELEASE OF MESSAGE CONTENT
Source: Network Security Essentials by William Stallings
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
8
TRAFFIC ANALYSIS
Source: Network Security Essentials by William Stallings
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
9
MASQUERADE
Source: Network Security Essentials by William Stallings
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
10
REPLAY
Source: Network Security Essentials by William Stallings
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
11
MESSAGE MODIFICATION
Source: Network Security Essentials by William Stallings
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
12
DENIAL OF SERVICE (DOS)
Source: Network Security Essentials by William Stallings
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
13
SECURITY SERVICES
Authentication
– A process of identifying and verifying whether the communicating entity is
the one it claims to be
Access control (or authorisation)
– A technique used to regulate access to resources
Confidentiality
– Protection of the data
Data integrity
– Ensuring received data is not tampered by unauthorised entities
Non-repudiation
– Protection against denial by communicating entities
Availability
– The property of a system being accessible and usable upon demand
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
14
RELATIONSHIP BETWEEN SECURITY
SERVICES AND ATTACKS
Services
Release of
Message
Content
Traffic
AnalysisMasquerade Replay
Message
Modification
Denial of
Service
Authentication
Access
Control
Confidentiality
(Message)
Confidentiality
(Header)
Data Integrity *
Non-
repudiation
Availability
* Using freshness
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
15
SAMPLE QUESTION
Which one of the following statements is true:
a) Authentication deals with identification and
verification while authorisation gives access
rights
b) Authentication gives access rights while
authorisation deals with identification and
verification
c) Both deal with identification and verification
d) Both give access rights
Answer: a
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
16
SECURITY MECHANISMS
Encryption
– A process of encoding messages in such a way that only
authorised parties can read it
Digital signature
– A cryptographic technique that allows recipients to validate
message authenticity
Access control mechanism
– Techniques for enforcing access rights
Notarisation
– Using a trusted party to assure data exchange
Password
– A secret word or phrase known to an authorised party
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
17
RELATIONSHIP BETWEEN SECURITY
SERVICES AND MECHANISMS
Services
EncryptionDigital
Signature
Access
Control
Mechanism
Notarisation Password
Authentication
Access
Control
Confidentiality
(Message)
Confidentiality
(Header)
Data Integrity
Non-
repudiation
Availability
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
18
WHAT IS CYBER SECURITY?
“Cybersecurity is the collection of tools, policies, security
concepts, security safeguards, guidelines, risk
management approaches, actions, training, best practices,
assurance and technologies that can be used to protect the
cyber environment and organization and user’s assets”
Source: International Telecommunications Union (ITU)
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
19
CYBER SECURITY:
SIMILARITY AND DIFFERENCE
Overlaps with information security [Solms-
COSE13]
– Information security refers to the CIA triad
More specific to cyberspace
Incorporates the human factor
– Relates to the role of human in the security
process
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
20
CYBER SECURITY: WHAT IS NEW?
Cyber security is not only about the CIA triad
Cybercrime
– Causing harm
– Say turning off security system
– Illegal downloads
Cyber bullying
– Harassing in cyberspace
Cyber terrorism
– Threatening or causing significant harm
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
21
CYBER SECURITY STRATEGIES
A matter of global interest
Many countries have defined their cyber
security strategies
US cyber security strategy classifies targeting
critical infrastructure as cyber terrorism
UK’s cyber security strategy covers cyber
bullying
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
22
NZ’s CYBER SECURITY STRATEGY
The New Zealand’s cyber security strategy has
four main goals [NZ-CSS15]:
– Exercising cyber resilience
– Having cyber capabilities
– Improving cyber security
– Increasing international cooperation
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
23
DATA BREACH
The release of confidential or sensitive
information to unauthorised parties
It can occur accidentally, or as the result of a
deliberate attack
May involve social engineering attacks
– Using psychological manipulation to trick people
Example
– 3 Billion Yahoo Accounts Data Breach in 2013: https://www.nytimes.com/2017/10/03/technology/yahoo-
hack-3-billion-users.html
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
24
SAMPLE QUESTION
The release of names, birth dates, and phone
numbers of Yahoo users is:
a) Lack of confidentiality
b) Lack of integrity
c) Lack of availability
d) All of the above
Answer: a
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
25
RESOURCES
Read Chapter 1 of
Computer Security: Principles and Practice
Fourth Edition
William Stallings and Lawrie Brown
Pearson Higher Ed USA
ISBN 1292220635
Read Chapter 1 of
Network Security Essentials – Applications and
Standards
Fourth Edition
William Stallings
Prentice Hall
ISBN 0-13-706792-5
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
26
RESOURCES (2)
[Solms-COSE13] Von Solms, Rossouw, and
Johan Van Niekerk. From information
security to cyber security, Computers &
Security 38 (2013): 97-102 [Download]
[NZ-CSS15] Security and Intelligence Group
(SIG), New Zealand's Cyber Security
Strategy, 2015, available at:
https://dpmc.govt.nz/publications/new-
zealands-cyber-security-strategy
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
27
NEWS & OPINION PIECES
Cyberattack, Cybersecurity and Protecting NZ,
News and Opinion, The University of Auckland,
September, 21, 2018, URL:
https://www.auckland.ac.nz/en/news/2018/09/2
1/cyberattack-cybersecurity-protecting.html
Tips for protection from online scams, News
and Opinion, The University of Auckland, April
18, 2019, URL:
https://www.auckland.ac.nz/en/news/2019/04/1
8/want-protection-from-online-scams.html
Top right
corner for
field
customer or
partner logotypes.
See Best practice
for example.
Slide title
40 pt
Slide subtitle
24 pt
Text
24 pt
5
20 pt
28
Questions?
Thanks for your attention!