Lecture 3 - Digital Security

Knowledge Society Lecture 3

Digital Security y

y

y

y

One of the major issues I the IT AGE o Increasingly more people trying to gain access to information Issue of finding a balance between security and usability o If a system is co mpletely secure no one can do anything anything o If it is completely usable there is no security Security is like an arms race o An evolutionary process Information Security Characteristics o Confidentiality = Information should be available to those who have right and proper access to it  Not going to publish an exam before you take it. Need to establish who can have access and what  they can do with it  o Integrity = we need to be able to trust that the information is a true and accurate record Availability Availability = information should be available to those t hat need to o legitimately know it  Personal Information Security Treats o PC connectivity of the Internet has made it much easier for intruders Its not a one way thing to the information  people are also connecting to you People can view and manipulate your computer system remotely o People often keep account numbers and passwords stored in o computers The only safe computer is a computer that is not connected to anything We are such an information rich society that its hard to keep up with all the usernames and password o IDE NTITY THEFT = the criminal act of using stolen information about a person to assume that person identity People having to prove that they are them Nation and Global Security Threats o Governments depend on IT and the Internet  Governments are forming and shaping our future society They are also vulnerable Most government services are online and are thus a target  o They have become a major target for organised crime and terrorism (or cyber-terrorism) cyber-terrorism) 

y

y









y

  

Taking out electronic resources  crucial to government  infrastructure o Security agencies now regularly deal in digital security o Problems with international attacks as there is no international law under which to prosecute the attackers. Types of security o Errors and accidents  errors and accidents are unavoidable, despite how we may plan against them Human errors Enter a wrong number Procedural errors Not following instructions Software errors (bugs) Computers dont dont always t rust the software Computer programmers can make errors in the code Updates are fixing these errors It is a bug because in the 40s first computers based on vacuum tubes o One day a moth flew onto a vacuum tube and it blew the tube and the programme had an error Incorrect data/information (dirty data) 

y



y



y



y y y y



y

o

Terrorism Terrorism may destroy data and c omputer systems Sept 11 loss of important data and information stored at the bottom of the buildings Without the particular knowledge of information it  is difficult to run your business (specific area of  expertise) Valuable technical technical and procedural experience is also lost  Crimes against computers and communications  illegal acts intended intended to d estroy/harm computer and communications communications equipment  Hardware theft  Stealing actual computers (Melbourne people in official coats) Software theft  einstalling software on other computers Reinstalling Time theft  Stealing time away from computer system o Loss of productivity  it could be doing what  youre paid to do Information theft  Taking information information that they have access to and use it for purposes that they shouldnt  Hardware/software destruction and vandalism Trashed computer labs Fraud, counterfeiting and impersonation Worms and viruses Designed to disrupt computers and computer services 

y

y



o



y



y



y



y



y



o



Leads to lost revenue and a large amount of downtime for organisations Producing and releasing viruses and worms is an illegal activity A worm is a program that copies itself repeatedly into memory and/or hard disks drive until the computer stops working or freezes Fills up memory and if its filled computer wont  work  A virus, however, is a program that is able to copy itself  from computer to computer and is capable of damaging software and/or data It does specific harm Each does s omething different  E.g. corrupt files on hard disk  o Delete all exe. Files o Computer criminals Nearly 80% of computer crime is committed by employees of organisations Time theft (unreported crimes) These crimes go largely unreported unreported A hacker is a person who breaks into computers and their networks, usually by gaining access to administrative controls White hat  o The good people that try and show governments and organisations their security vulnerabilities Black hat  o Evil people Trying to get access to computer systems and o are often making money (getting paid) o Many from Russia- cyber criminal gangs Grey hat  o In between  depending on who pays them Act as both o Software and networks Hackers exploit security holes They know they exists and how to gain access to them This is why patches are released - updates A security hole is an error in the program that allows violation violation of information security Sometimes patches are released to address security holes Information Security Measures o Identification and level of access Having cards ( e.g. credit cards), signatures, keys and badges etc. (Old and Secure) PINs and passwords  very weak forms of security protection 





y



y y y



y

 

y

y

y





y

y





y





Most people choose passwords and PI Ns that relate to them Most people Physical Traits Physical attributes of our bodies are unique Include finger prints, retinal patters ad D NA USB with thumbprints are coming in Biometrics is the science of measuring individual body characteristics Encryption The process of converting readable data (plaintext or clear text) Makes a combination of letters and numbers that  have nothing related to the numbers Only people who have the right key can access the information Decryption is the reverse process Commonly used encryption method uses a pair of public and private keys unique to each individual on email signatures people sometimes have a public public key which can be used to encrypt the information o this encrypted information can be sent to them o then only way you can decrypt this information is using a private key (they have to make sure they have it) makes sure that only the person that  has the private key can open it  Encryption software built into browsers y

y

o

 

y



o



y



 

y





o

Protecting software and data

Achieved by controlling access to sensitive software/data, keeping an audit log of files and controlling the activities of  people within the organisation o Have a disaster recovery plan Executed in a time of emergency to restore normal information processing activities Security for your PC o Your computer contains alot of valuable information o Its management (p articularly articularly security) is very important  o Have a good password o Dont give your password to anybody or even write it down o Encrypting personal data files is a good idea Application programs can do this with a password option (e.g. o Word) Regular and systematic backup is an essential activity o o Your computer contains a lot of valuable information Internet  Security Measures o Hackers Keep up to date with application software and operating system patches Install a personal firewire A firewall is software that examines incoming packets from the internet  Data packets are how the internet communicates The firewall can filter out packets that are potentially dangerous Organisations (such as Bond) run their own firewall that  protects their networks. As soon as a computer is networked it is vulnerable to an attack  o Viruses and Worms Combated by installing installing the latest Anti-virus software Be careful about email attachments o Denial of Service (DoS) Attacks Making repeated requests of a computer system or network  Millions per second This can overload it and deny legitimate users access to it  Will shutdown large computer systems, disrupting many users and leading to lost business Particularly target large companies o Spyware and Adware Software installed on your computer without your prior knowledge Used to monitor the computer or even control it  Adware sends you unsolicited advertising in the form of  pop-up windows Computer controlled controlled though spyware it is called a zombie Zombie armies are known as botnets Anti-spyware software can be us ed to defend against this Wardriving o 



y

y



 

y





y

 



y

 

y



 

  

The act of searching for WiFi wireless networks by a person in a moving vehicle Secure your wireless network  Scams and Hoaxes Internet is a very good medium for scams, hoaxes and frauds Easy to hide illegitimacy effective in the electronic world The legal system has a great deal of trouble keeping up with the latest digital developments An internet fraud is the crime of d eliberately deceiving a person over the internet in order to obtain property and services from them unjustly unjustly Spoofing The electronic assumption of anothers identity Often email is sent using a fake sender name Used to trick people to open spam email messages Illegal in most criminal codes Phishing and Pharming Short for password harnessing fishing o Try to make people r eveal private information o Often accompanied by a fake or spoofed URL o Making reveal bank account information o Never respond to these Pharming = a DNS server is electronically o hijacked to automatically redirect users from legitimate web-sites to spoofed websites Spam It represents the bulk of the Worlds email Simply delete it  Virus hoax Is an email that warns of a virus that does not exist  Sent just as a disruption Further strategies Always be on your guard Never respond to an email requesting private information If you do not know who an email is from, delete it straight  away Never visit the URLs contained within spam messages 



o



 



o

    

y

o

 

o

 

o

  



Knowledge Society Computer Crime and Security y

y

y

Infor mation security is concerned with ± Confidentiality ± Integrity ± Availability Identity theft  ± The criminal act of using stolen information about a person to assumer a persons identity identity Intellectual Property ± Refers to a product of the mind or intellect over which the owner holds legal entitlement  ± Ideas, intangible objects such as poetry, stories, music etc. ± Intellectual property rights concern the ownership and use of  intellectual intellectual property such as software, music, movies, data and

i

y

y

y y

y

y

ti

Secu Secu it th eat eats t usi esse sses ± Vi us abuse e of i of i t ernet  ernet acce access ss ± I si er abus apt op op thef  thef t  t  ± Lapt  nauthor orii ed access access by insider siderss ± Unauth eni enial-of-s al-of-servi ervice att  att acks acks ± Syst em em penet  penet rati ration on ± Syst  t of propri propriet ary ary informati nformation on ± Thef t of Sabot age age ± Sabot  Financiial frau fraud ± Financ elecommunicati cation on frau fraud ± Telecommu elecommunicati cation on eaves eavesdroppi dropping ± Telecommu tive wire wiret  t ap ap ± Active usiness ss int elli elligence = the the process process of gath gather eriing and analyzi analyzing ingormati ngormation on Busine in the the pu pursuit of suit of busi busine ness ss advant  advant age. age. Competiti ompetitive ve int elli elligence = concerned with informati nformation on about  about compe competit  tit ors ors Count eri erint elli elligence = concerned with prot  prot ecti ecting ng you your ow own informati nformation on from access access by you your competit  competit ors ors New laws laws t o hold people res re sponsi ponsible ble for mai maint aining the the secu ecurit y of th of the eir cust omers omer s Cybert  ybert erroris errorism m acks over the the int ernet  ernet t  t o intim timidat  dat e and harm a popu populati lation on ± Uses att acks omput er er Emergency Readi eadiness ness Team (US-CERT) U>S Comput  monit  monit ors ors the the secu ecurit y of US netw network orkss and the the int ernet  ernet and and res respond t o epis episode odess of cybert  cybert erroris errorism m revent cyber cyber att  att acks acks agai against Ameri mericans cans criti critical cal ± Prevent  infrast  nfrast ructure turess educe nati national onal vu vulnerabi lnerabilit y t o cyberatt  cyberatt acks acks ± Redu time from cyber ± Minimize damage and recovery time att acks acks Threats reats t o informati nformation on secu ecurit y ± Int ernet  ernet fla flaws ws entional onal and unint enti entional onal acts acts by law law -abi -abiding citi citizen zenss (User ± Int enti negli negligence) acks wishing wishing t o do seri erious damage ± Att acks Secu Securit y holes oles (secu ecurit y vu vulnerabi lnerabilit y) are sof tware tware bu bugs tha that allo t allow w violati olation onss of i of informati nformation on secu ecurit y crosof t  t s Trustwor ustworth thy y Computi omputing ng initia itiative tive is a long t erm, erm, collaborati collaborative ve Micros effort  effort t  t o provi provide more secu ecure, pri privat  vat e and reli reliable computi computing ng ex experi periences ences for everyone Sof tware tw are pat  pat ches are correcti correction onss t o sof tware tware bu bugs tha that ca t caus use e secu ecurit y holes oles  in the the form of u of  updat  pdat es 

y

y

y

y

y

y y

Piracy = the illegal copying, use and distribution of digital intellectual property Plagiarism = taking credit for so meone elses intellectual property Hacker = subverts computer security without authorization (system penetration) ± Attackers or intruders ± Black hat hacker Takes advantage of security vulnerability to gain unlawful access to private networks for the purpose of private advantage White hat hackers ± Individual who considers it working for the common good to hack into networks in order to call attention attention to flaws in security so they can be fixed Grey hat hackers ± A hacker of questionable ethics Script kiddle ± A person with little technical knowledge who follows the instructions of others to hack networks 





