COMPUTER SECURITY AND CRYPTOGRAPHY

CUE
NOTES
What is security?
Definition of Security : The quality or state of being secure—free from danger. A secure system
What are the critical has multiple layers of protection, including physical, personal, operational, communications,
infrastructure areas network, and information security.
that require security? Critical Infrastructure Areas : Telecommunications, electrical power systems, gas/oil,
banking/finance, transportation, water supply, government services, and emergency services.
What does the CIA
CIA Triad
Triad represent?
o Confidentiality : Ensures that only authorized parties can access systems or data.
Why is balancing Measures include information classification, secure document storage, and user education.
confidentiality, o Integrity : Ensures that data is accurate, complete, and uncorrupted. Threats include
corruption during compilation, storage, or transmission.
integrity, and
o Availability : Ensures that authorized users can access data when needed. It implies
availability important?
protection against interference or obstruction.

What is privacy in the Balancing CIA : Disconnecting a computer from the Internet increases confidentiality but reduces
context of computing? availability and integrity due to lost updates. Extensive data checks enhance integrity but reduce
confidentiality and availability. The CIA Triad forms the foundation of information security. Modern
systems expand these principles into additional characteristics like accuracy, authenticity, utility,
How does legislation and possession.
like PIPEDA protect
privacy? Definition of Privacy : Informational self-determination, the ability to control information about
oneself. This includes deciding who sees it, who uses it, what they use it for, and whom they share it
with.
Who are the
adversaries in PIPEDA (Canada) : Legislation requiring organizations to follow ten Fair Information Principles,
cybersecurity? including accountability, purpose identification, consent, limitation of collection, and safeguarding
data.

What are the main Adversaries : Amateurs ("script kiddies"),Crackers, Organized crime, Terrorists
types of threats? Threats : Interruption (Denial of Service), Interception (Unauthorized Access), Modification
(Tampering), Fabrication (Counterfeiting)
What are assets,
Adversaries exploit vulnerabilities in systems to cause harm. For instance, hackers may launch DDoS
vulnerabilities, threats, attacks to disrupt services or steal sensitive data.
attacks, and controls?
Example: A phishing attack targets individuals to intercept login credentials, compromising both
confidentiality and integrity.
What are the methods
of defense against Terminology and concepts Assets : Things we protect, such as hardware, software, and data.
threats? Vulnerabilities : Weaknesses in a system that can be exploited. Threats : Potential causes of
incidents that may harm a system. Attacks : Actions exploiting vulnerabilities to execute threats.
Controls : Measures to remove or reduce vulnerabilities.
What are the key
principles of computer A vulnerability in a file server that does not authenticate users could lead to an attack where
security? unauthorized users access or modify files.
Controls might include implementing strong authentication mechanisms or encrypting sensitive
data.
Methods of Defense :
o Prevent: Block the attack.
o Deter: Make the attack harder or more expensive.
o Deflect: Make the system less attractive to attackers.
o Detect: Identify ongoing or past attacks.
o Recover: Mitigate the effects of an attack.
Defense in Depth : Combining multiple defense strategies to enhance overall security.
Example: To protect against laptop theft, one could use deterrents (locks), detection (alarms), and
recovery (insurance).
Principles of computer security
o Principle of Easiest Penetration : Attackers target the weakest link in a system
o Principle of Adequate Protection : Security measures should match the value of the
assets being protected.
o Principle of Effectiveness : Controls must be efficient, easy to use, and appropriate.
o Principle of Weakest Link : A failure in any part of the security system can compromise
the entire system.
LECTURE 2
CUE
NOTES
What is a threat?
Terms
What is vulnerability? Threat : A potential cause of an incident that may result in harm to a system or organization.
What is risk? Vulnerability : A weakness of an asset or group of assets that can be exploited by one or more threats.
Who are threat agents? Risk : The potential for loss, damage, or destruction of an asset as a result of a threat exploiting a
vulnerability.
What are the main
types of damage Threat Agent : Entities that knowingly seek to manifest a threat.
caused by threats? Example: In a system with weak passwords:
Vulnerability : Passwords are vulnerable to dictionary attacks.
What are the Threat : An intruder exploits this weakness to break into the system.
components of a
Risk : Resources within the system are prone to illegal access, modification, or damage.
threat?
Damages
o Interruption : Destruction or unavailability of services/resources.
What are the types of o Interception : Unauthorized parties gaining access to resources.
threat agents? o Modification : Unauthorized parties altering resources.
o Fabrication : Unauthorized parties inserting fake assets/resources.
Example: A denial-of-service (DoS) attack interrupts service availability, while a virus might modify files,
What are the types of
and phishing could lead to unauthorized interception of credentials.
vulnerabilities?
Components of a threat
o Threat Agents : Criminals, terrorists, disgruntled employees, hackers, etc.
How do vulnerabilities o Capability : Software, technology, education, methods, etc., available to threat agents.
manifest themselves? o Threat Inhibitors : Factors discouraging threats, such as fear of capture or technical difficulty.
o Threat Amplifiers : Factors encouraging threats, such as peer pressure or access to information.
o Threat Catalysts : Events or circumstances triggering threats.
o Threat Motivators : Reasons driving threat agents, such as personal gain, power, or curiosity.
Example: A hacker motivated by fame might use advanced tools (capability) but be deterred by strict legal
consequences (inhibitor).
Threat Agents
o Natural : Fire, floods, power failure, earthquakes, etc.
o Unintentional : Insider or outsider actions without malicious intent.
o Intentional : Hostile insiders or outsiders, such as foreign agents, industrial spies, terrorists,
organized crime, hackers, and political dissidents.
Example: A natural disaster like a flood could destroy hardware, while a disgruntled employee might
intentionally leak sensitive data.
Vulnerabilities
o Physical Vulnerabilities : Weaknesses in physical security, such as unlocked doors or
unprotected devices.
o Natural Vulnerabilities : Susceptibility to environmental factors like heat or humidity.
o Hardware/Software Vulnerabilities : Bugs, misconfigurations, or outdated systems.
o Media Vulnerabilities : Stolen or damaged storage media.
o Emanation Vulnerabilities : Radiation emissions revealing sensitive information.
o Communication Vulnerabilities : Weaknesses in network communications.
o Human Vulnerabilities : Errors, lack of awareness, or social engineering.
Example: An employee writing down passwords exposes the system to human vulnerability, while outdated
software creates a software vulnerability.
Manifestation of Vulnerabilities
o External Misuse : Visual spying, misrepresenting, or physical scavenging.
o Hardware Misuse : Logical scavenging, eavesdropping, interference, or physical attacks.
o Masquerading : Impersonation, piggybacking, spoofing, or network weaving.
o Pest Programs : Trojan horses, logic bombs, worms, or viruses.
o Bypasses : Trapdoor attacks or password cracking.
o Active Misuse : Basic active attacks, incremental attacks, or denial of service.
o Passive Misuse : Browsing, interference, aggregation, or covert channels.
Example: A Trojan horse (pest program) might masquerade as legitimate software, allowing attackers to
bypass security measures.
What are some
Vulnerabilities
examples of
vulnerabilities? o Through Employees : Social interaction, discussing work in public, taking data out of the office,
installing unauthorized software, or disabling security tools.
o Through Former Employees : Retaining company data or discussing company matters.
o Through Technology : Social networking, file sharing, legacy systems, or storing data on mobile
What are the main
devices.
threats to information o Through Hardware : Susceptibility to dust, heat, or humidity; hardware design flaws; or
security? outdated hardware.
o Through Software : Insufficient testing, bugs, unchecked user input, or software complexity.
o Through Network : Unprotected communications, insecure architecture, or unnecessary scripts
What are common types executing.
of attacks? o Through IT Management : Missed patches, configuration errors, or inadequate change
management.
o Through Partners/Suppliers : Disruption of services, lost mail, or sharing confidential data.
Example: An employee opening a phishing email introduces malware into the system, creating a
vulnerability.
Threats to Information Security
o Acts of Human Error or Failure : Caused by inexperience, improper training, or incorrect
assumptions.
o Deviations in Quality of Service : Internet, communication, or power irregularities affecting
system availability.
o Espionage/Trespass : Unauthorized access to confidential information.
o Information Extortion : Stealing information and demanding compensation for its return.
o Sabotage or Vandalism : Deliberate acts to damage or deface systems.
o Deliberate Acts of Theft : Taking physical, electronic, or intellectual property.
o Deliberate Software Attacks : Malware like viruses, worms, or Trojan horses.
o Compromises to Intellectual Property : Software piracy or copyright infringement.
o Forces of Nature : Natural disasters disrupting systems.
o Technical Hardware Failures : Flaws in equipment causing unreliable service.
o Technical Software Failures : Bugs or purposeful shortcuts in software.
o Technological Obsolescence : Outdated infrastructure leading to unreliable systems.
Example: A DDoS attack (deliberate software attack) overwhelms a server, causing service interruption.
Attack Descriptions
o IP Scan and Attack : Scanning IP addresses for vulnerabilities and targeting them.
o Web Browsing : Infecting Web pages to spread malware.
o Virus : Infecting executable files to propagate.
o Unprotected Shares : Copying viral components via file shares.
o Mass Mail : Sending infected emails to addresses in contact lists.
o SNMP Vulnerabilities : Exploiting Simple Network Management Protocol weaknesses.
o Hoaxes : Attaching real viruses to fake warnings.
o Back Doors : Using unauthorized access mechanisms.
o Password Crack : Reverse-calculating passwords.
o Brute Force : Trying all possible password combinations.
o Dictionary Attack : Using a list of common passwords.
o Denial-of-Service (DoS) : Overloading a system with requests.
o Distributed Denial-of-Service (DDoS) : Coordinated DoS from multiple locations.
o Spoofing : Falsifying IP addresses to gain access.
o Man-in-the-Middle : Intercepting and modifying network traffic.
o Spam : Sending unsolicited emails, potentially carrying malware.
o Mail-Bombing : Flooding a target with excessive emails.
o Sniffers : Monitoring network traffic to steal information.
o Social Engineering : Manipulating individuals to reveal sensitive information.
o Buffer Overflow : Exploiting memory allocation errors to execute malicious code.
o Ping of Death : Sending oversized ICMP packets to crash systems.
o Additional Content :
Example: A DDoS attack targets a website, overwhelming it with traffic and rendering it inaccessible.
LECTURE 3

CUE
NOTES
What is an intrusion?
Introduction to IDPS
What is intrusion
prevention? o Intrusion : Occurs when an attacker attempts to gain entry into or disrupt the normal
operations of an information system.
What is intrusion o Intrusion Prevention : Activities that deter intrusions from occurring.
detection? o Intrusion Detection : Procedures and systems created to detect system intrusions.
o Intrusion Reaction : Actions taken when an intrusion event is detected.
o Intrusion Correction : Restoring operations to a normal state after an intrusion.
What are the types of
IDPS? Intrusion detection and prevention systems (IDPS) play a critical role in modern cybersecurity by
identifying, mitigating, and responding to threats. Example: A network-based IDPS detects unusual traffic
What are the advantages patterns indicative of a potential attack and alerts administrators.
and disadvantages of
NIDPS and HIDPS? Types of IDPS
Network-Based IDPS (NIDPS) :
 Focuses on protecting network information assets.
 Installed at specific points in the network to monitor traffic.
What are the detection  Looks for attack patterns using signature matching.
methods used by IDPS?
How do signature-based
and anomaly-based  Advantages:  Disadvantages:
methods differ?  Can cover large networks with few  Overwhelmed by high traffic
devices. volumes.
 Passive deployment minimizes disruption.  Cannot analyze encrypted packets.
 Harder for attackers to detect.  May miss certain types of attacks,
such as fragmented packets.

Host-Based IDPS (HIDPS) :

What are the response
behaviors of IDPS? o Monitors activity on individual computers or servers.
o Detects local events and file modifications.
o Can access decrypted data on the host.

 Advantages:  Disadvantages:
 Detects attacks that may elude NIDPS.  More management overhead.
 Not affected by switched network  Vulnerable to direct attacks.
protocols.  High resource consumption
 Analyzes audit logs for inconsistencies.

Application-Based IDPS :

 Protects specific applications from specialized attacks.

Wireless IDPS focuses on securing wireless networks, addressing issues like physical security and sensor
range.
Network behavior analysis systems examine traffic flow to identify abnormal patterns, such as DoS attacks
or worms.
IDPS Detection Methods

Signature-Based Statistical Anomaly- Stateful Protocol Log File Monitors :

IDPS : Based IDPS : Analysis IDPS :
Review log files
Matches data traffic Compares current Compares observed generated by servers
against known attack activity to baseline events to predefined and network devices.
signatures. parameters. protocol profiles.
Identify attack patterns
Widely used due to clear Can detect new types of Detects deviations in across the entire
and distinct signatures attacks not covered by multi-session attacks. network.
for many attacks. signatures.
Complex and resource- Requires significant
Requires continuous Higher processing intensive. resources for data
updates to detect new overhead and more false collection and analysis.
threats. positives.

Hybrid approaches combine multiple detection methods to improve accuracy and reduce false positives.
Example: A signature-based IDPS might detect a known virus, while an anomaly-based system could
identify a novel attack pattern.
IDPS Response Behavior

Active Response : Passive Response :

Collects additional information about the intrusion.
Example: An
Modifies the network environment to active
block response
the might automatically update firewall rules to block a detected threat, while a
attack. passive response would simply notify the administrator.
Takes direct action against Honeypots, Honeynets,
the intrusion, such asand Padded Cell Systems
blocking IP addresses.
Honeypots : Honeynets : Padded Cell Systems :
Decoy systems designed to lure Collections of honeypots on a Protected honeypots that cannot
attackers away from critical subnet. be easily compromised.
systems.
Provide broader coverage and Operate alongside traditional IDS
Collect information about attacker insights into attacker tactics. to divert attackers to a simulated
behavior. environment.
What are honeypots and
honeynets? Encourage attackers to stay long
enough for documentation and
What is a padded cell response.
system?

Legal implications of honeypots and padded cells must be carefully considered to avoid entrapment issues.
What are scanning and Example: A padded cell system might simulate a vulnerable server to capture attacker actions without
analysis tools? risking real data.
Scanning and Analysis Tools
What is biometric access o Scanning Tools :
control?
o Used to identify vulnerabilities in systems and networks.
o Include port scanners, OS detection tools, and wireless security tools.
o Vulnerability Scanners :
o Active scanners initiate traffic to find holes in systems.
o Passive scanners listen to network traffic to detect vulnerabilities.
o Packet Sniffers :
o Collect copies of packets for analysis.
o Useful for diagnosing network issues but can also be misused for eavesdropping.
Firewall analysis tools help administrators discover and configure firewall rules effectively.
Example: A vulnerability scanner might reveal outdated software versions, prompting updates to close
security gaps.
Biometric Access Control
Biometric Access Control :
o Uses measurable human characteristics to authenticate users.
o Includes fingerprint, palm print, hand geometry, facial recognition, retinal scans, and
iris patterns.
Acceptability :
o Balances user acceptance with security effectiveness.
o Highly reliable systems may be perceived as intrusive, leading to resistance from
users.
Biometrics provide strong authentication but must be implemented carefully to ensure privacy and
usability.
Example: A fingerprint scanner ensures only authorized personnel can access sensitive areas.
LECTURE 4
CUE
NOTES
Why is program security
important? Program Security

What are the types of Importance of Program Security : Programs constitute a significant part of computing systems,
program flaws? including operating systems, device drivers, network infrastructure, databases, and applications.
Key Questions :

What is a buffer overflow? o How do we keep programs free from flaws?

o How do we protect computing resources against programs that contain flaws?
Why are buffer overflows
dangerous? Flaws in programs can lead to vulnerabilities that attackers exploit to compromise systems.
Example: A buffer overflow in an application could allow an attacker to execute arbitrary code.

What is malicious code? Types of Program Flaws

Inadvertent Flaws : Intentional Flaws :

Errors made unintentionally by developers. Deliberately introduced by malicious actors.
Examples: Buffer overflows, validation errors,
domain errors, serialization issues, inadequate Examples: Malware, trapdoors, covert channels,
What controls can be authentication mechanisms, and boundary and logic bombs.
implemented during condition violations.
software development?
What administrative Inadvertent flaws often arise due to human error, poor coding practices, or inadequate testing.
controls enhance program
security? Intentional flaws are designed to exploit system weaknesses for malicious purposes. Example: A Trojan
horse might appear as legitimate software but secretly performs harmful actions.
Buffer Overflows
Definition : A buffer overflow occurs when more data is written to a buffer than it can hold, spilling into
adjacent memory locations.
Security Implications :
o Can overwrite critical data or instructions.
o Allows attackers to inject and execute malicious code.
Example : char sample[10];
for (i = 1; i <= 10; i++) sample[i] = 'A'; // Writes beyond allocated space
Modern programming languages and compilers include safeguards to prevent buffer overflows, such as
bounds checking. Defensive programming techniques, like input validation and using safer functions, help
mitigate this risk.
Example: Using strncpy instead of strcpy prevents buffer overflows in C.
Malicious Code
Malicious Code : Software designed to harm or exploit systems.
Types :
o Virus : Attaches itself to programs and propagates copies.
o Worm : Self-replicating malware that spreads across networks.
o Trojan Horse : Appears legitimate but performs hidden malicious actions.
o Logic Bomb : Triggers harmful actions when specific conditions are met.
o Time Bomb : Executes at a predetermined time.
o Trapdoor : Provides unauthorized access to functionality.
o Covert Channels : Secretly transmit information.
Malicious code can spread through email attachments, infected files, or network exploits. Antivirus
software detects and removes known threats by scanning for signatures or suspicious behavior. Example:
The Stuxnet worm targeted industrial control systems, causing physical damage.
Controls Against Program Threats
Controls :
o Modularity : Ensure components are independent and have limited interactions.
o Encapsulation : Minimize interfaces to reduce covert channels.
o Information Hiding : Restrict component effects on others.
o Peer Reviews : Conduct thorough reviews of code and design.
o Hazard Analysis : Identify potential system hazards systematically.
o Testing : Perform unit, integration, function, performance, acceptance, installation, and
regression tests.
o Good Design : Follow fault-tolerance philosophies, handle failures consistently, capture design
rationale, and use design patterns
How do operating systems
contribute to program Administrative Controls :
security? o Establish standards for development, documentation, testing, and configuration management.
What are trusted software o Conduct regular security audits.
and mutual suspicion? o Implement separation of duties to reduce insider threats.
Static analysis tools examine code characteristics to identify potential faults before runtime. Configuration
management ensures controlled changes during development and maintenance. Example: A peer review
might catch a logical flaw that automated tests miss.
Operating System Controls
 Trusted Software :
Code rigorously developed and analyzed. Ensures functional correctness, integrity enforcement,
limited privilege, and appropriate confidence levels.
 Mutual Suspicion :
Assumes other programs may not be trustworthy.
 Confinement :
Limits resources accessible to programs.
 Access Logs :
Tracks who accessed computer objects, when, and for how long.
Operating systems provide mechanisms like sandboxes, virtual machines, and privilege escalation
restrictions to enhance security. Example: A confined program cannot access sensitive files outside its
designated directory.
LECTURE 5

CUE
NOTES

Why is security not solely Security Beyond Technology : While technology plays a critical role in security, administrative and
a technical issue? physical controls are equally important.

What are the three main Components of Security :

components of security?  Technical Controls : Firewalls, encryption, intrusion detection systems (IDPS), etc.
 Administrative Controls : Policies, risk analysis, training, and audits.
 Physical Controls : Environmental safeguards, access control, and disaster recovery plans.
What is a security plan?
Example: A firewall is useless if there is no power to run it, or if sensitive documents are mailed to
competitors due to lack of employee awareness. Administrative and physical controls ensure that technical
measures function effectively and are aligned with organizational goals.
What is risk analysis?
Security Planning
How is risk exposure
calculated? Definition : A security plan documents the structured process of planning adequate, cost-effective
security protection for a system.
Key Elements :
o Policy : The overarching goal of computer security.
What is a security policy?
o Current State : Description of the current status.
What functions does it o Requirements : How to meet goals, including legal considerations.
serve? o Recommended Controls : Mapping controls to identify vulnerabilities.
o Accountability : Assigning responsibility for implementation and maintenance.
o Timetable : Setting deadlines for tasks.
o Continuous Attention : Ensuring the plan remains up to date.

What are the types of A well-documented security plan reflects input from various stakeholders, such as information owners,
physical security system operators, and security managers. Example: A hospital's security plan might prioritize protecting
measures? patient data while ensuring uninterrupted access for authorized medical staff.
How do they protect Risk Analysis
against natural disasters
and theft? Definition : Risk analysis involves identifying assets, assessing vulnerabilities, estimating likelihoods, and
computing expected losses. Risk Exposure Formula :
i. Steps : Identify assets.
ii. Determine vulnerabilities. Risk = Threat × Vulnerability
iii. Estimate likelihood of exploitation.
Risk Exposure = Risk Impact × Risk
iv. Compute expected annual loss.
Probability
v. Survey applicable controls and their costs.
vi. Project annual savings of control.
Risk analysis helps organizations decide whether to accept, mitigate, transfer, or avoid risks. Example: A
company might calculate the risk exposure of a server outage by multiplying the financial impact of
downtime by its probability of occurrence.
Organizational Security Policies
A security policy is a high-level management document that informs users of the goals and constraints on
system usage.
Functions : Recognize sensitive information assets. Clarify security responsibilities. Promote awareness
among existing employees. Guide new employees.
Audience : Users: Those interacting with the system. Owners: Individuals responsible for maintaining the
system. Beneficiaries: Stakeholders benefiting from secure operations.
Physical Security
Protection Against Natural Disasters : Earthquakes, hurricanes, floods, fires, storms, etc. Measures
include structural reinforcement, flood barriers, fire suppression systems, and backup power supplies.
Environmental Protection : Electrical issues: Blackouts, spikes, surges, sags, faults. Air conditioning and
humidity controls. Electromagnetic interference (EMI) protection.
Theft Prevention : Internal and external threats. Measures include locks, guards, surveillance cameras,
and secure storage.
What is a business
continuity plan (BCP)? Business Continuity and Disaster Recovery

How does it differ from a Business Continuity Plan (BCP) :

disaster recovery plan  Long-term strategic plan ensuring continued operation before, during, and after a
(DRP)? disaster.
 Goals: Maintain critical services and minimize disruption.
Disaster Recovery Plan (DRP) :

 Short-term tactical plan addressing specific IT-oriented disruptions.

 Focuses on recovering critical IT systems.
 Part of the broader BCP.
Contingency planning includes:

 Redundant Sites : Exact production duplicates.

 Hot Sites : Fully configured sites with necessary hardware and applications.
 Warm Sites : Partially equipped sites relying on backups.
 Cold Sites : Alternative locations requiring setup after a disruption.
 Mobile Sites : Portable data centers.
 Reciprocal Agreements : Bi-directional agreements for shared resources.
 Backups : Geographically distributed to ensure redundancy.