Defining Computer Security

• cybertechnology security can be thought of in terms of various counter measures:

• (i) unauthorized access to systems• (ii) alteration of data that resides in and is transmitted

between computer systems• (iii) disruption, vandalism, and sabotage of computers

systems and networks.

Defining Computer Security

• Confidentiality: protecting against un- authorized disclosure of information to third parties.

• Integrity: preventing unauthorized modification of files.

• Availability: preventing unauthorized withholding of information from those who need it when they need it. DOS

Figure 6-1

Computer Security

System Security Data Security

Resident Data Transmitted Data

vulnerability to "malicious programs" (viruses and worms).

vulnerability to access of data.

Four Types of Security Countermeasures

• Firewalls• Anti-Virus Software• Encryption Tools• Anonymity Tools

• Others??• Security through obscurity

New Security Problems ?

Collaboration

• Multi-User Applications Ubiquitous / Wireless Net

• Limiting access (e.g. in schools) Others ???

Encryption Tools (Continued)

• An encrypted communication will be only as secure and private as its key.

• In private-key encryption, both parties use the same encryption algorithm and the same private key.

• Public cryptography uses two keys: one public and the other private.

Encryption (Continued) – public Cryptography

• If A wishes to communicate with B, A uses B's public key to encode the message.

• That message can then only be decoded with B's private key, which is secret.

• Similarly when B responds to A, B uses A's public key to encrypt the message.

• That message can be decrypted only by using A's private key. Although information about an individual's public key is accessible to others, that individual's ability to communicate encrypted information is not compromised.

Anonymity Tools

• Users want to secure the integrity and confi- dentiality of their electronic communications.

• They also wish to protect their identity while engaging in on-line activities.

• Anonymity tools such as the Anonymizer, and pseudonymity agents such as Lucent's Personalized Web Assistant, enable users to roam the Web either anonymously or pseudonymously.

Anonymity Tools (Continued)

• able to navigate the Internet without personal identity being revealed.

• e.g., the user cannot be identified beyond certain technical information such as – the user's IP (Internet protocol) address, – ISP, and so forth.

Code of Network Ethics for Security (continued)

• Would you would be willing to purchase an automobile that could not be locked (secured) and thus protected against theft?

• Steele points out that there are no adequate "locks" for computers.

• He blames Microsoft and other large computer corporations for not ensuring and guaranteeing that the computer software products are more secure.

Code of Network Ethics for Security (Continued)

• Steele also believes that corporations that produce computer software should assume full responsibility, legal and moral, for any insecure software products they sell.

• He concludes that we need a "Code of Network Ethics" with a "due diligence" clause, which would spell out specific requirements for businesses engaged in the production of software.

Criticism of Steele’s Argument for a Network Code of Ethics

• We can agree with Steele's assumptions that consumers desire reliable products and that they expect dependable computer systems.

• We can also question whether the analogy that Steele draws between computer systems and automobiles is a useful one, or whether it breaks down in certain crucial respects.

• It is not yet possible to test computer systems for reliability in the same way that we can test automobile systems.

Total Security in Cyberspace

• Can total security in cyberspace be achieved? • If so, would it be a desirable goal? • When asked if we would prefer a secure cyberspace,

we would likely answer "yes." • But we might not be willing to accept the

consequences of such a level of security. – e.g., more secure systems might require certain additional

features in cyber-technology that would result in computer systems being less friendly and thus more difficult for ordinary users to operate.

Viewing Security as a Process Rather Than as a

Product • Scheier (2000) claims that anyone who

promises a totally secure or "hacker proof" system is selling "snake oil.“

• Many security experts assume we simply need to find the right technology or the foolproof encryption device or the right security countermeasures.

Security as a Process (continued)

• For Schneier, security is a process, not a product.

• Schneier believes that an important element in that process is risk assessment.

• Seeking perfect security would make a system useless, because "anything worth doing requires some risk."

Computer Security and Risk Analysis

• Risk analysis is a methodology used to come to an informed decision about the most cost-effective controls to limit the risks to your assets vis-à-vis the spectrum of threats.

• Banks and credit card companies can tolerate a considerable amount of credit risk and fraud because they know how to anticipate loses and price their services accordingly.

• What is the acceptable level of risk in computer systems? How can we assess it?

Risk Assessment (Continued)

• Many of the ethical issues surrounding computer security are not trivial.

• They have implications for public safety that can result in the deaths of significant numbers of persons.

• So it is not clear that all computer security issues can be understood simply in terms of the risk analysis model advocated by Schneier.