Quality of Information System (IS) reflecting local correctness and reliability of the operating system; the logical completeness of the hardware and software implementing the protection mechanisms; and the consistency of the data structures and occurrence of stored data.† † Definition from National Information Systems Security attack Spoofing impersonating another person, device or process Relay causing another computer to send out your attack Viruses / Worms infecting transmitted data

Assurance that information is not disclosed to unauthorized persons, processes, or devices.† † Definition from National Information Systems Security attack Shoulder Surfing peeking at things others consider private Network Sniffing examining some else’s network transmissions Vulnerability Scanning running software that maliciously analyzes another computing system white hat black hat

Integrity & Confidentiality are important first steps… Sender Receiver …toward ensuring private communications.

Timely, reliable access to data and information services for authorized users.† † Definition from National Information Systems Security attack Denial of Service (DoS) results from assets taxed beyond their capacity examples:  extreme levels of network traffic  too many server transactions  all memory or disk space exhausted

 spoofing  playback (replay) attack  man in the middle attack  dumpster diving  war driving  password cracking  denial of service (DoS) attack  shoulder surfing  network infrastructure attack  network scanning  buffer overflow  syn flood

Asset Security System Attack Proper Access

At the root of all security is trust. You trust that your software is (largely) correct. You trust that messages haven’t been altered. You trust that antivirus software keeps your system free of malware. You trust that no one else has access to your user account. You trust that your keyboard isn’t plugged into a key logger. What don’t you (or shouldn’t you) trust?? Since we obviously can’t trust everything, we need to develop and implement security policy...