Lecture 01 Information Security BS computer Science

Information Security

1. Lecture 01
InformationSecurity
1

2. 2

3. 3
WhatisSecurity?
•Thestateofbeingfreefromdangeror
threat
•Freedomformthreat
Ingeneral,securitymeansbeingfree
from danger.Tobesecureistobe
protectedfrom theriskofloss,damage,
unwanted modificationorother
hazards.

4. Securityiseverywhere..
4

5. Whatis
privacy
•Astateinwhichoneisnotobserved ordisturbedby
other.
•Securityisthetechnicalmethodsusedtoprotectthedata
and notconcernedwithhowandwhenitused.
•PrivacyishowanorganizationprocessPersonal
Datato complywithlaws,regulations.
5

6. •Securitycanbeachievedwithoutprivacy
but Privacycannotbeachievedwithout
security.
6

7. 7

8. WhatisInformation
Security?
8

9. 9
DescriptionofInfoSec
•Informationsecurity(sometimesreferred
toas InfoSec)
–coversthetoolsandprocesses
•Itincludespolicysettings
–Preventunauthorizedpeoplefrom
accessing businessorpersonal
information
•Protectssensitiveinformation
–includinginspection,modification,recording,
and anydisruptionordestruction

10. 10
•Theconsequencesofsecurity
incidents include
–Theftofprivateinformation
–Datatampering
–Datadeletion
–Attackscandisruptworkprocessesand
damagea company’sreputation,andalso
haveatangible cost
•Organizationsmustallocatefundsfor
security
–Ensurethattheyarereadytodetect,
respondto, andproactivelyprevent,attacks
suchas
•Phishing,malware,viruses,maliciousinsidersetc.

11. Termswe
heard….
NETWORK
SECURITY
11
INFORMATION
SECURITY

12. 12

13. 13
DifferenceBetweenCyberSecurity,
Network Security,andInformation
Security
Sr.# CyberSecurity NetworkSecurity InformationSecurity
01.
Cybersecurityisthemethod
ofprotectingsystems,
networks,andprogramsfrom
digitalattacks.
NetworkSecurityisthe
methodofprotectingthe
usabilityandintegrityof
yournetworkanddata.
Informationsecurityisthe
measurestakentoprotect
therecordsfrom
unauthorizedentryand
use.
02.
CyberSecurityisasubpartof
InformationSecurity.
NetworkSecurityisa
subpartofCyberSecurity.
CyberSecurity&
NetworkSecuritycomes
underInformation
Security.
03.
Itprotectsanythinginthe
cyberarea.
Itprotectsanythinginthe
networkarea.
Informationsecurityisfor
informationirrespectiveof
thespace.

14. 14
Sr.# CyberSecurity NetworkSecurity InformationSecurity
04.
Itdealswithprotectionfrom
cyberattacks.
Itdealswithprotection
fromDOS(Denialof
Service)attacks.
Itdealswiththesecurity
ofdatafromanykindof
threat.
05.
Cybersecurityattacks
againstcybercrimeand
cyberfraud.
NetworkSecurityattacks
againsttrojans.
InformationSecurity
attacksagainst
unauthorizedaccess,
disclosuremodification,
anddisruption.
06.
Cybersecurityensures the
securityoftheentiredigital
data.
Networksecurityonly
ensuresthesecurityof
transitdata.
Informationsecurity
ensurestheprotectionof
transitanddigitaldata.

15. 15
Sr.# CyberSecurity NetworkSecurity InformationSecurity
07.
Itdealswiththesecurityof
thedataresting.
Itsecuresdatatraveling
acrossthenetworkby
terminals.
Itgivesintegrity,
confidentiality,and
availability.
08.
CommonCyberSecurity
Risks:
Socialengineering
Bruteforce
Baiting
Ransomware
CommonNetwork
SecurityRisks:
Viruses,worms,
andtrojans
DenialofService
(DOS)attack
Zero-dayattacks
Common
InformationSecurity
Risks:
Access
Destruction
Availability

16. https://nr3c.gov.pk/about_us.ht
ml
16

17. 17

18. 18
MultanAddress
•CYBERCRIMEWING
–INCHARGECYBERCRIME
FIAOFFICEH.06,STREET-3
SHALIMARTOWN BOSANTOWN
MULTAN
–PHONE[phone]

19. 19
TopCybersecurity
companiesinPakistanList2022Updated
•DeltaTech,Pakistan’sCyberSecurity
ConsultingFirm
•Tier3CyberSecurityServices–Pakistan
•CatalyicSecurity|CyberSecuritySolutions|
Cyber SecurityCompany|
catalyicsecurity.com
•TrilliumInformationSecuritySystems(TISS)
•PakCERT[PakistanComputerEmergency
Response Team]
•DunicotPvt.Ltd.,CyberSecurityServices
Company
•Tranchulas
•CyberSecurityconsultancyCompany
•InstituteofCyberSecurity
•PakistanInformationSecurityAssociation
(PISA)

20. 20

21. 21
InformationSecurity
Policy
•AnInformationSecurityPolicy(ISP)isaset
of rulesthatguideindividualswhenusingIT
assets.
•Companiescancreateinformation
security policies
–toensurethatemployeesandotherusers
follow securityprotocolsandprocedures.
•Securitypoliciesareintendedtoensurethat
–onlyauthorizeduserscanaccesssensitive
systemsand information.

22. 22
•Tomakeyourpolicytrulyeffective,
–updateitfrequentlybasedoncompany
changes,
–newthreats,conclusionsdrawn
from previousbreaches,
–andchangestosecuritysystemsandtools.
•Makeyourinformationsecurity
strategy practicalandreasonable.
•Tomeettheneedsandurgencyof
different departmentswithinthe
organization,
–itisnecessarytodeployasystemof
exceptions, withanapprovalprocess,
–enablingdepartmentsorindividualsto
deviate fromtherulesinspecific

23. 23
TopInformationSecurity
Threats
1.UnsecureorPoorlySecuredSystems
•Thespeedandtechnologicaldevelopment
–Oftenleadstocompromisesinsecurity
measures.
•Inothercases,systemsaredeveloped
without securityinmind,
–Remaininoperationatanorganizationas
legacy systems.
•Organizationsmustidentifythesepoorly
secured systems,
–andmitigatethethreatbysecuringorpatching
them orisolatingthem.

24. 24
2.SocialMedia
Attacks•Manypeoplehavesocialmediaaccounts,
–wheretheyoftenunintentionallysharealot
of informationaboutthemselves.
•Attackerscanlaunchattacksdirectlyvia
social media,
–Eg.Byspreadingmalwareviasocial
media messages,orindirectly,byusing
information obtainedfromthesesitesto
analyzeuserand organizational
vulnerabilities,andusethemto
designanattack.

25. 25
3.Social
Engineering•Itinvolvesattackerssendingemailsandmessages
–thattrickusersintoperformingactionsthatmay
compromisetheirsecurityordivulgeprivate
information.
–Attackersmanipulateusersusingpsychological
triggerslike curiosity,urgencyorfear.
•Becausethesourceofasocialengineering
message appearstobetrusted,
–peoplearemorelikelytocomply,forexampleby
clickinga linkthatinstallsmalwareontheir
device,orbyproviding personalinformation,
credentials,orfinancialdetails.
•Organizationscanmitigateitbymakingusers
–awareofitsdangersand
–trainingthemtoidentifyandavoidsuspected
social engineeringmessages.
–Inaddition,technologicalsystemscanbeusedto
block socialengineeringatitssource.

26. 26

27. 27
4.Malwareon
Endpoints•Organizationalusersworkwithalarge
varietyof endpointdevices,
–Includingdesktopcomputers,laptops,tablets,and
mobile phones,
–Manyofwhichareprivatelyownedandnotunderthe
organization’scontrol,
–AllofwhichconnectregularlytotheInternet.
•Aprimarythreatonalltheseendpointsis
malware, whichcanbetransmittedbyavariety
ofmeans,
–canresultincompromiseoftheendpointitself,
–canalsoleadtoprivilegeescalationtoother
organizational systems.
•Traditionalantivirussoftwareisinsufficientto
blockall modernformsofmalware,and
–moreadvancedapproachesaredevelopingto
securing
endpoints,suchasendpointdetectionandresponse
(EDR).

28. 28
5.Lackof
Encryption•Encryptionprocessesencodedatasothatit
can onlybedecodedbyuserswithsecret
keys.
–Itisveryeffectiveinpreventingdataloss
–incaseofequipmentlossortheft
–incaseoforganizationalsystemsare
compromisedby attackers.
•Unfortunately,thismeasureisoften
overlooked duetoitscomplexityandlackof
legalobligations associatedwithproper
implementation.
•Organizationsareincreasingly
adopting encryption,
–bypurchasingstoragedevicesor
–usingcloudservicesthatsupportencryption,or
–usingdedicatedsecuritytools.

29. 29
6.Security
Misconfiguration•Modernorganizationsuseahuge
numberof technologicalplatformsand
tools,
–inparticularwebapplications,databases,and
–SoftwareasaService(SaaS)applications,or
–InfrastructureasaService(IaaS)
•fromproviderslikeAmazonWebServices.
•Enterprisegradeplatformsandcloud
services havesecurityfeatures,
–Butthesemustbeconfiguredbythe
organization.
–Securitymisconfigurationdueto
negligenceor humanerrorcanresult

30. 30
•Anotherproblemis“configurationdrift”,
–wherecorrectsecurityconfigurationcanquickly
becomeoutofdateandmakeasystem
vulnerable,to ITorsecuritystaff.
•Organizationscanmitigate
security misconfigurationusing
–technologicalplatformsthatcontinuously
monitor systems,
–identifyconfigurationgaps,and
–alertorevenautomaticallyremediate
configuration issuesthatmakesystems
vulnerable.

31. 31
CYBERCRIME
PREVENTIONTIPS
HTTPS://NR3C.GOV.PK/CTIPS.HTML
•SECUREYOURSMARTPHONES
–Alwayssecureyoursmartphonewithastrong
password
–Ensurethatyourdevicelocksitselfautomatically
–Installsecuritysoftware
–Onlydownloadappsfromapprovedsources
–Checkyourappspermissions
–Dontmissoperatingsystemupdates
–Bewaryofanylinksyoureceiveviaemailortext
message
–TurnoffautomaticWi-Ficonnection
–Whenbrowsingorshoppingonyourphone(or
computer), alwayslook
for"https"intheurlinsteadof "http"

32. 32
•SECUREYOURONLINEBANKING
–NeverusesamePINCODEformultiplebank
accounts
–NeveruseunprotectedPCsatcybercafesfor
internet banking
–Neverkeepyourpincodeandcardstogether
–NeverleavethePCunattended whenusinginternet
bankinginapublicplace
–RegisterforMobileSMS,EmailTransactionAlerts
–Neverreplytoemailsaskingforyourpasswordorpin
code
–VisitbankswebsitebytypingtheURLintheaddress
bar
–Logoffandcloseyourbrowserwhenyouaredone
using internetbanking
–WhenusingATMalwaysconcealkeypadbefore
entering pincode
–BeforeusingATM,makesurethatthereisnoextra
device
installedinthesurroundings

33. 33
•SECUREYOURFACEBOOK
–Useextrasecurityfeaturestoaccess
account (securitycode,Loginalert
etc)
–Useloginnotificationalert
–Allowspecificindividualstoviewyour
contents (Videos,PhotosandFriends
etc.)
–Controlwhocancontactyou
–Blockyourprofilefromsearchengines

34. 34
•SECUREYOURWI-FI
–ChangeDefaultAdministratorPasswords
and UsernamesoftheWi-Fi Router
–UsecomplexpasswordandchangePassword
after regularintervals
–PositiontheRouterorAccessPointSafely
–TurnofftheNetwork/Wi-Firoutersifitisnot
in use

35. 35
•SECUREYOURBROWSING
–Whatyouputonlinewillalwaysremain
there
–Nevertrustanyfreeonlinecontent
–Dontprovidepersonalinformationonlineto
get somethingfree
–Don’tclickonlinksinsidee-mailsor
messages

36. 36
Information
Security•Itcanbedefinedas“measures
adoptedtopreventtheunauthorized
use,misuse,modificationordenialof
useofknowledge,facts,dataor
capabilities”.
•ThreeaspectsofISare:
–SecurityAttack
–SecurityMechanism
–SecurityService

37. 37
•SecurityAttack:
–Anyactionthatcomprisesthesecurityofinformation
•SecurityMechanism:
–Amechanismthatisdesignedtodetect,prevent,or
recoverfromasecurity.
•SecurityService:
–Itisaprocessingorcommunicationservicethat
enhances the securityofthe data
processingsystemsandinformationtransfer.The
servicesareintendedtocountersecurityattacks
bymakinguseofoneormoresecurity
mechanismstoprovidetheservice.

38. Whatarethe3Principles
ofIS?
•ThebasictenetsofISarecalledtheCIA
Triad
38

39. Confidentiali
ty•Confidentialitymeasuresare
designedto preventunauthorized
disclosureof information.
•Thepurposeoftheconfidentiality
principleis tokeeppersonalinformation
private
–andtoensurethatitisvisibleandaccessible
only tothoseindividuals whoownitorneed
itto performtheirorganizationalfunctions.
39

40. Integrit
y
•Consistencyincludesprotectionagainst
unauthorized changes(additions,deletions,
alterations,etc.)to data.
•Theprincipleofintegrityensuresthatdatais
accurateandreliableandisnotmodified
incorrectly, whetheraccidentallyormaliciously.
40

41. Availabili
ty
•Availabilityistheprotectionofasystem’sability
to makesoftwaresystemsanddatafully
availablewhen auserneedsit(orataspecified
time).
•Thepurposeofavailabilityistomakethe
technology infrastructure,theapplicationsand
thedataavailable whentheyareneededforan
organizationalprocess orforanorganization’s
customers
.
41

42. PassiveVs.Active
Attacks
•Informationsecurityisintendedto
protect organizationsagainstmalicious
attacks.
•Therearetwoprimarytypesofattacks:–Passiveand
Active.
Releaseof
message
contents
Traffic
analysis
Passive
Activ
e
Masquerad
e
Repl
y
Modificationof
message
contents
Denialof
Service
4
s
3

43. 43
Passive
Attack•Inapassiveattack,anattackermonitorsa
systemandillegallycopiesinformation
withoutalteringit.
•Theythenusethisinformationto
disruptnetworksorcompromisetarget
systems.
•Theattackersdonotmakeanychangeto
thecommunicationorthetargetsystems.
–Thismakesitmoredifficulttodetect.
•However,encryptioncanhelpprevent
passiveattacksbecauseitobfuscatesthe
data,makingitmoredifficultforattackersto
makeuseofit.

44. APassiveattackattemptstolearnormake
useof informationfromthesystem,butdoes
notaffect systemresources.
44

45. 45
Typesofpassive
attacks•Releaseofmessagecontent
–Itmaybedesirabletopreventtheopponent
from learningthecontentsofthe
transmission.
•Trafficanalysis
–Amoreclevertechniquewherethe
•Opponentcoulddeterminethelocationand
identityof communicatinghosts
•Couldobservethefrequency&lengthof
encrypted messagesbeingexchangedthere
•byguessingthenatureofcommunicationtaking
place.

46. Active
Attack•Activeattacksinvolvesomemodification
of thedatastreamorcreationofafalse
stream. Anactiveattackattemptstoalter
system resourcesoraffecttheir
operation.
46

47. FourtypesofActive
attacks•Masquerade:Here,anentitypretendstobe
some otherentity.Itusuallyincludes
oneoftheotherforms
of activeattack
–Example:Ifthelegitimateuserleavesthe
terminalorsessionopenandloggedin,a
coworkermayactasamasqueradeattacker.
–Vulnerableauthenticationisoneofthe
otherfactorthatcantriggeramasquerade
attack,asithelpstheattackertogainaccess
mucheasily.
47

48. Replay:Itinvolvesthepassivecaptureofadataunit
anditssubsequentretransmissiontoproducean
unauthorizedeffect.i.e.transmissionismaliciouslyor
fraudulentlyrepeatedordelayed
48
man-in-the-middle
attack

49. •Modificationofmessages:Itmeansthatsome
portionofa legitimatemessageisaltered,orthat
messagesaredelayedtoproduceanunauthorizedeffect.
–Ex:“John’saccnois2346”ismodifiedas“John’saccnois7892”
•Denialofservice:Thisattackpreventsorinhibitsthe
normaluse ormanagementofcommunicationfacilities.
–Ex:(a)Disruptionofentirenetworkbydisablingit
–(b)Suppressionofallmessagestoaparticulardestination
bya thirdparty.
49

50. Commonvariantsofanactive
attacks
1.Interruption
•theattackerinterruptstheoriginalcommunication
and createsnew,maliciousmessages,
pretendingtobeoneof thecommunicating
parties.
•Anassetofthesystemisdestroyedorbecomes
unavailable orunusable.Itisanattackon
availability.
–Examples
•Destructionofsomehardware
•Jammingwirelesssignals
•Disablingfilemanagementsystems
50

51. 2.
Interception–Anunauthorizedpartygainsaccesstoanasset.
Attackon confidentiality.
•Examples:
–Wiretappingtocapturedataina
network.
–Illicitlycopyingdataorprograms
–Eavesdropping
51

52. 3.
ModificationWhenanunauthorizedpartygainsaccess
and tampersanasset.Attackison
Integrity.
•Examples:
–Changingdatafile
–Alteringaprogramandthecontentsofa
message
52

53. 4.
Fabrication•Createsfake,orsynthetic,communications,typicallywith
theaimofachievingdenialofservice(DoS).This
preventsusersfromaccessingsystemsorperforming
normaloperations.
•Anunauthorizedpartyinsertsabogusobjectintothe
system.
AttackonAuthenticity.Alsocalledimpersonation
•Examples:
–Hackersgainingaccesstoapersonalemailand
sending message
–Insertionofrecordsindatafiles
–Insertionofspuriousmessagesinanetwork
53

54. 54
ReadingAssignment
Question:Whatdoyouknowabout
HERMIT Spyware?
–Readandprepareitsbriefsummary
–NoneedtosubmititsHard/Softcopy.
–Willbediscussedinclass.
–Deadline:BeforeNextlecture.