CH 1
CH 1
CH 1
Chapter 1
Lecture Notes
Data Security
• Data security is the practice of keeping data protected from
corruption and Unauthorized access.
• The focus behind data security is to ensure privacy while
protecting personal or corporate data.
Information Technology Security
• Information technology security is the process of protecting
computers, networks, programs and data from unintended or
unauthorized access, change or destruction.
Why Do we care about Computer Security?
• Our modern ways of communication provide a lot of
examples of critical situations involving security issues.
✓ Communicating by phone,
✓ by e-mail, or by fax,
✓ Getting connected to a bank via the Internet and performing
transactions
✓ Digital payment systems,
✓ e-voting systems, etc. demands confidentiality and integrity
of exchanged information.
Security Goals (pillars)
• Confidentiality
• Integrity
• Availability
Confidentiality
• It ensures that computer-related assets are accessed only by
authorized parties.
• Confidentiality is sometimes called secrecy or privacy.
Only authorized entities are allowed to view
Only sender, intended receiver should “understand”
message contents
• confidentiality covers two related concepts
Data confidentiality
Privacy
Cont..
Integrity
• Information needs to be changed constantly.
• Integrity means that changes need to be done only by authorized
entities and through authorized mechanisms or assets can be
modified only by authorized parties or only in authorized ways.
Ensures the message was not altered by unauthorized
individuals.
sender, receiver want to ensure message not altered (in transit,
or afterwards) without detection
• Integrity can be
Data integrity
System integrity
Cont..
Availability
• it means that assets are accessible to authorized parties at
appropriate times
• The information created and stored by an organization needs
to be available to authorized entities. Information needs to
be constantly changed, which means it must be accessible to
authorized entities.
• It assures that system works promptly and service is not
denied for authorized user.
Vulnerability
Hardware Vulnerabilities
• Hardware is more visible than software
• it is rather simple to attack by adding devices, changing
them, removing them, intercepting the traffic to them, or
flooding them with traffic until they can no longer function.
• Computers have been drenched with water, burned, frozen,
gassed, and electrocuted with power surges.
Cont..
Software vulnerability
• Software can be replaced, changed, or destroyed
maliciously, or it can be modified, deleted, or misplaced
accidentally. Whether intentional or not, these attacks exploit
the software’s vulnerabilities.
• Sometimes, the attacks are obvious, as when the software no
longer runs. More subtle are attacks in which the software
has been altered but seems to run normally
Cont..
Data vulnerability
• a data attack is a more widespread and serious problem than
either a hardware or software attack.
• data items have greater public value than hardware and
software because more people know how to use or interpret
data.
Policies and mechanisms