Computer security is the protection of the assets of a computer or computer system.
Assets and Their Value
Types of assets: hardware, software, data, people, processes, or combinations of these.
Asset value:
- Depends on the asset owner’s or user’s perspective.
- May be independent of monetary cost, depending instead on factors such as replacement cost.
- May be time or event dependent.
The value of an asset influences the threats it faces. The type of an asset has a bearing on its vulnerabilities.
Vulnerability-Threat-Control Paradigm
- Vulnerability
A weakness in a system, in procedures, design, or implementation, that might be exploited to cause loss or harm. - Threat
A set of circumstances with the potential to cause loss or harm to a computing system. - Control
An action, device, procedure, or technique that removes or reduces a vulnerability.
Threats to a computer system originate from 3 sources:
- Human-initiated.
- Computer-initiated.
- Induced by nature.
Potential harm to an asset is viewed from 2 perspectives:
- What bad things can happen to assets.
- Who or what can cause or allow those bad things to happen.
Security Properties
3 basic properties for an asset:
- Confidentiality
Ability of a system to ensure an asset is viewed (read) only by authorized parties. - Integrity
Ability of a system to ensure an asset is modified (write) only by authorized parties. - Availability
Ability of a system to ensure an asset can be used by any authorized parties.
These 3 properties (CIA) are both basic security properties and the objects of security threats.
Communication over networks introduces additional properties:
- Authentication
Ability of a system to confirm the identity of a sender. - Nonrepudiation
Also called accountability, the ability of a system to confirm that a sender cannot convincingly deny having sent something. - Auditability
Ability of a system to trace all actions related to a given asset.
Acts Causing Security Harm
The CIA triad can be viewed from the perspective of the nature of the harm caused to assets, characterized by 4 acts:
- Interception
Confidentiality suffers if someone intercepts data. - Interruption
Availability is lost if someone or something interrupts a flow of data or access to a computer. - Modification
Integrity fails if someone or something modifies data. - Fabrication
Integrity also fails if someone or something fabricates false data.
Attackers are broadly categorized as passive or active.