Information Security Lecture 1

Lecture 1 Title: Introduction to Information Security

Lecture Outlines:
1.1 Information Security
1.2 New Threats
1.3 Important Challenges in Security
1.4 Security Models
1.5 Security Goals
1.6 Security Attacks

Objectives:
After studying this lecture, you will be able to discuss
✓ Meaning of information security.
✓ The most important new security threats
✓ Important challenges in providing security
✓ Various models in security
✓ Primary goals of security
✓ Two types of security attacks

1
Information Security Lecture 1

1.1 Information Security

We are living in the information age. We need to keep information about every
aspect of our lives. In other words, information is an asset that has a value like any
other asset. As an asset information needs to be secured from attacks.
To be secured, information needs to be hidden from unauthorized access
(Confidentiality), protected from unauthorized change (Integrity), and available to
an authorized entity when it is needed (Availability).
The confidentiality of the file was achieved by restricting the access to a few
authorized and trusted people in the organization. In the same way, only a few
authorized people were allowed to change the contents of the files. Availability was
achieved by designating at least one person who would have access to the files at all
times.
With the availability of computers, the three security requirements however, did
not change. The files stored in computers require confidentiality, integrity and
availability. The implementation of these requirements, however, is different and more
challenging.
The second major change that affected security is the introduction of distributed
systems and the use of networks and communications facilities for carrying data
between terminal user and computer and between computer and computer. Network
security measures are needed to protect data during their transmission. In fact, the term
network security is somewhat misleading, because virtually all business, government,
and academic organizations interconnect their data processing equipment with a
collection of interconnected networks. Such a collection is often referred to as an
internet, and the term internet security is used.
There are no clear boundaries between these two forms (computer and network) of
security. For example, one of the most publicized types of attack on information systems

2
Information Security Lecture 1

is the computer virus. A virus may be introduced into a system physically when it arrives
on a diskette or optical disk and is subsequently loaded onto a computer. Viruses may
also arrive over an internet. In either case, once the virus is resident on a computer
system, internal computer security tools are needed to detect and recover from the virus.

1.2 New Threats

Today computers are very powerful, work at unimaginable speed and at very
high accuracy. With computers we now have new concerns such as:
1. Automating Attacks
The speed of computers makes several attacks worthwhile. For example, they would
excel in somehow stealing a very low amount (say half a dollar) from a million bank
accounts in a matter of few minutes. This would give the attacker half a million dollars
possibly without any major complaints!
2. Privacy Concerns
Collecting information about people and later misusing it is turning out to be a
huge problem, these days. The so called data mining applications gather process and
tabulate all sorts of details about individuals. People can then illegally sell this
information. For example, companies like banks, airlines are collecting and processing
a mind boggling amount of information about us, without we realizing when and how
it is going to be used.
3. Distance Does Not Matter
Thieves would earlier attack banks, because banks had money. Banks do not have
money today! Money is in digital form inside computers and moves around by using
computer networks. Instead it is far easier and cheaper to attempt an attack on the
computer system of the bank, sitting at home. In 1995, a Russian hacker broke into
Citibank‟s computers remotely, stealing $12 million. Although the attacker was traced,
it was very difficult to get him extradited for the court case.

3
Information Security Lecture 1

1.3 Important Challenges in Security

Here we highlight some challenges in providing security.
1. Security involving communications and networks is not as simple. Indeed, most
of the major requirements for security services can be given self-explanatory one-
word labels: confidentiality, authentication, nonrepudiation, integrity. But the
mechanisms used to meet those requirements can be quite complex, and
understanding them may involve rather subtle reasoning.
2. In developing a particular security mechanism or algorithm, one must always
consider potential attacks on those security features. In many cases, successful
attacks are designed by looking at the problem in a completely different way,
therefore exploiting an unexpected weakness in the mechanism.
3. It is necessary to decide where to use your different security mechanisms (e.g., at
what points in a network are certain security mechanisms needed) and in a logical
sense (e.g., at what layer or layers of an architecture such as TCP/IP should
mechanisms be placed).

4. Security mechanisms usually involve more than a particular algorithm or protocol.

They usually also require that participants own some secret information (e.g., an
encryption key), which raises questions about the creation, distribution, and
protection of that secret information. There is also a reliance on communications
protocols whose behavior may complicate the task of developing the security
mechanism.
1.4 Security Models
An organization can take several approaches to implement its security model. Let
us summarize these approaches.
1. No Security: In this simplest case, the approach could be a decision to implement

no security at all.
4
Information Security Lecture 1

2. Security Through Obscurity: In this model, a system is secure simply because

nobody knows about its existence and contents. This approach cannot work for too
long, as there are many ways an attacker can come to know about it.
3. Hot Security: In this scheme, the security for each host is enforced individually.

This is a very safe approach, but the trouble is that it cannot scale well. The
complexity and variety of modern sites/organizations makes the task even harder.
4. Network Security: Host security is tough to achieve as organizations grow and

become more various. In this technique, the focus is to control network access to
various hosts and their services, rather than individual host security. This is a very
efficient and scalable model.

1.5 Security Goals

There are three primary goals in any security service:
1. Confidentiality
The principle of confidentiality is that only the sender and the intended recipient
should be able to access the contents of a message. Confidentiality gets compromised
if an unauthorized person is able to access the message. Example of this could be a
confidential email message sent by user A to user B, which is accessed by user C
without the permission or knowledge of A and B. This type of attack is called
interception.
2. Integrity
When the contents of a message are changed after the sender sends it, but before
it reaches the intended recipient, we say that the integrity of the message is lost.
For example, consider that user A sends message to user B. User C tampers with a
message originally sent by user A, which is actually destined for user B. User C
somehow manages to access it, change its contents and send the changed message
to user B. User B has no way of knowing that the contents of the message changed
5
Information Security Lecture 1

after user A had sent it. User A also does not know about this change. This type
of attack is called modification.
3. Availability
The principle of availability is that resources should be available to authorized
parties at all times. For example, due to the intentional actions of an unauthorized
user C, an authorized user A may not be able to contact a server B. This would failure
the principle of availability. Such an attack is called interruption.

1.6 Security Attacks

It must be noted that the OSI security architecture focuses on security attacks,
mechanisms, and services. In this section we discuss the security attacks.
Security Attack is any action that compromises the security of information
owned by an organization. In the literature, the terms threat and attack are commonly
used to mean more or less the same thing. However, RFC 2828 (RFC: Request For
Comment- is a security standard) differentiates threat and attack. Threat is a potential
for violation of security. It is a possible danger that might exploit vulnerability. Attack
is an intelligent act that is intentional attempt (especially in the sense of a method or
technique) to evade security services and violate the security policy of a system.
However, attacks are classified as passive and active:
1.6.1 Passive Attacks
It is an attempt to learn or make use of information from the system without
affecting system resources. Passive attacks are in the nature of eavesdropping on, or
monitoring of, transmissions. Two types of passive attacks are release of message
contents and traffic analysis.

• Release of Message Contents is easily understood (Figure 1). We would like to prevent
an opponent from learning the contents of these transmissions.

6
Information Security Lecture 1

Figure 1 : Release of message.

• Traffic Analysis shows in (Figure 2). If we had encryption protection in place, an

opponent might still be able to observe the pattern of these messages, determine the
location and identity of communicating hosts and could observe the frequency and length
of messages being exchanged. This information might be useful in guessing the nature of
the communication that was taking place.

Figure 2 : Traffic analysis.

Passive attacks are very difficult to detect because they do not involve any alteration
of the data. Neither the sender nor receiver is aware that a third party has read the
messages or observed the traffic pattern. However, message encryption is a simple
7
Information Security Lecture 1

solution to thwart passive attacks. Thus, the emphasis in dealing with passive attacks
is on prevention rather than detection.

1.6.2 Active Attacks

It is an attempt to alter system resources or affect their operation. Active attacks
involve some modification of the data stream or the creation of a false stream and can
be subdivided into four categories: masquerade, replay, modification of messages,
and denial of service.

• Replay involves the passive capture of a data unit and its subsequent retransmission
to produce an unauthorized effect (Figure 3).

Figure 3 : Replay

• A masquerade(deny) takes place when one entity pretends to be a different entity

(Figure 4). A masquerade attack usually includes one of the other forms of active
attack.

8
Information Security Lecture 1

Figure 4 : Masquerade

• Modification of messages simply means that some portion of a legitimate message

is altered, or that messages are delayed or reordered, to produce an unauthorized
effect (Figure 5).

Figure 5 : Modification of message

• The denial of service prevents or deny the normal use or management of

communications facilities (Figure 6). This attack may have a specific target; for
example, of service denial is the disruption of an entire network, either by disabling
the network or by overloading it with messages so as to degrade performance.

9
Information Security Lecture 1

C (Attacker) disrupts service to A

Figure 6 : Denial of service

Active attacks present the opposite characteristics of passive attacks. Whereas

passive attacks are difficult to detect, measures are available to prevent their success.
On the other hand, it is quite difficult to prevent active attacks absolutely, because of
the wide variety of potential physical, software, and network vulnerabilities. Instead,
the goal is to detect active attacks and to recover from any disruption or delays caused
by them. If the detection has a deterrent effect, it may also contribute to prevention.

10