1. Stephen S. Yau CSE465 & CSE591, Fall 2006 1 Information Assurance (IA) & Security Overview Concepts Security principles & strategies Techniques Guidelines, policies & laws

2. Stephen S. Yau CSE465 & CSE591, Fall 2006 2 Basic Concepts of Information Assurance & Security

3. Stephen S. Yau CSE465 & CSE591, Fall 2006 3 Information Forms and States Information Forms –Thoughts and speech –Hard copy –Softcopy –Personal knowledge –Technical skills –Corporate knowledge –Formal and informal meetings –Telephone conversations –Video teleconferences Information States Transmitted, processed, stored

4. Stephen S. Yau CSE465 & CSE591, Fall 2006 4 Threats and Vulnerabilities A threat is a potential occurrence that can have an undesirable effect on the system assets or resources [t1- ch1.2, t2- ch1.2] A vulnerability is a weakness that makes a threat to possibly occur [t1-ch20.1, t2- ch23.1]

5. Stephen S. Yau CSE465 & CSE591, Fall 2006 5 Four Categories of Threats Disclosure: Unauthorized access to information –Snooping Deception: Acceptance of false data –Alteration –Spoofing –Denial of receipt Disruption: Interruption or prevention of correct operations –Alteration Usurpation: Unauthorized control of part of a system –Alteration –Spoofing –Delay –Denial of Service, DDoS t1-ch1.2, t2-ch1.2

6. Stephen S. Yau CSE465 & CSE591, Fall 2006 6 Necessary Protection In order to secure information, some or all of the following protections of a system are needed –Protect working area from outside intrusion or theft –Store key equipment in secure room, and make sure it works properly –Review programs carefully for potential malicious logic –Keep track of all sensitive files, documents, conference record, experiment results, which may be on printed papers. stored in magnetic storage media, CDs or DVDs. Protect them from unauthorized access. Backup this information periodically in case of system failure –Encrypt sensitive information when storage or transmission. –Choose good passwords and change them periodically –Report abnormal actions immediately

7. Stephen S. Yau CSE465 & CSE591, Fall 2006 7 Information Assurance (IA) is information operations (IO) that protect and defend information and information systems by ensuring their Information Assurance (IA) is information operations (IO) that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality and nonrepudiation. DoD Definition of Information Assurance

8. Stephen S. Yau CSE465 & CSE591, Fall 2006 8 Information Characteristics Availability: Timely and reliable access to data and information services for authorized user. Integrity: Protection against unauthorized modification or destruction of information Authentication: Security measure designed to establish validity of transmission, message, or originator, or means of verifying an individual’s authorization to receive specific categories of information t1-ch1.1, t2-ch1.1

9. Stephen S. Yau CSE465 & CSE591, Fall 2006 9 Information Characteristics (cont.) Confidentiality: Assurance that information is not disclosed to unauthorized persons, processes, or devices. Nonrepudiation: Assurance that sender of data is provided with proof of delivery to recipient, and recipient is provided with proof of sender’s identification. Privacy: Ability and/or right to protect certain personal data; extends ability and/or right to prevent invasion of personal information or space. Extends to families, but not to legal persons, such as corporations, organizations, schools

10. Stephen S. Yau CSE465 & CSE591, Fall 2006 10 Information Characteristics (cont.) Secrecy: Refers to effect of mechanisms used to limit number of principals who can access information, such as cryptography or computer access control Denial of Service: Mechanisms which prevent legitimate user from using the system.

11. Stephen S. Yau CSE465 & CSE591, Fall 2006 11 Information System Information system consisting of  Computer systems and networks  Information  Operating environments

12. Stephen S. Yau CSE465 & CSE591, Fall 2006 12 INFOSEC INFOSEC: Information Systems Security –Protection of information systems against unauthorized access to or modification of information, whether in storage, processing or transit, and against denial of service to authorized users or provision of service to unauthorized users, including those measures necessary to detect, document, and counter such threats.

13. Stephen S. Yau CSE465 & CSE591, Fall 2006 13 OPSEC OPSEC: Operations Security –A process that determines what information adversaries can obtain or piece together from observation and to provide measures for reducing such vulnerabilities to acceptable levels

14. Stephen S. Yau CSE465 & CSE591, Fall 2006 14 Other Important Terms Orange Book: –The DoD Trusted Computer System Evaluation Criteria (DoD 5200.28-STD) [ –The DoD Trusted Computer System Evaluation Criteria (DoD 5200.28-STD) [t1-ch18.2, t2-ch21.2]Indicators: –Data derived from open sources or from detectable actions that the threat can piece together or interpret to reach conclusions or official estimates concerning friendly intentions, capabilities, or activities. –Data derived from open sources or from detectable actions that the threat can piece together or interpret to reach conclusions or official estimates concerning friendly intentions, capabilities, or activities. Profile indicator Deviation indicator Tip-off indicator

15. Stephen S. Yau CSE465 & CSE591, Fall 2006 15 Challenges for IA Development of computer and network systems, and information technology expend the need of information to be protected and defended Information becomes most important resource of an organization World is more connected with Internet Information warfare, espionage more common and threatening