Chapter 5

Protecting Information Resources
Computer and network security has become critical for most organizations, especially in recent years with “hackers”, or computer criminals, becoming more numerous and adept at stealing and altering private information. Hackers use a variety of tools to break into computers and networks, such as sniffers, password crackers, and rootkits, and many others, which can be found free on the web. A comprehensive security system protects an organization’s resources, including information and computer and network equipment. The type of information an organization needs to protect can take many forms: e-mails, in voices transferred via electronic data interchange (EDI), new products designs, marketing campaigns, and financial statements. A comprehensive security system includes hardware, software, procedures, and personnel that collectively protect information resources and keep intruders and hackers at bay. There are three important aspect of computer and network security: confidentiality, integrity, and availability, collectively referred to as “the CIA TRIANGLE”. Confidentiality means a system must not allow disclosing information to anyone who isn’t authorized to access it. Integrity- ensures the accuracy of information resources in an organization. Availability ensures that computers and networks are operating, and authorized users can access the information they need. It should also ensure quickly recovery in case of system failure or disaster. TYPES OF HACKERS SCRIPT KIDDLE- an inexperienced, usually young hacker who uses programs others have developed to attack computer and network systems and deface Web sites. BLACK HAT- hackers who specialized in unauthorized penetration of information system. They attack system for profit, fun, or political motivations or as part of a social cause. These penetration attacks often involve modifying and destroying data. WHITE HAT (also known as “ethical hacker”)- computer security experts who specialize in penetration testing and other testing methods to ensure that a company’s information systems are secure. When planning a comprehensive security system, the first step is designing fault-tolerant system, which have a combination of hardware and software for improving reliability-a way of ensuring availability in case of a system failure. Some commonly used methods includes the following: a. Uninterruptible power supply (UPS) b. Redundant array of independent disks (RAID) c. Mirror disk 2. SECURITY THREATS: AN OVERVIEW Threats can also be categorized by whether they’re unintentional (such as natural disasters, a user’s accidental deletion of data and structural failures) or intentional. Intentional threats include hacker attacks and attacks by disgruntled employees-spreading a virus on the

SOCIAL ENGINEERING. TROJAN PROGRAM. retinal scanning. hand geometry. vein analysis.means using “people skills”-such as being a good listener and assuming a friendly. worm. copied. trace . and all other data transmissions are blocked. signature analysis. such as user pressing Enter or running a specific program. or Web site and is usually hidden inside a popular program.contains code intended to disrupt a computer. The following list describes some biometric devices and measures : *facial recognition. WORM. These elements are unique to a person and can’t be stolen. A network administrator defines rules for access. or passed on to others.use a physiological element to enhance security measures. lost. unaware that the malicious program is also running in the background. Security Measures and Enforcement: An Overview BIOMETRIC SECURITY MEASURES. This routine enables the designer or programmer to bypass system security and sneak back into the system later to access programs or files. network. This attack takes advantage of the human element of security systems. worms are independent programs that can spread themselves without having to be attached to a host program. and voice recognition MEASURES CALLBACK MODEMS. worms. LOGIC BOMB. or other destructive code. DENIAL-OF-SERVICE (DoS) ATTACK. BLENDED THREATS.also travels from a computer to computer in a network.(trapdoor) is a programming routine built into a system by its designer or programmer. BACKDOOR. fingerprints. a combination of hardware and software that acts as a filter or barrier between a private network and external computers or networks. including the internet. Users run the popular programs. unthreatening air-to trick others into revealing private information. Unlike a security threat that combines the characteristics of computer viruses. They’re usually placed in front of a firewall and can identify attack used to verify whether a user’s access is valid by logging the user off (after he attempts to connects to the network) and then calling the user back at a predetermined number.can protect against both external and internal a type of trojan program used to release a virus.floods a network or server with service requests to prevent legitimate user’s access to the system.INTENTIONAL THREATS VIRUSES. and other malicious codes with vulnerabilities found on public and private networks.consists of self propagating program code that’s triggered by a specified time or event. but it doesn’t usually erase data. palm prints. Logic bombs are triggered at a certain time or by an event. INSTRUSION DETECTION SYSTEM (IDS). iris analysis.

” into scrambled form called “ciphertext” that can’t be read by others. Cisco System.uses two keys: a public key known to everyone and a private or secret key known to the a commonly used encryption protocol that manages transmission security on the internet. characters. Inc. generates alarm for the network administrator. SECURE SOCKETS LAYERS. IBM Internet Security Systems Juniper Networks.primary control access to computers and networks and include devices for securing computers and peripherals from theft. and symbols that’s entered to allow access to a system. TRANSPORT LAYER SECURITY. a software feature that erases the screen and signs the user off automatically after a specified length of inactivity. VIRTUAL PRIVATE and cause routers to terminate connections with suspicious sources. TERMINAL RESOURCE PHYSICAL SECURITY MEASURES. URL www. such as the internet. ACCESS CONTROL – are designed to protect systems from authorized access to preserve data a combination of a cryptographic protocol that ensures data security and integrity over public www. The following sections describe two used access controls: terminal resource security and DATA ENCRYPTION DATA www. Ltd.provides a secure “tunnel” through the internet for transmitting messages and data via a private network. .checkpoint.transforms data called “plaintext” or “cleartext. ASSYMETRIC ENCRYPTION. A password’s length and complexity determines its vulnerability to discovery by unauthorized users.iss. VENDORS Enterasys network inc. Inc. Check Point Software Technologies.

SYMMETRIC ENCRYPTION. Authentication is important because using a credit card number in an online transaction doesn’t mean the person using it is the card’s legitimate owner. confirmation. Nonrepudiation.must also be incorporated into e-commerce transactions to verify orders and reciept of shipments. Confirmation. E-commerce transaction security is concerned with the following issues: CONFIDENTIALITY AUTHENTICATION INTEGRITY NONREPUDIATION OF ORIGIN NONREPUDIATION OF RECEIPT .is essential in case a dispute over a transaction is raised. The sender and receiver must agree on the key and keep it secret. Digital signatures are used for this factor and serve to bind partners in transaction.also called “secret key encryption” the same key is used to encrypt and decrypt the message. In e-commerce transactions. three factors are critical for security: authentication. and nonrepudiation.

Maribeth Rivera Submitted by: Renea Maryll Alviz Angelie Nucum Mary Ann Garcia Angeli Carmel Yambao Jose Marie Ibe Allain Joseph Gonzales .University of the Assumption Del Pilar San Fernando Pampanga Written Report Protecting Information Resources Submitted to: Ms.

Sign up to vote on this title
UsefulNot useful