Unit 6. Computer Security

With the increased reliance on computer technologies to facilitate commerce and communications, more people are connecting their computers to the Internet. Although this trend enhances computer users' ability to share information and conduct business, it also provides more ways for intruders to break into computer systems.

Tools to breach computer systems that require minimal computer system expertise are increasingly available. As a consequence, more people can hack into computer systems, steal confidential data on a computer, alter, or even corrupt, targeted computer systems. Intruders can use your computer to attack your organization, other corporations, and even governments. Computers can be used to achieve detrimental effects if we, as computer users, are not aware of security vulnerabilities and do not take steps to prevent computer attacks.

To secure your system, first you need to know how your system may be vulnerable, and what threats intruders can cause. This information is provided in theSecurity Threats section. Next, you will explore current technologies to protect your data in Security Technologies section. Lastly, you will learn about existing tools and best practices to prevent and detect intrusions, as well as recovering from an attack in Prevention, Detection, and Recovery section.

Whether a computer can be kept secure depends largely on its users. At the end of this unit, you should become an informed user of security issues and counter measures to provide better protection for your computer system.

Reading Sequence: 6.1 Security Threats 6.2 Security Technologies 6.3 Prevention, Detection, and Recovery
Assessments: Exercise 6

6.1 Security Threats

Before we delve into ways security can be breached, let us first examine the characteristics of a secure system.

A secure system maintains the following:

• Data confidentiality- data access is restricted to authorized personnel

• Data integrity- data is not altered unintentionally

• Data availability- services that enable data access are operational

Consequences of weak computer security for home users include:

• Sensitive information exposed- for example, intruder can use your password and credit card number to steal your money.

• Loss of data - for example, intruders can delete or corrupt important documents such as financial statements and business proposals.

• Loss of system functionality- for example, intruders can occupy your CPU and memory using malicious programs disabling the system to process legitimate instructions.

Additional consequences of weak computer security for businesses may include:

• Loss of time and money devoted to resolving security issues (for example, loss of revenue opportunity during system downtime)

• Loss of trust in system from customers resulting in loss of profit, reputation, jobs, and potentially the entire business (for example, if credit card information of customers could be obtained by intruders through an online store, then no one would use the site, and the business will no longer be profitable.)

To understand how to secure a computer system, you should first understand the intruders, who they are and how they attack. The common attack methods discussed in this section are categorized into three groups: identity theft/privacy violation attacks, malicious software programs (for example, virus, worms, and Trojan horse), and denial of service attacks. Identity theft/privacy violation attacks generally violate data confidentiality. Malicious software programs can violate data confidentiality, integrity, and availability. Denial of service attacks are aimed at the availability of a system's resources.

We will examine each category of attack in more detail and gain a better understanding of the impact these security threats have on computer systems. You will also gain some tips on preventive measures to mitigate these attacks.

Reading Sequence: 6.1.1 Intruders: Who, Why, and How? Learning Goal: Knowledge of who the intruders are, their motivations of attack, and the steps they take to compromise computer systems. 6.1.2 Identity Theft and Privacy Violation. Learning Goal: Gain familiarity with ways an attacker can steal login names, passwords, and other sensitive information. 6.1.3 Malicious Software. Learning Goal: Knowledge of software programs such as virus, worm, and Trojan horse. Parsons/Oja, Chapter 3-Section E. Learning Goal: Knowledge of computer viruses and how to fight them. 6.1.4 Denial of Service. Learning Goal: Obtain understanding of denial of service (DoS) attack.

                                           

Assessments: Multiple-Choice Quiz 22