1. 2016-11-201 Prof. I. J. Chung Dept. of Computer & Information Science, Korea Univ. 컴퓨터와 인터넷 윤리 Professor I. J. Chung

2. 2016-11-202 Prof. I. J. Chung Dept. of Computer & Information Science, Korea Univ. Breaches and hacking on computer system Prepare for the worst case Investigate and recognize the illegal access and thus prevents the harmful breaches and hacking Develop well in advance of any incident Ethical decision with respect to computer security includes decision which information system and data most need protection Confine the expected damages as little as possible Restore data and computer systems to normal state

3. 2016-11-203 Prof. I. J. Chung Dept. of Computer & Information Science, Korea Univ. Breaches and hacking on computer system Provide the formal incident report for future Keep track and record all relevant data and information about security incidents such as: System events and login Specific and particular actions taken Outside communications Do these activities for future prosecution and help for incident eradication and follow-up

4. 2016-11-204 Prof. I. J. Chung Dept. of Computer & Information Science, Korea Univ. Eradication effort Record all possible illegal criminal evidences from the system Create disk image and backup all compromised systems for future and as evidence Restore the backup system after the malfunction is eradicated Prevent the malfunctions or hacking from occurring again

5. 2016-11-205 Prof. I. J. Chung Dept. of Computer & Information Science, Korea Univ. Intrusion Detection Intrusion detection algorithms with AI technologies BBID (Behavior-Based Intrusion Detection) KBID (Knowledge-Based Intrusion Detection) BBID (Behavior-Based Intrusion Detection) Watch the activities so far and recognize something abnormal if there exists some deviation Establish the model normal behavior of a system and users from reference sources e.g. access traffic at odd hours or users who have not used before KBID (Knowledge-Based Intrusion Detection) Apply the useful information such as specific attacks and system weak points Watch any attempts to exploit these system weak points e.g. repeated failed login, download a file or program to computer system

6. 2016-11-206 Prof. I. J. Chung Dept. of Computer & Information Science, Korea Univ. Intrusion Prevention Stronger than intrusion detection Prevent the illegal attacks by blocking the viruses or other threats Common intrusion prevention: Firewall and/or network IPS(Intrusion Prevention System) Firewall and IPS are complementary in that Firewall blocks everything but authorized, valid accesses IPS allows everything but explicitly denied invalid accesses Firewall >> IPS Note: Can you distinguish firewall and IPS?

7. 2016-11-207 Prof. I. J. Chung Dept. of Computer & Information Science, Korea Univ. Intrusion Detection Honeypot Installs fake decoy server to identify and investigate the hackers Gives fake network information to the hackers