Scribd Logo
Upload

Welcome to Scribd!

  • 23 views

    Advance Topics in Info & Comm Security Lecture 2: Security Policies and Prevention Tips

    Uploaded by

    Usman Ali
    1) Security policies define what is and isn't allowed, while mechanisms enforce those policies. Policies can conflict and create vulnerabilities if not properly composed. 2) The goals of security are prevention, detection, and recovery from attacks. Security is underpinned by trust and assumptions about how systems will operate. 3) Operational issues like risk analysis and laws must be considered, as well as human factors like organizational problems and social engineering. Proper specification, design, implementation and operation are needed to provide assurance that systems meet security requirements.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Advance Topics in Info & Comm Security Lecture 2: Security Policies and Prevention Tips

    Uploaded by

    Usman Ali
    23 views14 pages
    1) Security policies define what is and isn't allowed, while mechanisms enforce those policies. Policies can conflict and create vulnerabilities if not properly composed. 2) The goals of security are prevention, detection, and recovery from attacks. Security is underpinned by trust and assumptions about how systems will operate. 3) Operational issues like risk analysis and laws must be considered, as well as human factors like organizational problems and social engineering. Proper specification, design, implementation and operation are needed to provide assurance that systems meet security requirements.

    Original Description:

    Advance

    Original Title

    ATS-2

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    1) Security policies define what is and isn't allowed, while mechanisms enforce those policies. Policies can conflict and create vulnerabilities if not properly composed. 2) The goals of security are prevention, detection, and recovery from attacks. Security is underpinned by trust and assumptions about how systems will operate. 3) Operational issues like risk analysis and laws must be considered, as well as human factors like organizational problems and social engineering. Proper specification, design, implementation and operation are needed to provide assurance that systems meet security requirements.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    23 views14 pages

    Advance Topics in Info & Comm Security Lecture 2: Security Policies and Prevention Tips

    Uploaded by

    Usman Ali
    1) Security policies define what is and isn't allowed, while mechanisms enforce those policies. Policies can conflict and create vulnerabilities if not properly composed. 2) The goals of security are prevention, detection, and recovery from attacks. Security is underpinned by trust and assumptions about how systems will operate. 3) Operational issues like risk analysis and laws must be considered, as well as human factors like organizational problems and social engineering. Proper specification, design, implementation and operation are needed to provide assurance that systems meet security requirements.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 14

    Advance Topics in Info &

    Comm Security

    Lecture 2: Security
    policies and prevention
    tips
    Policies and Mechanisms
    • Policy says what is, and is not, allowed
    – This defines “security” for the site/system/etc.
    • Mechanisms enforce policies
    • Composition of policies
    – If policies conflict, discrepancies may create
    security vulnerabilities
    Policies and Mechanisms
    • Policy: may be expressed in
    – natural language, which is usually imprecise but easy to understand;
    – mathematics, which is usually precise but hard to understand;
    – policy languages, which look like some form of programming language
    and try to balance precision with ease of understanding
    • Mechanisms: may be
    – technical, in which controls in the computer enforce the policy; for
    example, the requirement that a user supply a password to authenticate
    herself before using the computer
    – procedural, in which controls outside the system enforce the policy; for
    example, firing someone for ringing in a disk containing a game
    program obtained from an untrusted source

    • The composition problem requires checking for inconsistencies among policies. If, for
    example, one policy allows students and faculty access to all data, and the other
    allows only faculty access to all the data, then they must be resolved
    Goals of Security
    • Prevention
    – Prevent attackers from violating security policy
    – Prevention is ideal, because then there are no
    successful attacks.
    • Detection
    – Detect attackers’ violation of security policy
    – Occurs after someone violates the policy.
    • Recovery
    – Stop attack, assess and repair damage
    – Continue to function correctly even if attack succeeds
    Trust and Assumptions
    • Underlie all aspects of security
    • Policies
    – Unambiguously partition system states
    – Correctly capture security requirements
    • Mechanisms
    – Assumed to enforce policy
    – Support mechanisms work correctly
    • Example of lock picker
    Assurance
    • Assurance is a measure of how well the system meets its
    requirements; more informally, how much you can trust the
    system to do what it is supposed to do. It does not say what
    the system is to do; rather, it only covers how well the system
    does it
    • System specification, design, and implementation can provide
    a basis for determining "how much" to trust a system
    • Specification
    – Requirements analysis
    – Statement of desired functionality
    • Design
    – How system will meet specification
    • Implementation
    – Programs/systems that carry out design
    Operational Issues
    • Security does not end when the system is
    completed. Its operation affects security
    – Cost-Benefit Analysis
    • Is it cheaper to prevent or recover?
    – Risk Analysis
    • Should we protect something?
    • How much should we protect this thing?
    – Laws and Customs
    • Are desired security measures illegal?
    • Will people do them?
    Human Issues
    • Organizational Problems
    – Power and responsibility
    – Financial benefits (security does not bring in
    revenue, it merely prevents the loss of
    revenue )
    • People problems
    – Heart of any security system is people
    – Outsiders and insiders
    – Social engineering
    Tying Together

    Threats

    Policy

    Specification

    Design

    Implementation

    Operation
    Top 10 Cyber Crime Prevention Tips

    1. Use Strong Passwords


    – Use different user ID / password combinations for different accounts
    – avoid writing them down.
    – Make the passwords more complicated by combining letters,
    numbers, special characters (minimum 10 characters in total)
    – change them on a regular basis.

    2. Secure your computer


    – Activate your firewall
    Firewalls are the first line of cyber defence; they block connections to unknown
    or bogus sites and will keep out some types of viruses and hackers.
    – Use anti-virus/malware software
    Prevent viruses from infecting your computer by installing and regularly updating
    anti-virus software.
    – Block spyware attacks
    Prevent spyware from infiltrating your computer by installing and updating anti-
    spyware software.
    Top 10 Cyber Crime Prevention Tips

    3. Be Social-Media Savvy
    Make sure your social networking profiles (e.g. Facebook, Twitter,
    Youtube, MSN, etc.) are set to private. Check your security settings. Be
    careful what information you post online. Once it is on the Internet, it is
    there forever!

    4. Secure your Mobile Devices


    Be aware that your mobile device is vulnerable to viruses and hackers.
    Download applications from trusted sources.

    5. Install the latest operating system updates


    Keep your applications and operating system (e.g. Windows, Mac, Linux)
    current with the latest system updates. Turn on automatic updates to
    prevent potential attacks on older software.
    Top 10 Cyber Crime Prevention Tips

    6. Protect your Data


    Use encryption for your most sensitive files such as tax returns or financial
    records, make regular back-ups of all your important data, and store it in
    another location.

    7. Secure your wireless network


    Wi-Fi (wireless) networks at home are vulnerable to intrusion if they are
    not properly secured. Review and modify default settings. Public Wi-Fi,
    a.k.a. “Hot Spots”, are also vulnerable. Avoid conducting financial or
    corporate transactions on these networks.

    8. Protect your e-identity


    Be cautious when giving out personal information such as your name,
    address, phone number or financial information on the Internet. Make sure
    that websites are secure (e.g. when making online purchases) or that
    you’ve enabled privacy settings (e.g. when accessing/using social
    networking sites).
    Top 10 Cyber Crime Prevention Tips

    1. Avoid being scammed


    Always think before you click on a link or file of unknown origin. Don’t feel
    pressured by any emails. Check the source of the message. When in
    doubt, verify the source. Never reply to emails that ask you to verify your
    information or confirm your user ID or password.

    2. Call the right person for help


    Don’t panic! If you are a victim, if you encounter illegal Internet content or if you
    suspect a computer crime, identity theft or a commercial scam, report this to your
    local police. If you need help with maintenance or software installation on your
    computer, consult with your service provider or a certified computer technician.
    Key Points
    • Policy defines security, and mechanisms
    enforce security
    – Confidentiality
    – Integrity
    – Availability
    • Trust and knowing assumptions
    • Importance of assurance

    You might also like

    pFad - Phonifier reborn

    Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

    Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


    Alternative Proxies:

    Alternative Proxy

    pFad Proxy

    pFad v3 Proxy

    pFad v4 Proxy