ov 11 - 1 copyright © 2011 element k content llc. all rights reserved. system security computer...

OV 11 - 1Copyright © 2011 Element K Content LLC. All rights reserved.

System Security

Computer Security Basics System Security Tools Authentication Methods Encryption Methods


Security Factors

Authorization

Accountability Auditing

Access control


Least Privilege

User 1 User 4

User 2 User 3

Data Entry Clerks Financial Coordinators

Perform their jobwith more access

privileges

Perform their jobwith more access

privileges

Perform their jobwith fewer access

privileges

Perform their jobwith fewer access

privileges


Non-Repudiation

With non-repudiation: Owner or sender of data remains associated with the data Independent verification of sender’s identity Sender is responsible for message and data


Threats

Information Security Threats

Changes toInformation

Interruption ofServices

Interruption ofAccess

Damage toHardware

Damage toFacilities

Unintentionalor intentionalUnintentionalor intentional


Vulnerabilities

Vulnerabilities include: Improperly configured or installed hardware or software Bugs in software or operating systems Misuse of software or communication protocols Poorly designed networks Poor physical security Insecure passwords Unchecked user input Design flaws in software or operating systems

Attacker Unsecured router Information system


Attacks

Physical Security Attacks Software-Based Attacks

Social Engineering Attacks Web Application-Based Attacks

Network-Based Attacks


Risks

Risks include: System loss Power outage Network failure Physical losses


Unauthorized Access

Attacker

Intentional orunintentional

misuse

Intentional orunintentional

misuse

Deliberate attackby outsider

Deliberate attackby outsider


Data Theft

Attacker

Data in transitData in transit

Files on serverFiles on server


Hackers and Attackers

Possess skills to gain access to computersPossess skills to gain access to computers Always malicious intentAlways malicious intent

Hacker Attacker


Permissions

Administrators: Full access

User01: Read-only access

Contractors: No access

Marketing documents


NTFS Permissions

Supports file-level security on Windows operating systems Permissions can be applied either to folders or to individual files. When applied on a folder, these permissions, are applied to the files and

subfolders within it. There are several levels of NTFS permissions, which specify whether users

can: Read files or run applications Write to existing files and Modify, create, or delete files.


Group Policy

Group policy controls workstation, and security features

Group policy controls workstation, and security features


Authentication

Validates an individual’s credentials

to access resources

Validates an individual’s credentials

to access resources


User Name/Password Authentication

Compares user’s credentials against stored credentials

Compares user’s credentials against stored credentials


Strong Passwords

! P a s s 1 2 3 4

Minimum lengthMinimum length

Special charactersSpecial characters

Uppercase letters

Uppercase letters

Lowercase letters

Lowercase letters

NumbersNumbers


Tokens

PINPINUnique valueUnique value

User informationUser information PasswordPassword


Biometrics

Fingerprint scanner Retinal scanner Hand geometry scanner Voice-recognition software Facial-recognition software

Fingerprint Scanner


Multi-Factor Authentication

PasswordPassword

Requires validation of two authentication factors

Requires validation of two authentication factors


Mutual Authentication

Each party verifies another’s identity

Each party verifies another’s identity


SSO

Email

Instant Messaging


EAP

EAP: Hardware-based identifiers for authentication:

Fingerprint scanners Smart Card readers

Different EAP type for each authentication scheme Might need password in addition to physical authentication

Fingerprint scanner


Kerberos

Kerberos server

Ticket

Ticket

User passes credentials to an

authentication server

User passes credentials to an

authentication server


Wireless Authentication Methods

There are three wireless authentication methods: Open system Shared-key 802.1x and EAP


Wireless Authentication Methods (Cont.)



Shared WEP key



Access point RADIUS server Active directory

Request

Response


Encryption

Converts data from cleartext to ciphertext

Converts data from cleartext to ciphertext


Encryption and Security Goals

Encryption supports: Confidentiality Integrity Non-repudiation


Key-Based Encryption Systems

Shared-Key Encryption

Encrypts dataEncrypts data Decrypts dataDecrypts data

Same key on both sidesSame key on both sides


Key-Based Encryption Systems (Cont.)

Key-Pair Encryption

Computer A Computer B


Public key B


Public key A

Exchange public keysExchange public keys

Data encrypted using public key BData encrypted using public key B Data decrypted using private key BData decrypted using private key B3322

11


WEP

Same security as on a wired network without encryption

Same security as on a wired network without encryption


WPA/WPA2

TKIP EAP

TKIP EAP

TKIP provides improved data encryption.EAP provides stronger user authentication.TKIP provides improved data encryption.

EAP provides stronger user authentication.


Digital Certificates

User with Certificate Device with Certificate


Certificate Encryption

11 22

44 33

1. User obtains certificate and keys

2. User shares public key

3. Data encrypted with public key

4. Data decrypted with private key


PKI

CA

CA

Certificates Software Services Other Cryptographic Components

CA

CA issuing user certificates

CA issuing user certificates


Certificate Authentication

11

22

44

33

1. Presents certificate

2. Validates and accepts certificate

3. Issues certificate

4. Certificate authentication is successful

Certificate holder Resource

CA


DES

3 DES keys

Shared DES key

56 bits 8 parity bits

Triple encodingTriple encoding


Encryption Devices

Encryption device (HSM)

Restricts execution of external programs

Restricts execution of external programs


SSL

SSL combines: Digital certificates RSA public-key encryption

SSLSSL


Encryption Using SSL

Request secure connectionRequest secure connection11

Send certificate and public keySend certificate and public key22

Negotiate encryptionNegotiate encryption33

Generates and encrypts a session keyGenerates and encrypts a session key44

Uses session key for data encryptionUses session key for data encryption55


TLS

TCP/IP


Reflective Questions

1. Which of the basic security concepts in this lesson were familiar to

you, and which were new?

2. Can you describe some situations in which you have used basic

security techniques such as authentication, access control, and

encryption, or made use of a security policy?

ov 11 - 1 copyright © 2011 element k content llc. all rights reserved. system security computer...

Documents

content llc

data slide

intentional slide

outsider slide

server slide

access user01

fewer access privileges

access marketing documents