Define information security Define security as process, not point product.

Save this PDF as:
 WORD  PNG  TXT  JPG

Size: px
Start display at page:

Download "Define information security Define security as process, not point product."

Transcription

1 CSA 223 Network and Web Security Chapter One What is information security. Look at: Define information security Define security as process, not point product.

2 Define information security Information is a knowledge obtained from investigation, study, instruction, news or facts. Security is freedom from danger, safety; freedom from fear. Information security measures adopted to prevent the unauthorized use, misuse, modification, or denial of use of knowledge, facts, data, or capability. Or it is the steps you take to guard your information.

3 Define information security People are the weakest link in securing the organization information. Information security will not guarantee the safety of the organization, information, or computer systems. Security is a process, not a product A single layer of security cannot ensure good security. Effective security is achieved by a combination of all security disciplines. Do not rely on a single product for all security you must use layered approach.

4 Define information security Information security is mindset; examine the threats to the organization. with this mindset, the user of information should feel confident and comfortable with the security process used by an organization. There is currently no effective process to certify computer system.

5 History of security Physical security : All assets and important information are physical. To protect these assets, physical security was used, such as walls, moats, and guards. Communication security : Use of encryption system (cipher) is allowing the user to send messages that could not be read if they are intercepted. Emissions security. Computer security. Network security. Information security.

6 Define security as process Many different products and types of products are necessary to fully protect an organization some of these technologies and products include : 1. Anti-virus software. 2. Access controls. 3. policy management 4. Firewalls. 5. Biometrics 6. Vulnerability scanning. 7. Encryption.

7 Anti-virus The goal of anti-virus is to reduce the exposure of the organization to malicious code. Anti-virus software will not protect organization from an intruder who misuses a legitimate program to gain access to the system.

8 Access control Capability to restrict access to files based on the ID of the user. Access control can restrict legitimate users from accessing files they should not have access to. Authenticating a user s access is accomplished by using any combination of something you know, something you have, or something you are.

9 Policy management and intrusion detection Policies and procedures are important components of a good security program, and the management of policies across computer systems is equally important. Using of a policy management system, an organization can be made aware of any system that does not confirm to policy. Intrusion detection identify when someone doing something wrong and stop them. Intrusion detection systems are not foolprof and cannot replace security practices

10 Firewalls Firewalls are access control devices for the network and can assist in protecting an organization s internal network from external attacks. By their nature, firewalls are border security products, meaning that they exist on the border between the internal network and the external networks. Although firewalls provide protection from attackers, they cannot prevent an attack from using an allowed connection.

11 Biometrics Biometrics uses a biological elements to authenticate the user s access. Biometrics are yet another authentication mechanism and they too can reduce the risk of someone guessing a password. Types of Biometrics scanners include fingerprints, face recognition and voice. Each method usually required some type of device to identify human characteristics.

12 Encryption Encryption is the primary mechanism for communications security. Encryption might even protect information that is in storage by encrypting files. The encryption system will not differentiate between legitimate and illegitimate users if both present the same keys to the encryption algorithm. Therefore,encryption by itself will not provide security. Encryption need to controls on the Encryption keys and the system at hole.

13 Vulnerability Scanning and Physical Security Scanning computer system for vulnerabilities is an important part of a good security program. Vulnerability scanning will not detect legitimate users who may have inappropriate access. Physical security is the one product category that could provide complete protection to computer systems and information. Employees must have access to computers and information in order for the organizations to function. Therefore, the physical security must allow some people to gain access in this case physical security will not protect system from attacks that use legitimate access.

14 Chapter two Types of Attacks Look at : Access attacks. Modification attacks Denial-of-service attacks Repudiation attacks

15 Types of attacks There are four primary categories of attacks: 1. Access attacks. 2. Modification attacks 3. Denial-of-service attacks 4. Repudiation attacks

16 2.1 Access attack An access attack is an attempt to gain information that the attacker is not authorized to see. This attack can occur wherever the information resides or may exist during transmission. This type of attack is an attack against the confidentiality of the information. There are three kinds of access attack: 1. Snooping 2. Eavesdropping 3. Interception

17 2.1.1 Snooping Snooping is looking through information files in the hopes that the attacker will find something interesting. If the files are on a computer system, an attacker may attempt to open one file after another until information is found. information stored on media Information on local hard drive and left in the office or on backups taken off-site desktop computer

18 2.1.2 Eavesdropping When someone listens in on a conversation that they are not a part of, that is Eavesdropping. To gain unauthorized access to information, an attacker must position himself at a location where information of interest is likely to pass by. Wireless networks have increased the opportunity to perform Eavesdropping. Mainframe attacker s computer Traffic from the desktop to The mainframe travels over The local area network. the attacker can listen on the session from the desktop by attaching to the same local area network

19 2.1.3 Interception Interception is an active attack against the information. When an attacker Intercepts information he is inserting himself in the path of the information and capturing it before it reaches its destination. Attackers may allow the information to continue to its destination or not. Information access using Interception is the most difficult option for an attacker.

20 How access attacks are accomplished If access control permission are set properly, the unauthorized individual should be denied access. Correct permissions will prevent most casual snooping. There are many vulnerabilities that will allow attacker to succeed in accessing the unauthorized data. Attackers use a Sniffer to Eavesdropping on the transmission. A sniffer is a computer that is configured to capture all the traffic on the network. A sniffer can be installed after an attacker has increased his privileges on a system or if the attacker is allowed to connect his own system to the network.

21 2.2 Modification attack A modification attack is an attempt to modify information that an attacker is not authorized to modify. Attacker may do one of the following : 1. Changes: one type of modification attack is to change existing information, such as an attacker changing an existing employee s salary or student grades. 2. Insertion: when an insertion attack is made, information that did not previously exist is added. For example, an attacker might choose to add transaction in a banking system that moves funds from customer s account to his own. 3. Deleting: a delete attack is the removal of existing information.

22 How modification attacks are accomplished If the attacker has access to files, modification can be made. If the attacker does not have authorized access to files the attacker would first have to increase his access to the system or remove the permission on the file. Attackers use vulnerability on the computer system to access the system or files. Then attacker can modify the file data. The attacker exploits vulnerability on the server and replace homepage with something new.

23 Define Denial-of-Service Attacks Denial-of-Service (DoS) Attacks are attacks that deny the use of resources to legitimate users of the system, information, or capabilities. (DoS) is nothing more than vandalism. Denial of Access may occurs on: 1. Information: Denial of Access to information causes the information to be unavailable. 2. Application: Denial of Access to applications normally an attack against a computer system running the application. 3. Systems: Denial of Access to systems cause all information that is stored on the system to become unavailable.

24 How Denial-of-Service Attacks are accomplished DoS attacks against the information can be made by simply turning off the system. Turning off the system will also cause an attack against system. DoS attacks against the application. Attacker send a predefined set of commands to the application telling the application not process properly. The application will likely crash.

25 Repudiation Repudiation attack is an attempt to give false information or to deny that real event or transaction should have occurred. An attacker may masquerade as another person to collect information or interrupt normal operations.

Data Communication. Chapter # 5: Networking Threats. By: William Stalling

Data Communication. Chapter # 5: Networking Threats. By: William Stalling Data Communication Chapter # 5: By: Networking Threats William Stalling Risk of Network Intrusion Whether wired or wireless, computer networks are quickly becoming essential to everyday activities. Individuals

More information

Ethics and Information Security. 10 주차 - 경영정보론 Spring 2014

Ethics and Information Security. 10 주차 - 경영정보론 Spring 2014 Ethics and Information Security 10 주차 - 경영정보론 Spring 2014 Ethical issue in using ICT? Learning Outcomes E-policies in an organization relationships and differences between hackers and viruses relationship

More information

Firewalls, Tunnels, and Network Intrusion Detection

Firewalls, Tunnels, and Network Intrusion Detection Firewalls, Tunnels, and Network Intrusion Detection 1 Firewalls A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system.

More information

(2½ hours) Total Marks: 75

(2½ hours) Total Marks: 75 (2½ hours) Total Marks: 75 N. B.: (1) All questions are compulsory. (2) Makesuitable assumptions wherever necessary and state the assumptions made. (3) Answers to the same question must be written together.

More information

Access Controls. CISSP Guide to Security Essentials Chapter 2

Access Controls. CISSP Guide to Security Essentials Chapter 2 Access Controls CISSP Guide to Security Essentials Chapter 2 Objectives Identification and Authentication Centralized Access Control Decentralized Access Control Access Control Attacks Testing Access Controls

More information

COMPUTER NETWORK SECURITY

COMPUTER NETWORK SECURITY COMPUTER NETWORK SECURITY Prof. Dr. Hasan Hüseyin BALIK (1 st Week) Outline Course Information and Policies Course Syllabus 1. Overview Course Information Instructor: Prof. Dr. Hasan H. BALIK, balik@yildiz.edu.tr,

More information

The Need for Biometric Authentication

The Need for Biometric Authentication The Need for Biometric Authentication Presented previously at: InfoTec 2002 DefCon 10 in Las Vegas NebraskaCERT 2002 Mutual of Omaha ConAgra Foods Presented by: Nate Rotschafer Peter Kiewit Institute Revised:

More information

A Security Model for Space Based Communication. Thom Stone Computer Sciences Corporation

A Security Model for Space Based Communication. Thom Stone Computer Sciences Corporation A Security Model for Space Based Communication Thom Stone Computer Sciences Corporation Prolog Everything that is not forbidden is compulsory -T.H. White They are after you Monsters in the Closet Virus

More information

ANATOMY OF AN ATTACK!

ANATOMY OF AN ATTACK! ANATOMY OF AN ATTACK! Are Your Crown Jewels Safe? Dom Kapac, Security Evangelist WHAT DO WE MEAN BY CROWN JEWELS? Crown jewels for most organizations are critical infrastructure and data Data is a valuable

More information

90% 191 Security Best Practices. Blades. 52 Regulatory Requirements. Compliance Report PCI DSS 2.0. related to this regulation

90% 191 Security Best Practices. Blades. 52 Regulatory Requirements. Compliance Report PCI DSS 2.0. related to this regulation Compliance Report PCI DSS 2.0 Generated by Check Point Compliance Blade, on April 16, 2018 15:41 PM O verview 1 90% Compliance About PCI DSS 2.0 PCI-DSS is a legal obligation mandated not by government

More information

5. Execute the attack and obtain unauthorized access to the system.

5. Execute the attack and obtain unauthorized access to the system. Describe how a combination of preventive, detective, and corrective controls can be employed to provide reasonable assurance about information security. Before discussing the preventive, detective, and

More information

Integrated Access Management Solutions. Access Televentures

Integrated Access Management Solutions. Access Televentures Integrated Access Management Solutions Access Televentures Table of Contents OVERCOMING THE AUTHENTICATION CHALLENGE... 2 1 EXECUTIVE SUMMARY... 2 2 Challenges to Providing Users Secure Access... 2 2.1

More information

Systems and Network Security (NETW-1002)

Systems and Network Security (NETW-1002) Systems and Network Security (NETW-1002) Dr. Mohamed Abdelwahab Saleh IET-Networks, GUC Spring 2017 Course Outline Basic concepts of security: Attacks, security properties, protection mechanisms. Basic

More information

System Threat Analysis Case Study for Software Based Communications

System Threat Analysis Case Study for Software Based Communications System Threat Analysis Case Study for Software Based Communications David K. Murotake, Ph.D. dmurotak@scatechnica.com Mobile: (603) 321-6536 www.scatechnica.com SBC Workshop 2004 1 Introduction Software

More information

CompTIA Security+ (Exam SY0-401) Course 01 Security Fundamentals

CompTIA Security+ (Exam SY0-401) Course 01 Security Fundamentals CompTIA Security+ (Exam SY0-401) Course 01 Security Fundamentals This course contains copyrighted material used by permission of Logical Operations, Inc. Slide 1 Course 01: Security Fundamentals The Information

More information

Chapter 11: Networks

Chapter 11: Networks Chapter 11: Networks Devices in a Small Network Small Network A small network can comprise a few users, one router, one switch. A Typical Small Network Topology looks like this: Device Selection Factors

More information

Wireless LAN Security (RM12/2002)

Wireless LAN Security (RM12/2002) Information Technology in Education Project Reference Materials Wireless LAN Security (RM12/2002) Infrastructure Division Education Department The Government of HKSAR www.ited.ed.gov.hk December 2002 For

More information

Network Security and Cryptography. December Sample Exam Marking Scheme

Network Security and Cryptography. December Sample Exam Marking Scheme Network Security and Cryptography December 2015 Sample Exam Marking Scheme This marking scheme has been prepared as a guide only to markers. This is not a set of model answers, or the exclusive answers

More information

n Learn about the Security+ exam n Learn basic terminology and the basic approaches n Implement security configuration parameters on network

n Learn about the Security+ exam n Learn basic terminology and the basic approaches n Implement security configuration parameters on network Always Remember Chapter #1: Network Device Configuration There is no 100 percent secure system, and there is nothing that is foolproof! 2 Outline Learn about the Security+ exam Learn basic terminology

More information

2. INTRUDER DETECTION SYSTEMS

2. INTRUDER DETECTION SYSTEMS 1. INTRODUCTION It is apparent that information technology is the backbone of many organizations, small or big. Since they depend on information technology to drive their business forward, issues regarding

More information

Information Security Identification and authentication. Advanced User Authentication II

Information Security Identification and authentication. Advanced User Authentication II Information Security Identification and authentication Advanced User Authentication II 2016-01-29 Amund Hunstad Guest Lecturer, amund@foi.se Agenda for lecture I within this part of the course Background

More information

Cyber Criminal Methods & Prevention Techniques. By

Cyber Criminal Methods & Prevention Techniques. By Cyber Criminal Methods & Prevention Techniques By Larry.Boettger@Berbee.com Meeting Agenda Trends Attacker Motives and Methods Areas of Concern Typical Assessment Findings ISO-17799 & NIST Typical Remediation

More information

Security Aspects Control Rationale Best Practices Self-Assessment (Click all that applicable) 1. Security Policy and Security Management

Security Aspects Control Rationale Best Practices Self-Assessment (Click all that applicable) 1. Security Policy and Security Management Seven Habits of Cyber Security for SMEs Security Aspects Control Rationale Best Practices Self-Assessment (Click all that applicable) 1. Security Policy and Security Management Security Policy is an important

More information

CompTIA Security+(2008 Edition) Exam

CompTIA Security+(2008 Edition) Exam http://www.51- pass.com Exam : SY0-201 Title : CompTIA Security+(2008 Edition) Exam Version : Demo 1 / 7 1.An administrator is explaining the conditions under which penetration testing is preferred over

More information

e-commerce Study Guide Test 2. Security Chapter 10

e-commerce Study Guide Test 2. Security Chapter 10 e-commerce Study Guide Test 2. Security Chapter 10 True/False Indicate whether the sentence or statement is true or false. 1. Necessity refers to preventing data delays or denials (removal) within the

More information

ECCouncil Exam v9 Certified Ethical Hacker Exam V9 Version: 7.0 [ Total Questions: 125 ]

ECCouncil Exam v9 Certified Ethical Hacker Exam V9 Version: 7.0 [ Total Questions: 125 ] s@lm@n ECCouncil Exam 312-50v9 Certified Ethical Hacker Exam V9 Version: 7.0 [ Total Questions: 125 ] Question No : 1 An Intrusion Detection System(IDS) has alerted the network administrator to a possibly

More information

Linux Network Administration

Linux Network Administration Secure Remote Connections with OpenSSH Objective At the conclusion of this module, the student will be able to: Configure the ssh daemon start, stop, and restart sshd 17 January 2005 NETW 111 - SSH 2 SSH

More information

Best Practices With IP Security.

Best Practices With IP Security. Best Practices With IP Security Presented by Stuart Strong Presented by Stuart Strong s.strong@fecinc.com What are the threats? Know your enemy Network telescope research Current measurement of network

More information

n Explain penetration testing concepts n Explain vulnerability scanning concepts n Reconnaissance is the first step of performing a pen test

n Explain penetration testing concepts n Explain vulnerability scanning concepts n Reconnaissance is the first step of performing a pen test Chapter Objectives n Explain penetration testing concepts n Explain vulnerability scanning concepts Chapter #4: Threats, Attacks, and Vulnerabilities Vulnerability Scanning and Penetration Testing 2 Penetration

More information

تاثیرفناوری اطالعات برسازمان ومدیریت جلسه هشتم و نهم

تاثیرفناوری اطالعات برسازمان ومدیریت جلسه هشتم و نهم بنام خدا تاثیرفناوری اطالعات برسازمان ومدیریت جلسه هشتم و نهم امنیت بخشی به سیستمهای فناوری اطالعات Securing Information Systems 1 Learning Objectives Describe the business value of security and control.

More information

The Eight Rules of Security

The Eight Rules of Security The Eight Rules of Security The components of every security decision. Understanding and applying these rules builds a foundation for creating strong and formal practices through which we can make intelligent

More information

ISO/IEC Common Criteria. Threat Categories

ISO/IEC Common Criteria. Threat Categories ISO/IEC 15408 Common Criteria Threat Categories 2005 Bar Biszick-Lockwood / QualityIT Redmond, WA 2003 Purpose This presentation introduces you to the threat categories contained in ISO/IEC 15408, used

More information

Chapter 11: It s a Network. Introduction to Networking

Chapter 11: It s a Network. Introduction to Networking Chapter 11: It s a Network Introduction to Networking Small Network Topologies Typical Small Network Topology IT Essentials v5.0 2 Device Selection for a Small Network Factors to be considered when selecting

More information

Wireless Attacks and Countermeasures

Wireless Attacks and Countermeasures Wireless Attacks and Countermeasures Wireless Network Technology Wireless network refers to any type of computer network which is wireless, and is commonly associated with a network whose interconnections

More information

Exam : SY Title : CompTIA Security+(2008 Edition) Exam. Version : Demo

Exam : SY Title : CompTIA Security+(2008 Edition) Exam. Version : Demo Exam : SY0-201 Title : CompTIA Security+(2008 Edition) Exam Version : Demo 1.An administrator is explaining the conditions under which penetration testing is preferred over vulnerability testing. Which

More information

CTS2134 Introduction to Networking. Module 08: Network Security

CTS2134 Introduction to Networking. Module 08: Network Security CTS2134 Introduction to Networking Module 08: Network Security Denial of Service (DoS) DoS (Denial of Service) attack impacts system availability by flooding the target system with traffic or by exploiting

More information

# ROLE DESCRIPTION / BENEFIT ISSUES / RISKS

# ROLE DESCRIPTION / BENEFIT ISSUES / RISKS As SharePoint has proliferated across the landscape there has been a phase shift in how organizational information is kept secure. In one aspect, business assets are more secure employing a formally built

More information

CHAPTER 8 SECURING INFORMATION SYSTEMS

CHAPTER 8 SECURING INFORMATION SYSTEMS CHAPTER 8 SECURING INFORMATION SYSTEMS BY: S. SABRAZ NAWAZ SENIOR LECTURER IN MANAGEMENT & IT SEUSL Learning Objectives Why are information systems vulnerable to destruction, error, and abuse? What is

More information

SECURING YOUR HOME NETWORK

SECURING YOUR HOME NETWORK What is home network security? SECURING YOUR HOME NETWORK Home network security refers to the protection of a network that connects devices to each other and to the internet within a home. Whether it s

More information

Distributed Systems. Lecture 14: Security. Distributed Systems 1

Distributed Systems. Lecture 14: Security. Distributed Systems 1 06-06798 Distributed Systems Lecture 14: Security Distributed Systems 1 What is security? policies and mechanisms threats and attacks Overview Security of electronic transactions secure channels authentication

More information

CompTIA Security+ (2008 Edition) Exam

CompTIA Security+ (2008 Edition) Exam CompTIA SY0-201 CompTIA Security+ (2008 Edition) Exam Version: 7.20 Topic 1, Volume A QUESTION NO: 1 Which of the following cryptography types provides the same level of security but uses smaller key sizes

More information

Distributed Systems. Lecture 14: Security. 5 March,

Distributed Systems. Lecture 14: Security. 5 March, 06-06798 Distributed Systems Lecture 14: Security 5 March, 2002 1 What is security? policies and mechanisms threats and attacks Overview Security of electronic transactions secure channels authentication

More information

Computer Security: Principles and Practice

Computer Security: Principles and Practice Computer Security: Principles and Practice Chapter 3 User Authentication First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown User Authentication fundamental security building

More information

Chapter 10: Security and Ethical Challenges of E-Business

Chapter 10: Security and Ethical Challenges of E-Business Chapter 10: Security and Ethical Challenges of E-Business Learning Objectives Identify several ethical issues in IT that affect employment, individuality, working condition, privacy, crime health etc.

More information

Overview. Computer Network Lab, SS Security. Type of attacks. Firewalls. Protocols. Packet filter

Overview. Computer Network Lab, SS Security. Type of attacks. Firewalls. Protocols. Packet filter Computer Network Lab 2017 Fachgebiet Technische Informatik, Joachim Zumbrägel Overview Security Type of attacks Firewalls Protocols Packet filter 1 Security Security means, protect information (during

More information

CPET 499/ITC 250 Web Systems Chapter 16 Security. Topics

CPET 499/ITC 250 Web Systems Chapter 16 Security. Topics CPET 499/ITC 250 Web Systems Chapter 16 Security Text Book: * Fundamentals of Web Development, 2015, by Randy Connolly and Ricardo Hoar, published by Pearson Paul I-Hai, Professor http://www.etcs.ipfw.edu/~lin

More information

CS6501: Great Works in Computer Science

CS6501: Great Works in Computer Science CS6501: Great Works in Computer Science Jan. 29th 2013 Longze Chen The Protection of Information in Computer Systems Jerome H. Saltzer and Michael D. Schroeder Jerry Saltzer Michael Schroeder 1 The Meaning

More information

E-Commerce/Web Security

E-Commerce/Web Security E-Commerce/Web Security Prepared For: Software Engineering 4C03 Kartik Sivaramakrishnan McMaster University 2005 Prepared by James Allin 9902847 1.0 - Introduction... 3 2.0 - E-Commerce Transaction Overview...

More information

06/02/ Local & Metropolitan Area Networks. 0. Overview. Terminology ACOE322. Lecture 8 Network Security

06/02/ Local & Metropolitan Area Networks. 0. Overview. Terminology ACOE322. Lecture 8 Network Security 1 Local & Metropolitan Area Networks ACOE322 Lecture 8 Network Security Dr. L. Christofi 1 0. Overview As the knowledge of computer networking and protocols has become more widespread, so the threat of

More information

Information Security

Information Security Information Security Dr. Rabie A. Ramadan GUC, Cairo Rabie.ramadan@guc.edu.eg Room C7-310 Lecture 1 Class Organization One class Weekly One Tutorial Weekly Most probably taught by myself 3-4 theoretical

More information

God is in the Small Stuff and it all matters. .In the Small Stuff. Security and Ethical Challenges. Introduction to Information Systems Chapter 11

God is in the Small Stuff and it all matters. .In the Small Stuff. Security and Ethical Challenges. Introduction to Information Systems Chapter 11 Introduction to Information Systems Essentials for the Internetworked E-Business Enterprise 1 Eleventh Edition 2 Chapter Objectives C h a p t e r 11 Eleventh Edition James A. O Brien Identify several ethical

More information

GE Fanuc Intelligent Platforms

GE Fanuc Intelligent Platforms GE Fanuc Intelligent Platforms Vendor Statement for CERT CVE-2009-0216 CERT has reported vulnerabilities in ifix (versions PDE, 2.0, 2.2, 2.21, 2.5, 2.6, 3.0, 3.5, 4.0, 4.5, and 5.0). The vulnerabilities

More information

Point ipos Implementation Guide. Hypercom P2100 using the Point ipos Payment Core Hypercom H2210/K1200 using the Point ipos Payment Core

Point ipos Implementation Guide. Hypercom P2100 using the Point ipos Payment Core Hypercom H2210/K1200 using the Point ipos Payment Core PCI PA - DSS Point ipos Implementation Guide Hypercom P2100 using the Point ipos Payment Core Hypercom H2210/K1200 using the Point ipos Payment Core Version 1.02 POINT TRANSACTION SYSTEMS AB Box 92031,

More information

Full file at https://fratstock.eu

Full file at https://fratstock.eu CISSP Guide to Security Essentials, 2 nd Edition Solutions 2 1 CISSP Guide to Security Essentials, 2 nd Edition Chapter 2 Solutions Review Questions 1. The process of obtaining a subject s proven identity

More information

Chapter 4. Network Security. Part I

Chapter 4. Network Security. Part I Chapter 4 Network Security Part I CCNA4-1 Chapter 4-1 Introducing Network Security Introduction to Network Security CCNA4-2 Chapter 4-1 Introducing Network Security Why is Network Security important? Rapid

More information

POLICY 8200 NETWORK SECURITY

POLICY 8200 NETWORK SECURITY POLICY 8200 NETWORK SECURITY Policy Category: Information Technology Area of Administrative Responsibility: Information Technology Services Board of Trustees Approval Date: April 17, 2018 Effective Date:

More information

EXCERPT. NIST Special Publication R1. Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations

EXCERPT. NIST Special Publication R1. Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations EXCERPT NIST Special Publication 800-171 R1 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations An Excerpt Listing All: Security Requirement Families & Controls Security

More information

Protection and Security

Protection and Security Protection and Security CS 502 Spring 99 WPI MetroWest/Southboro Campus Three Circles of Computer Security Inner Circle Memory, CPU, and File protection. Middle Circle Security Perimeter. Authentication

More information

Lecture 9 User Authentication

Lecture 9 User Authentication Lecture 9 User Authentication RFC 4949 RFC 4949 defines user authentication as: The process of verifying an identity claimed by or for a system entity. Authentication Process Fundamental building block

More information

CERTIFIED SECURE COMPUTER USER COURSE OUTLINE

CERTIFIED SECURE COMPUTER USER COURSE OUTLINE CERTIFIED SECURE COMPUTER USER COURSE OUTLINE Page 1 TABLE OF CONTENT 1 COURSE DESCRIPTION... 3 2 MODULE-1: INTRODUCTION TO DATA SECURITY... 4 3 MODULE-2: SECURING OPERATING SYSTEMS... 6 4 MODULE-3: MALWARE

More information

Chapter 16: Advanced Security

Chapter 16: Advanced Security : Advanced Security IT Essentials: PC Hardware and Software v4.0 1 Purpose of this Presentation To provide to instructors an overview of : List of chapter objectives Overview of the chapter contents, including

More information

Easy-to-Use PCI Kit to Enable PCI Compliance Audits

Easy-to-Use PCI Kit to Enable PCI Compliance Audits Easy-to-Use PCI Kit to Enable PCI Compliance Audits Version 2.0 and Above Table of Contents Executive Summary... 3 About This Guide... 3 What Is PCI?... 3 ForeScout CounterACT... 3 PCI Requirements Addressed

More information

Computer Forensics: Investigating Network Intrusions and Cyber Crime, 2nd Edition. Chapter 3 Investigating Web Attacks

Computer Forensics: Investigating Network Intrusions and Cyber Crime, 2nd Edition. Chapter 3 Investigating Web Attacks Computer Forensics: Investigating Network Intrusions and Cyber Crime, 2nd Edition Chapter 3 Investigating Web Attacks Objectives After completing this chapter, you should be able to: Recognize the indications

More information

Vulnerability Management Policy

Vulnerability Management Policy Vulnerability Management Policy Document Type: Policy (PLCY) Endorsed By: Information Technology Policy Committee Date: 4/29/2011 Promulgated By: Chancellor Herzog Date: 6/16/2011 I. Introduction IT resources

More information

SINGLE COURSE. NH9000 Certified Ethical Hacker 104 Total Hours. COURSE TITLE: Certified Ethical Hacker

SINGLE COURSE. NH9000 Certified Ethical Hacker 104 Total Hours. COURSE TITLE: Certified Ethical Hacker NH9000 Certified Ethical Hacker 104 Total Hours COURSE TITLE: Certified Ethical Hacker COURSE OVERVIEW: This class will immerse the student into an interactive environment where they will be shown how

More information

Threat Modeling. Bart De Win Secure Application Development Course, Credits to

Threat Modeling. Bart De Win Secure Application Development Course, Credits to Threat Modeling Bart De Win bart.dewin@ascure.com Secure Application Development Course, 2009 Credits to Frank Piessens (KUL) for the slides 2 1 Overview Introduction Key Concepts Threats, Vulnerabilities,

More information

Network Security Issues and Cryptography

Network Security Issues and Cryptography Network Security Issues and Cryptography PriyaTrivedi 1, Sanya Harneja 2 1 Information Technology, Maharishi Dayanand University Farrukhnagar, Gurgaon, Haryana, India 2 Information Technology, Maharishi

More information

IS Today: Managing in a Digital World 9/17/12

IS Today: Managing in a Digital World 9/17/12 IS Today: Managing in a Digital World Chapter 10 Securing Information Systems Worldwide losses due to software piracy in 2005 exceeded $34 billion. Business Software Alliance, 2006 Accessories for war

More information

CS 356 Operating System Security. Fall 2013

CS 356 Operating System Security. Fall 2013 CS 356 Operating System Security Fall 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter 5 Database

More information

Configuring NAT for IP Address Conservation

Configuring NAT for IP Address Conservation This module describes how to configure Network Address Translation (NAT) for IP address conservation and how to configure inside and outside source addresses. This module also provides information about

More information

Ethical Hacking & Information Security. Justin David G. Pineda Asia Pacific College

Ethical Hacking & Information Security. Justin David G. Pineda Asia Pacific College Ethical Hacking & Information Security Justin David G. Pineda Asia Pacific College Topics for today: Is there such thing as ethical hacking? What is information security? What are issues that need to be

More information

CHAPTER 6 EFFICIENT TECHNIQUE TOWARDS THE AVOIDANCE OF REPLAY ATTACK USING LOW DISTORTION TRANSFORM

CHAPTER 6 EFFICIENT TECHNIQUE TOWARDS THE AVOIDANCE OF REPLAY ATTACK USING LOW DISTORTION TRANSFORM 109 CHAPTER 6 EFFICIENT TECHNIQUE TOWARDS THE AVOIDANCE OF REPLAY ATTACK USING LOW DISTORTION TRANSFORM Security is considered to be the most critical factor in many applications. The main issues of such

More information

A (sample) computerized system for publishing the daily currency exchange rates

A (sample) computerized system for publishing the daily currency exchange rates A (sample) computerized system for publishing the daily currency exchange rates The Treasury Department has constructed a computerized system that publishes the daily exchange rates of the local currency

More information

Introduction to Information Security Dr. Rick Jerz

Introduction to Information Security Dr. Rick Jerz Introduction to Information Security Dr. Rick Jerz 1 Goals Explain the various types of threats to the security of information Discuss the different categorizations of security technologies and solutions

More information

Securing the Distributed Enterprise

Securing the Distributed Enterprise Securing the Distributed Enterprise Hans Riemer Director of Business Development Hitachi Computer Products Software Solutions Division www.hitachisoftware.com 1 Why is Security a Big Deal? The corporation

More information

Finding Feature Information

Finding Feature Information This module describes how to configure Network Address Translation (NAT) for IP address conservation and how to configure inside and outside source addresses. This module also provides information about

More information

NETWORK THREATS DEMAN

NETWORK THREATS DEMAN SELF-DEFENDING NETWORK NETWORK THREATS DEMAN NEW SECURITY: STRATEGIES TECHNOLOGIES Self-Propagating Threats A combination of: self propagating threats Collaborative applications Interconnected environments

More information

10 Hidden IT Risks That Might Threaten Your Business

10 Hidden IT Risks That Might Threaten Your Business (Plus 1 Fast Way to Find Them) Your business depends on intelligence. But can you count on your technology? You may not be in the intelligence technology business, but it s probably impossible to imagine

More information

BOR3307: Intro to Cybersecurity

BOR3307: Intro to Cybersecurity Key Terms for lesson 4 are listed below: It is important that you maintain a copy of these key terms handy as you take this course and complete the readings. Working from a standard lexicon will keep you

More information

Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice.

Copyright 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. Workplace Security Solution from Tablet to Printers Holger Wenzel, Pre-Sales Computing Stefan Kitschmer, Category Manager Printing PPS, HP Germany HP Client Security Secure your investment with built-in

More information

19.1. Security must consider external environment of the system, and protect it from:

19.1. Security must consider external environment of the system, and protect it from: Module 19: Security The Security Problem Authentication Program Threats System Threats Securing Systems Intrusion Detection Encryption Windows NT 19.1 The Security Problem Security must consider external

More information

6 Vulnerabilities of the Retail Payment Ecosystem

6 Vulnerabilities of the Retail Payment Ecosystem 6 Vulnerabilities of the Retail Payment Ecosystem FINANCIAL INSTITUTION PAYMENT GATEWAY DATABASES POINT OF SALE POINT OF INTERACTION SOFTWARE VENDOR Table of Contents 4 7 8 11 12 14 16 18 Intercepting

More information

PROTECTING INFORMATION ASSETS NETWORK SECURITY

PROTECTING INFORMATION ASSETS NETWORK SECURITY PROTECTING INFORMATION ASSETS NETWORK SECURITY PAUL SMITH 20 years of IT experience (desktop, servers, networks, firewalls.) 17 years of engineering in enterprise scaled networks 10+ years in Network Security

More information

PracticeDump. Free Practice Dumps - Unlimited Free Access of practice exam

PracticeDump.   Free Practice Dumps - Unlimited Free Access of practice exam PracticeDump http://www.practicedump.com Free Practice Dumps - Unlimited Free Access of practice exam Exam : SY0-501 Title : CompTIA Security+ Certification Exam Vendor : CompTIA Version : DEMO Get Latest

More information

TIME SYSTEM SECURITY AWARENESS HANDOUT

TIME SYSTEM SECURITY AWARENESS HANDOUT WISCONSIN TIME SYSTEM Training Materials TIME SYSTEM SECURITY AWARENESS HANDOUT Revised 11/16/2017 2018 Security Awareness Handout All System Security The TIME/NCIC Systems are criminal justice computer

More information

Cyber security tips and self-assessment for business

Cyber security tips and self-assessment for business Cyber security tips and self-assessment for business Last year one in five New Zealand SMEs experienced a cyber-attack, so it s essential to be prepared. Our friends at Deloitte have put together this

More information

NETWORK INTRUSION. Information Security in Systems & Networks Public Development Program. Sanjay Goel University at Albany, SUNY Fall 2006

NETWORK INTRUSION. Information Security in Systems & Networks Public Development Program. Sanjay Goel University at Albany, SUNY Fall 2006 NETWORK INTRUSION Information Security in Systems & Networks Public Development Program Sanjay Goel University at Albany, SUNY Fall 2006 1 Learning Objectives Students should be able to: Recognize different

More information

CIS 5373 Systems Security

CIS 5373 Systems Security CIS 5373 Systems Security Topic 4.1: Network Security Basics Endadul Hoque Slide Acknowledgment Contents are based on slides from Cristina Nita-Rotaru (Northeastern) 2 Network Security INTRODUCTION 3 What

More information

Vulnerability Assessment. Detection. Aspects of Assessment. 1. Asset Identification. 1. Asset Identification. How Much Danger Am I In?

Vulnerability Assessment. Detection. Aspects of Assessment. 1. Asset Identification. 1. Asset Identification. How Much Danger Am I In? Detection Vulnerability Assessment Week 4 Part 2 How Much Danger Am I In? Vulnerability Assessment Aspects of Assessment Vulnerability Assessment is a systematic evaluation of asset exposure to threats

More information

Securing the Smart Grid. Understanding the BIG Picture 11/1/2011. Proprietary Information of Corporate Risk Solutions, Inc. 1.

Securing the Smart Grid. Understanding the BIG Picture 11/1/2011. Proprietary Information of Corporate Risk Solutions, Inc. 1. Securing the Smart Grid Understanding the BIG Picture The Power Grid The electric power system is the most capital-intensive infrastructure in North America. The system is undergoing tremendous change

More information

Overview of Information Security

Overview of Information Security Overview of Information Security Lecture By Dr Richard Boateng, UGBS, Ghana Email: richard@pearlrichards.org Original Slides by Elisa Bertino CERIAS and CS &ECE Departments, Pag. 1 and UGBS Outline Information

More information

The Security Problem

The Security Problem CSC 4103 - Operating Systems Spring 2007 Lecture - XX Protection and Security Tevfik Koşar Louisiana State University April 12 th, 2007 1 The Security Problem Security must consider external environment

More information

ENDNOTE SECURITY OVERVIEW INCLUDING ENDNOTE DESKTOP AND ONLINE

ENDNOTE SECURITY OVERVIEW INCLUDING ENDNOTE DESKTOP AND ONLINE ENDNOTE SECURITY OVERVIEW INCLUDING ENDNOTE DESKTOP AND ONLINE INTRODUCTION In line with commercial industry standards, the data center used by EndNote employs a dedicated security team to protect our

More information

University of Alabama at Birmingham MINIMUM SECURITY FOR COMPUTING DEVICES RULE July 2017

University of Alabama at Birmingham MINIMUM SECURITY FOR COMPUTING DEVICES RULE July 2017 University of Alabama at Birmingham MINIMUM SECURITY FOR COMPUTING DEVICES RULE July 2017 Related Policies, Procedures, and Resources UAB Acceptable Use Policy, UAB Protection and Security Policy, UAB

More information

Juniper Vendor Security Requirements

Juniper Vendor Security Requirements Juniper Vendor Security Requirements INTRODUCTION This document describes measures and processes that the Vendor shall, at a minimum, implement and maintain in order to protect Juniper Data against risks

More information

MTA Networking Fundamentals Exam.

MTA Networking Fundamentals Exam. Microsoft 98-367 MTA Networking Fundamentals Exam TYPE: DEMO http://www.examskey.com/98-367.html Examskey Microsoft 98-367 exam demo product is here for you to test the quality of the product. This Microsoft

More information

Securing Information Systems

Securing Information Systems Introduction to Information Management IIM, NCKU System Vulnerability and Abuse (1/6) Securing Information Systems Based on Chapter 8 of Laudon and Laudon (2010). Management Information Systems: Managing

More information

Fundamentals of Information Systems Security Lesson 8 Mitigation of Risk and Threats to Networks from Attacks and Malicious Code

Fundamentals of Information Systems Security Lesson 8 Mitigation of Risk and Threats to Networks from Attacks and Malicious Code Fundamentals of Information Systems Security Lesson 8 Mitigation of Risk and Threats to Networks from Attacks and Malicious Code Learning Objective Explain the importance of network principles and architecture

More information

Web Gate Keeper: Detecting Encroachment in Multi-tier Web Application

Web Gate Keeper: Detecting Encroachment in Multi-tier Web Application Web Gate Keeper: Detecting Encroachment in Multi-tier Web Application Sanaz Jafari Prof.Dr.Suhas H. Patil (GUIDE) ABSTRACT The Internet services and different applications become vital part of every person

More information

Module 20: Security. The Security Problem Authentication Program Threats System Threats Threat Monitoring Encryption. Operating System Concepts 20.

Module 20: Security. The Security Problem Authentication Program Threats System Threats Threat Monitoring Encryption. Operating System Concepts 20. Module 20: Security The Security Problem Authentication Program Threats System Threats Threat Monitoring Encryption 20.1 The Security Problem Security must consider external environment of the system,

More information