Foundations of Security

Module 1

Simplifying Security.

1 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Scenario

Franklin,anemployeeworkingforan
organization,downloadsfreesoftware
fromawebsite.Afterinstallingthe
software,however,Franklin'ssystem
rebootsandstartstomalfunction.

What might have gone

wrong with Franklins system?

What would you have done in

Franklins place?

2 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
 May23,2011

HomecomputerUsersatRiskDuetoUseofFolkModelSecurity

EASTLANSING,Mich. Mosthomecomputersarevulnerabletohackerattacksbecausetheuserseithermistakenlythinktheyhave
enoughsecurityinplaceortheydontbelievetheyhaveenoughvaluableinformationthatwouldbeofinteresttoahacker.
ThatsthepointofapaperpublishedthismonthbyMichiganStateUniversitysRickWash,whosaysthatmosthomecomputerusersrely
onwhatareknownasfolkmodels.Thosearebeliefsaboutwhathackersorvirusesarethatpeopleusetomakedecisionsaboutsecurity
tokeeptheirinformationsafe.
Unfortunately,theydontoftenworkthewaytheyshould.
Homesecurityishardbecausepeopleareuntrainedinsecurity,saidWash,anassistantprofessorintheDepartmentof
Telecommunication,InformationStudiesandMedia.Butitisntbecausepeopleareidiots.Rathertheytrytheirbesttomake senseof
whatsgoingonandfrequentlymakechoicesthatleavethemvulnerable.
http://news.msu.edu

3 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
 May23,20118:21:51PMET

'Fakefrag'TrojanScaresYouintoPayingUp

AdeviousnewTrojanisputtingthefearofharddrivefailure
intocomputerowners,andthenrushinginto"save"theday
atyourexpense.
Oncethe"Fakefrag"Trojanfindsitswayontoyoursystemvia
speciallycraftedmaliciousWebpages,itgetstoworkonthe
taskofmakingyoubelieveallyourfileshavebeenerasedfrom
yourharddrive,thesecurityfirmSymantecreported.
Scareware scams,whichtrytoconvinceuserstheyhavea
computervirus,andthentrickthemintopurchasingfake
antivirussoftware,arenothingnew.However,Fakefrag takes
thecrimeastepfurther:itactuallymovesyourfilesfromthe
"AllUsers"foldertoatemporarylocation,andhidesfilesinthe
"CurrentUser"folder,Symantecsaid.

http://www.msnbc.msn.com

4 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Module Objectives
SecurityIncidents LayersofSecurity

EssentialTerminologies SecurityRiskstoHomeUsers

ComputerSecurity WhattoSecure?
WhatMakesaHomeComputer
WhySecurity?
Vulnerable?
PotentialLossesDuetoSecurity WhatMakesaSystemSecure?
Attacks
BenefitsofComputerSecurity
ElementsofSecurity Awareness
FundamentalConceptsofSecurity BasicComputerSecurityMechanisms

5 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Module Flow

Potential
Essential Computer LossesDue
Terminologies Security toSecurity
Attacks

Security
Elementsof Layersof Whatto
Risksto
Security Security Secure?
HomeUsers

WhatMakes Benefitsof Basic

aHome Computer Computer
Computer Security Security
Vulnerable? Awareness Mechanisms

6 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
 Security Incident Occurrences Over Time
ReportonJanuary,2011
Security Incident Occurrences Over Time

900

800 787

700
604
600 537
511
500
409
400

300

200 141
100 23
6 14 10
0
2002 2003 2004 2005 2006 2007 2008 2009 2010 2011
Years http://datalossdb.org

7 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Security Incidents by Breach Type - 2011

AsecurityincidentisAnyrealorsuspectedadverseevent inrelationtothe
securityofcomputersystemsorcomputernetworks.
http://www.cert.org

40%

10% 10% 10% 10% 10% 10%

Stolen Stolen Lost Hack Web Disposal Unknown

Laptop Document Laptop Document

http://datalossdb.org

8 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Essential Terminologies
Threat Exploit Vulnerability

Anactionoreventthat Adefinedwaytobreach Existenceofaweakness,

hasthepotentialto thesecurityofanIT design,orimplementation
compromiseand/or systemthrough errorthatcanleadtoan
violatesecurity vulnerability unexpected,undesirable
eventcompromisingthe
securityofthesystem

Cracker,Attacker,
Attack DataTheft
orIntruder
Anindividualwhobreaks Anyactionderivedfrom Anyactionofstealing
intocomputersystemsin intelligentthreatsto theinformationfromthe
ordertosteal,change,or violatethesecurityofthe userssystem
destroyinformation system

9 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
 Computer Security

Securityisastateofwell Computersecurityrefersto Usersshouldfocuson

beingofinformation and theprotectionofcomputer varioussecuritythreatsand
infrastructure systems andthe countermeasures inorderto
informationauserstoresor protecttheirinformation
processes assets

1 2 3

10 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Why Security?

Computersecurityis Computeradministration
importantforprotectingthe andmanagementhave
confidentiality,integrity,and becomemorecomplex
availability ofcomputer whichproducesmoreattack
systemsandtheirresources avenues

Evolutionoftechnologyhas
Networkenvironmentsand
focusedontheeaseofuse
networkbasedapplications
whiletheskilllevelneeded
providemoreattackpaths
forexploitshasdecreased

11 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Potential Losses Due to
Security Attacks
Misuseofcomputer
resources Financialloss

Unavailabilityof
Dataloss/theft
resources

Lossoftrust Identitytheft

12 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Module Flow

Potential
Essential Computer LossesDue
Terminologies Security toSecurity
Attacks

Security
Elementsof Layersof Whatto
Risksto
Security Security Secure?
HomeUsers

WhatMakes Benefitsof Basic

aHome Computer Computer
Computer Security Security
Vulnerable? Awareness Mechanisms

13 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Elements of Security
Confidentiality isensuring
thatinformationisaccessible
onlytothoseauthorizedto
haveaccess(ISO17799)
Integrity isensuringthatthe Nonrepudiation isensuringthata
informationisaccurate, partytoacontractoracommunication
complete,reliable,andisinits cannotdenytheauthenticityoftheir
originalform signatureonadocument

Non
Confidentiality Authenticity Integrity Availability
Repudiation

Authenticity isthe Availability isensuringthatthe

identificationandassurance informationisaccessibleto
oftheoriginofinformation authorizedpersonswhen
requiredwithoutdelay

14 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
The Security, Functionality, and Ease
of Use Triangle
Applications/softwareproductsbydefaultarepreconfiguredforeaseofuse,whichmakesthe
uservulnerabletovarioussecurityflaws
Similarly,increasedfunctionality(features) inanapplicationmakeitdifficulttouseinaddition
tobeinglesssecure

Movingtheballtoward
securitymeansmoving
awayfromthe Security
functionalityandeaseof (Restrictions)
use

Ease of Functionality
Use (Features)

15 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Fundamental Concepts of Security
Precaution
Adheringtothepreventativemeasures while
usingcomputersystemandapplications

Maintenance
Managingallthechangesinthecomputer
applicationsandkeepingthemuptodate

Reaction
Actingtimelywhensecurityincidents occur

16 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Layers of Security Layer 5

Layer 4

Layer 3
User
Layer 2
Security
Application
Layer 1 Ensuresthatavalid
Security userisloggedin
System
Coverstheuseof andthatthe
Security loggedinuseris
Network software,
Protectsthesystem hardware,and allowedtousean
Security anditsinformation procedural application/
Physical
Protectsthe fromtheft, methodstoprotect program
Security corruption,
networksand applicationsfrom
Safeguardsthe theirservicesfrom unauthorized externalthreats
personnel, unauthorized access,ormisuse
hardware,programs, modification,
networks,anddata destruction,or
fromphysical disclosure
threats

17 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Security Risks to Home Users
Homecomputersarepronetovariouscyberattacks astheyprovideattackerseasy
targetsduetoalowlevelofsecurityawareness
Securityrisktohomeusersarisefromvariouscomputerattacks andaccidents
causingphysicaldamagetocomputersystems

ComputerAttacks ComputerAccidents
Malwareattacks Harddiskorothercomponentfailures
Emailattacks Powerfailureandsurges
Mobilecode(Java/JavaScript/ActiveX)attacks
Theftofacomputingdevice
Denialofserviceandcrosssitescriptingattacks
Identitytheftandcomputerfrauds
Packetsniffing
Beinganintermediaryforanotherattack
(zombies)

Note:Thesethreatsandtheircountermeasureswillbediscussedindetailinthelatermodules

18 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
What to Secure?
Hardware Software
Laptops,DesktopPCs,CPU, Operatingsystemandsoftware
harddisk,storagedevices, applications
cables,etc.

Information Communications
Personalidentificationsuchas Emails,instantmessengers,and
SocialSecurityNumber(SSN), browsingactivites
passwords,creditcardnumbers,
etc.

19 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Module Flow

Potential
Essential Computer LossesDue
Terminologies Security toSecurity
Attacks

Security
Elementsof Layersof Whatto
Risksto
Security Security Secure?
HomeUsers

WhatMakes Benefitsof Basic

aHome Computer Computer
Computer Security Security
Vulnerable? Awareness Mechanisms

20 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
What Makes a Home Computer
Vulnerable?
Lowlevelof Defaultcomputerand Increasingonline
securityawareness applicationsettings activities

Noneorverylittle Notfollowingany
investmentin standardsecurity
securitysystems policiesorguidelines

21 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
What Makes a System Secure?
Systemsecuritymeasureshelpprotect computersandinformationstoredinthesystems
fromaccidentalloss,maliciousthreats,unauthorizedaccess,etc.

SystemAccessControls DataAccessControls

Ensurethatunauthorizedusersdonot Monitorsystemactivitiessuchaswhois
getintothesystem accessingthedataandforwhatpurpose
Forcelegaluserstobeconsciousabout Defineaccessrulesbasedonthesystem
security securitylevels

SystemandSecurity
SystemDesign
Administration

Performregularsystemandsecurity Deployvarioussecuritycharacteristicsin
administrationtaskssuchasconfiguring systemhardwareandsoftwaredesign
systemsettings,implementingsecurity suchasmemorysegmentation,privilege
policies,monitoringsystemstate,etc. isolation,etc.

22 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Benefits of Computer Security
Awareness
Computersecurityawarenesshelpsminimizethechancesofcomputerattacks

Ithelpspreventthelossofinformation storedonthesystems

Ithelpsuserstopreventcybercriminalsfromusingtheirsystems inorderto
launchattacksontheothercomputersystems

Ithelpsusersminimizelossesincaseofanaccident thatcausesphysicaldamage
tocomputersystems

Itenablesuserstoprotectsensitiveinformationandcomputingresources from
unauthorizedaccess

23 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
Module Summary

Securityisastateofwellbeingofinformationandinfrastructures
Computersecurityistheprotectionofcomputingsystemsandthedatathatthey
storeoraccess
Confidentiality,integrity,nonrepudiation,authenticity,andavailabilityarethe
elementsofsecurity
Securityrisktohomeusersarisefromvariouscomputerattacksandaccidents
causingphysicaldamagetocomputersystems
Computersecurityawarenesshelpsminimizethechancesofcomputerattacksand
preventthelossofinformationstoredonthesystems

24 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.
 Basic Computer Security Checklist

Useofstrongpasswords

Useofantivirussystems

Regularupdateofoperatingsystemandotherinstalledapplications

Regularbackupofimportantfiles

Useofencryptiontechniquesanddigitalsignatures

Useoffirewallandintrusiondetectionsystems

FollowingstandardguidelinesforInternetactivities

Physicalsecurityofcomputinginfrastructure

Awarenessofcurrentsecurityscenarioandattacktechniques

25 CopyrightbyEC-Council
AllRightsReserved.ReproductionisStrictlyProhibited.