Hans Georg Schaathun: COMM037 Information Security Management

The module
Hans Georg Schaathun
What is Computer Security? Broad interests in information security

COMM037 Information Security Management Multimedia Security,
Steganalysis using Machine Learning,
Security in NFC communications; et
Dr Hans Georg Schaathun cetera
Background in Coding and Cryptography
University of Surrey Linear Codes and Geometry
Codes for Digital Fingerprinting
Autumn 2010 – Week 1 Applications to Robust Watermarking
Dr Hans Georg Schaathun What is Computer Security? Autumn 2010 – Week 1 1 / 43 Dr Hans Georg Schaathun What is Computer Security? Autumn 2010 – Week 1 3 / 43
The module The module
Why «Security Information Management»? Module Objectives

... information security is primarily a management problem,
not a technical one ... At the end of the module, the students will
Whitman & Mattord 2005 be able to identify assets and threats, and assess risks.
be able to communicate clearly and unambiguously about security
Slightly different objectives for different programmes problems and write policy and guidance documents which are
Security Technologies and Application useful to other people in an organisation.
Development of secure systems and security technologies have an understanding of how to relate and adapt information
Implement information security in organisations
systems in general and security solutions in particular to specific
Other modules cover specific security technologies
business processes and requirements to meet overall goals.
Information Systems
Managing information systems in general be aware of the many security pitfalls at the various stages of a
Information security as a special case systems life cycle
Internet Computing be able critically to review security at each stage of the systems
Awareness of emerging technologies and their security challenges lifecycle
Holistic approach to security in distributed systems
The session The problem
Session objectives Yellow Stickers Exercise
Establish a common terminology to discuss (computer) security Sit in groups of 3-5.

Be able to distinguish between vulnerabilities, threats, and attacks Write down all computer security problems that you can think of.
Get a glimpse of the wide range of threats One problem per yellow sticker.
The problem Assets The problem Assets
What is an asset Working with Information Assets
Our focus is on information assets

... but not independent of other assets
Security is always about protecting something Impact on an asset may be
Something of value loss of
Something whic could be damaged or lost damage to
This is we call assets positive effects (e.g. press coverage ⇒ brand awareness)
Information assets (client details, research results, personal letters) Impact on information assets may lead to damage or loss of other
Real assets (money, hardware, software, people, etc.) assets
Intangible assets (brand, goodwill, etc.) password for your Internet bank (information asset)
If you don’t know what your assets are and vice versa
you don’t know what to protect your data centre (physical asset) burns down
Same principles apply to information assets and other assets
Remember the dependencies
The problem Three faces of security The problem Three faces of security
Confidentiality Complete confidentiality
Put your asset (e.g. the computer) in a locked steel box,

set it in concrete,
and sink it in the ocean.
Talking of security, we often think of confidentiality.
Unauthorised entities cannot get information.
Your asset is secret Og OO
passwords O
personal details Data?
??
trade secrets ??

Which of your assets require confidentiality?
Is this good enough?

The information is no good to anyone.
Availability Integrity
Definition (Availability) Definition (Integrity)

The system is accessible and useable upon demand by an authorised The state of the system or data can only be changed by an authorised
entity. entity.
Can we maintain availability and confidentiality at the same time? If integrity is not ensured.
Denial of Service (DoS) attacks violate availability. I could change your bank account to send money to my Swiss bank
E.g. a horde of computers send dummy request to a web server, account.
causing a congestion which prevents legitimate users from using We could forge a file to incriminate the PM.
the web services in a timely fasion. Integrity problems lead to loss of other assets (money and
No confidentiality at stake – server data are public
goodwill)
but not available to the public
You cannot trust your computer.
Potentially costly damage.
The three faces of security Exercise

The CIA Triad
Return to your groups.

Integrity Availability
Take a handful of yellow stickers (not necessarily your own)
Security For each one decide what kind of security problem it is,
Integrity, Confidentiality, Availability?
Two or three of the above?
Confidentiality
Basic ontology Basic ontology
Threats and Threat Sources A basic ontology
owns one
Security incidents happen for a reason Organisation or more Asset
adverse effect on
Threat potential events and actions which could harm the assets t on may be asso-
effec ciated with
e rse
Threats are potential adv caused by
The exist and must be addressed before they are may result in Threat Threat Source
realised
may be re-
Threat Source an entity with a will and potential to cause harm Impact alised through
A threat source will have a motive may exploit
hackers – do it for the challenge Vulnerability
may reduce
thieves – do it for gain
competitors – want to gain a competitive advantage may be reduced by
blackmailers
Without a motive, there is no threat
Control
Fundamental terms A threat scenario
Organisation Yourself or the entity you work for.
Assets The values at stake.

Threat Source Entities with an intent or potential to cause damage.
(Competitors, organised criminals, petty thieves)
Threats What can go wrong? Potential actions of your Threat
Sources
Impact (of an Incident) Realisation of a threat. An actual event (attack

or otherwise) damaging the assets.
Vulnerabilities Weaknesses in your system, increasing the probability
of realising a threat.
Control The countermeasures you take against the threats.
Different Threat Sources Attack types
Three main classes of threat sources Attacks is an important group of incidents (impact)
Adversaries – sentient beings with an intention to cause harm
Honest, but fallible users – accidentally causing harm
Random events – accidents like flood and fire
Common distinction
Security against intentional attacks, i.e. adversaries Modification
Useability user interface design to avoid human error
Interception
Reliability against random events
Fuzzy boundaries between the three
Similar protection mechanisms
Arson and accidental fire
Incident in one area leads to vulnerabilites in others
Useability problems ⇒ misconfigured security mechanisms Interruption Fabrication
Risk analysis Risk analysis
What is Risk? Risk appetite

Consequence and Probability
Probability of an incident How often do we expect the threat to be

realised?
Impact of an incident How serious would the realisation of a threat be?
What would be the damage to the assets?
Risk Product of consequence and probability. Say expected
(average) damage.
Assessing risk Risk management
Risk is the product of two factors. Reduce

Severity (Cost) of the incident. reduce probability
Probability of the incident. reduce impact
Unlikely events may be acceptable, even if serious and costly. Transfer
e.g. insurance – buy out of the risk
Very probable events may be acceptable, if they don’t cost too
much. Accept
just live with it
Controls can reduce either
Probability Avoid
Consequence close the activities which lead to the risk
Reducing risk (controls) Prevention versus Detection
Two ways to reduce risk Perfect prevention is utopia

Reduce probability of damage Always a non-zero probability of damage
Reduce cost of damage Second-line defence
Prevention reduces the probability of damage Detection: identify attacker and/or damage
A threat is blocked by control of a vulnerability Reaction
Maintain a secure state at all times Recovery from the damage
Data never leaks, unauthorised modification impossible, etc. prosecution of the attacker
Compensation for loss
How can we reduce the consequences? Penalties to deter potential attackers
Elements of Detection How do you secure this?
Accountability:
Every user is responsible for his actions
Audit trails are used to trace users accountable
Nonrepudiation:
A user cannot deny previous actions
A payment issued cannot be revoked
An authorisation signed cannot be revoked
Defining Computer Security Defining Computer Security
Definitions Using the word Security
Definition (Gollmann)
Computer Security deals with the prevention and detection of Definitions vary
unauthorised actions by users of a computer system. When you write, define it
When you read, read the definition
Definition (Gollmann (explaining causes)) Don’t use your intuition
Computer Security concerns the measures we can take to deal with
intentional actions by parties behaving in some unwelcome fashion.
Defining Computer Security Exercise
Presenting secure solutions The weekly exercises
Never say this product is secure

... it is secure against something One exercise sheet is given every week.
what scenario is it intended for? To be solved individually and brought to the following session.
which threats have been addressed?
which potential threats have not been controlled? Format may vary
for which applications is it unsuitable? Class discussion on exercises
Peer-assessment
Never say this feature increases security
Group discussions
which threat does it control?
which vulnerability is reduced?
Exercise Exercise
End-of-term assessment Develop an «Information Security» Ontology

Portfolio Exercise Week 1
A portfolio is assessed for 40% of the mark

Include three of the weekly papers Build upon and expand the ontology discussed in the lecture, adding
Two will be announced when teaching is complete the following terms:
One is your choice Event
You may revise the papers using all you have learnt. Risk
You will not have time to solve the exercises from scratch at the Value
end of term.
Risk Appetite
i.e. do exercises every week.
Residual Risk
The portfolio will also include a short, concluding essay
A 2h written, unseen examination for 60% of the mark.

Hans Georg Schaathun: COMM037 Information Security Management

Hochgeladen von

Dokumentinformationen

Originalbeschreibung:

Originaltitel

Copyright

Verfügbare Formate

Dieses Dokument teilen

Dokument teilen oder einbetten

Freigabeoptionen

Stufen Sie dieses Dokument als nützlich ein?

Sind diese Inhalte unangemessen?

Copyright:

Verfügbare Formate

Hans Georg Schaathun: COMM037 Information Security Management

Hochgeladen von

Copyright:

Verfügbare Formate

The module

Hans Georg Schaathun

What is Computer Security? Broad interests in information security

The module The module

Why «Security Information Management»? Module Objectives

Session objectives Yellow Stickers Exercise

Establish a common terminology to discuss (computer) security Sit in groups of 3-5.

The problem Assets The problem Assets

What is an asset Working with Information Assets

Our focus is on information assets

Confidentiality Complete confidentiality

Put your asset (e.g. the computer) in a locked steel box,

Is this good enough?

Definition (Availability) Definition (Integrity)

The three faces of security Exercise

Return to your groups.

Basic ontology Basic ontology

Threats and Threat Sources A basic ontology

Fundamental terms A threat scenario

Organisation Yourself or the entity you work for.

Assets The values at stake.

Impact (of an Incident) Realisation of a threat. An actual event (attack

Basic ontology Basic ontology

Different Threat Sources Attack types

What is Risk? Risk appetite

Probability of an incident How often do we expect the threat to be

Risk analysis Risk analysis

Assessing risk Risk management

Risk is the product of two factors. Reduce

Reducing risk (controls) Prevention versus Detection

Two ways to reduce risk Perfect prevention is utopia

Risk analysis Risk analysis

Elements of Detection How do you secure this?

Definitions Using the word Security

Defining Computer Security Exercise

Presenting secure solutions The weekly exercises

Never say this product is secure

End-of-term assessment Develop an «Information Security» Ontology

A portfolio is assessed for 40% of the mark

Das könnte Ihnen auch gefallen