COMPUTER SECURITY - PART 3
COMPUTER
SECURITY - PART 3
COMPUTER PROTECTION
In computer security a countermeasure is an action, device,
procedure, or technique that reduces a threat, a vulnerability, or an attack by
eliminating or preventing it, by minimizing the harm it can cause, or by
discovering and reporting it so that corrective action can be taken.
SECURITY MEASURES
A state of computer "security" is the conceptual ideal,
attained by the use of the three processes: threat prevention, detection, and
response. These processes are based on various policies and system components,
which include the following:
·
User account access controls
and cryptography can protect systems files and data, respectively.
·
Firewalls are by far the most
common prevention systems from a network security perspective as they can (if
properly configured) shield access to internal network services, and block
certain kinds of attacks through packet filtering. Firewalls can be both
hardware- or software-based.
·
Intrusion Detection System
(IDS) products are designed to detect network attacks in-progress and assist in
post-attack forensics, while audit trails and logs serve a similar function for
individual systems.
·
"Response" is
necessarily defined by the assessed security requirements of an individual
system and may cover the range from simple upgrade of protections to
notification of legal authorities, counter-attacks, and the like. In some
special cases, a complete destruction of the compromised system is favored, as
it may happen that not all the compromised resources are detected.
Computer security comprises mainly preventive measures, like
firewalls or an exit procedure. A firewall can be defined as a way of filtering
network data between a host or a network and another network, such as the
Internet, and can be implemented as software running on the machine, hooking
into the network stack (or, in the case of most UNIX-based operating systems
such as Linux, built into the operating system kernel) to provide real time
filtering and blocking.
Another implementation is a so-called physical firewall which
consists of a separate machine filtering network traffic. Firewalls are common
amongst machines that are permanently connected to the Internet.
VULNERABILITY
Is the cycle of identifying, and remediating or mitigating
vulnerabilities, is integral to computer security and network security.
Vulnerabilities can be discovered with a vulnerability scanner,
which analyzes a computer system in search of known vulnerabilities, such as
open ports, insecure software configuration, and susceptibility to malware
Beyond vulnerability scanning, many organisations contract outside
security auditors to run regular penetration tests against their systems to
identify vulnerabilities. In some sectors this is a contractual requirement.
HOW TO REDUCING
VULNERABILITIES AND PROTECT YOUR SYSTEM
Cryptography properly implemented is now virtually impossible to
directly break. Breaking them requires some non-cryptographic input, such as a
stolen key, stolen plaintext, or some other extra cryptanalytic information.
Two factor authentication is a method for mitigating unauthorized
access to a system or sensitive information. It requires "something you know"; a password or
PIN, and "something you have";
a card, dongle, cellphone, or other piece of hardware. This increases security
as an unauthorized person needs both of these to gain access.
Social engineering and direct computer access (physical) attacks can only be prevented
by non-computer means, which can be difficult to enforce, relative to the
sensitivity of the information.
It is possible to reduce an attacker's chances by keeping systems up
to date with security patches and updates, using a security scanner or/and
hiring competent people responsible for security. The effects of data
loss/damage can be reduced by careful backing up and insurance.
HARDWARE PROTECTION
MECHANISMS
Using devices and methods such as dongles, trusted platform modules,
intrusion-aware cases, drive locks, disabling USB ports, and mobile-enabled
access may be considered more secure
due to the physical access.
·
USB dongles are typically used
in software licensing schemes to unlock software capabilities, but they can
also be seen as a way to prevent unauthorized access to a computer or other
device's software. The dongle, or key, essentially creates a secure encrypted
tunnel between the software application and the key. The principle is that an
encryption scheme on the dongle, such as Advanced
Encryption Standard (AES)
provides a stronger measure of security, since it is harder to hack and
replicate the dongle than to simply copy the native software to another machine
and use it. Another security application for dongles is to use them for
accessing web-based content such as cloud software or Virtual Private Networks
(VPNs). In addition, a USB dongle can be configured to lock or unlock a
computer.
·
Disabling USB ports is a
security option for preventing unauthorized and malicious access to an
otherwise secure computer. Infected USB dongles connected to a network from a
computer inside the firewall are considered by the magazine Network World as
the most common hardware threat facing computer networks.
·
Trusted platform modules (TPMs)
secure devices by integrating cryptographic capabilities onto access devices,
through the use of microprocessors, or so-called computers-on-a-chip. TPMs used
in conjunction with server-side software offer a way to detect and authenticate
hardware devices, preventing unauthorized network and data access.
·
Computer case intrusion
detection refers to a push-button switch which is triggered when a computer
case is opened. The firmware or BIOS is programmed to show an alert to the
operator when the computer is booted up the next time.
·
Drive locks are essentially
software tools to encrypt hard drives, making them inaccessible to thieves. Tools
exist specifically for encrypting external drives as well.
·
Mobile-enabled access devices
are growing in popularity due to the ubiquitous nature of cell phones. Built-in
capabilities such as Bluetooth, the newer Bluetooth low energy (LE), Near field
communication (NFC) on non-iOS devices and biometric validation such as thumb
print readers, as well as QR code reader software designed for mobile devices,
offer new, secure ways for mobile phones to connect to access control systems.
These control systems provide computer security and can also be used for
controlling access to secure buildings.
SECURE OPERATING SYSTEMS
One use of the term "computer security" refers to
technology that is used to implement secure operating systems. In the 1980s the
United States Department of Defense (DoD) used the "Orange Book"
standards, but the current international standard ISO/IEC 15408, "Common
Criteria" defines a number of progressively more stringent Evaluation
Assurance Levels.
CAPABILITIES AND ACCESS
CONTROL LISTS
Within computer systems, two of many security models capable of
enforcing privilege separation are access control lists (ACLs) and capability-based security. Using ACLs to confine programs
has been proven to be insecure in many situations, such as if the host computer
can be tricked into indirectly allowing restricted file access, an issue known
as the confused deputy problem. It has also been shown that the promise of ACLs
of giving access to an object to only one person can never be guaranteed in practice.
Both of these problems are resolved by capabilities. This does not mean
practical flaws exist in all ACL-based systems, but only that the designers of
certain utilities must take responsibility to ensure that they do not introduce
flaws. Capabilities have been mostly restricted to research operating systems,
while commercial OSs still use ACLs.
The most secure computers are those not connected to the Internet
and shielded from any interference. In the real world, the most secure systems
are operating systems where security is not an add-on.
OTHER LEGAL AND TECHNICAL ASPECTS
Identifying attackers is difficult, as they are often in a different
jurisdiction to the systems they attempt to breach, and operate through
proxies, temporary anonymous dial-up accounts, wireless connections, and other
anonymising procedures which make backtracing difficult and are often located
in yet another jurisdiction. If they successfully breach security, they are
often able to delete logs to cover their tracks.
The number of attempted attacks is so large that organisations
cannot spend time pursuing each attacker. Note however, that most of the sheer
bulk of these attacks are made by automated vulnerability scanners and computer
worms.
Law enforcement officers are often unfamiliar with information
technology, and so lack the skills and interest in pursuing attackers. There
are also budgetary constraints. It has been argued that the high cost of
technology, such as DNA testing, and improved forensics mean less money for
other kinds of law enforcement, so the overall rate of criminals not getting
dealt with goes up as the cost of the technology increases.
In addition, the identification of attackers across a network may
require logs from various points in the network and in many countries, the
release of these records to law enforcement requires a search warrant and depending
on the circumstances, the legal proceedings required can be drawn out to the
point where the records are either regularly destroyed, or the information is
no longer relevant.
Please, let me know what do you think about this post and send me an email or leave you comments below.
Comments
Post a Comment