Section 1.2. What Is Computer Security?

1.2. What Is Computer Security?

The term computer security has different interpretations based on what era the term describes. Early on, computer security specialized in keeping the glass houses in which the computer core was positioned safe from vandalism, along with providing constant cooling and electricity. As computers became more dispersed, security became more of an issue of preserving data and protecting its validity, as well as keeping the secrets secret. As computers moved onto the desktop and into the home, computer security took the form of protection against data thieves and network attackers. Modern computer security includes considerations of business continuity. This ability mitigates interruption or loss regardless of the threat, and more importantly, develops rational systems that estimate and offset risk. These values are incorporated into procedures and policies that make computer security a priority from the top down. Today, industrial security, in terms of loss control due to theft, vandalism, and espionage, involves the same personnel controls and physical security provisions that protect the enterprise as a whole.

You can get a good thumbnail sketch of computer and network security by examining the principles on which it is founded. Computer and network security are built on three pillars, commonly referred to by the C-I-A acronym:

• Confidentiality

• Integrity

• Availability

Data is confidential if it stays obscure to all but those authorized to use it. Data has integrity as long as it remains identical to its state when the last authorized user finished with it. Data is available when it is accessible by authorized users in a convenient format and within a reasonable time. (Note: the C-I-A acronym will be repeated like a mantra throughout the course of this book.)

Following shortly on the heels of C-I-A are a host of other terms and acronyms. Each of these has its own shade of meaning, but all of them are part of the C-I-A model:

Identification

Who do you say you are?

Authentication

How do I know it's really you?

Authorization

Now that you are here, what are you allowed to do?

Accountability

Who did what, and, perhaps, who pays the bill?

Different groups emphasize different combinations. To "simple is best" administrators, a favored authentication would likely be the username (who you say you are) and password (prove it to me!) combination. Devotees of biometric security identification, on the other hand, who use some physical attribute as a means of identification, point with pride to the fact that a retina scan can identify and authenticate simply by taking a picture of the blood vessels in the back of someone's eye. (The crack to this system was demonstrated by actor Tom Cruise in the film Minority Report. It lent a whole new meaning to the phrase "He's got his father's eyes.") Other groups promote acronyms within acronyms. For example, "authentication, authorization, and accounting" (AAA) is Cisco shorthand meaning that user verification and rights determination can be accomplished in the same process as transaction record keeping, or audit logging.

Computer security and network security are part of a larger undertaking that protects your computer and everything associated with ityour building, your terminals and printers, your cabling, and your disks and tapes. Most importantly, computer security protects the information you've stored in your system. That's why computer security is often called information security.

The International Information Systems Security Certification Consortium, or (ISC)², encompasses the following 10 domains in its common body of knowledge:

• Information security management

• Access control systems and methodology

• Cryptography

• Physical security

• Enterprise security architecture

• Application security

• Telecommunications, network, and internet security

• Law, investigation, and ethics

• Business continuity planning

• Operations security

Each domain includes five functional areas:

• Information protection requirements

• Information protections environment

• Security technology and tools

• Assurance, trust, and confidence mechanisms

• Information protection and management services

1.2.1. A Broader Definition of Security

The popular conception of computer security is that its only goal is secrecy, such as keeping the names of secret agents from falling into the hands of the enemy, or keeping a nationwide fast food chain's new advertising strategy from being revealed to a competitor. Secrecy is a very important aspect of computer security, but it's not the whole story.

In some systems or application environments, one aspect of security may be more important than others. Your own assessment of what type of security your organization requires will influence your choice of the particular security techniques and products needed to meet those requirements.

1.2.2. Secrecy and Confidentiality

A secure computer system must not allow information to be disclosed to anyone who is not authorized to access it. For example, in highly secure government systems, secrecy ensures that users access only information that they are allowed, by the nature of their security clearances, to access. Similarly, in business environments, confidentiality ensures the protection of private information (such as payroll data) as well as sensitive corporate data (such as internal memos and competitive strategy documents).

Of course, secrecy is of paramount importance in protecting national defense information and highly proprietary business information. In such environments, other aspects of security (e.g., integrity and availability), while important, may be less critical. Chapter 3 discusses several major methods of enforcing secrecy or confidentiality in your system, including controlling who gets access and specifying what individual users are able to do. Chapter 7 discusses encryption, another excellent way to keep information a secret.

1.2.3. Accuracy, Integrity, and Authenticity

A secure computer system must maintain the continuing integrity of the information stored in it. Accuracy or integrity means that the system must not corrupt the information or allow any unauthorized malicious or accidental changes to it. It wasn't deliberate, but when a simple software error changed entries in Bank of New York transactions many years ago, the bank had to borrow $24 billion to cover its accounts until things got straightened outand the mistake cost $5 million in extra interest.

In network communications, a related variant of accuracy known as authenticity provides a way to verify the origin of data by determining who entered or sent it, and by recording when it was sent and received.

In financial environments, accuracy is usually the most important aspect of security. In banking, for example, the confidentiality of funds transfers and other financial transactions is usually less important than the verifiable accuracy of these transactions. Chapter 7 discusses message authentication, a method that ensures the accuracy of a transmission. With this method, a code is calculated and appended to a message when that message is sent across a network. At the receiving end, the code is calculated again. If the two codes are identical, the message sent is the same as the message receivedproof that it wasn't forged or modified during transmission.

1.2.4. Availability

A secure computer system must keep information available to its users. Availability means that the computer system's hardware and software keeps working efficiently and that the system is able to recover quickly and completely if a disaster occurs.

The opposite of availability is denial of service, or DoS. Denial of service means system users are unable to get the resources they need. The computer may have crashed. There may not be enough memory or processes to run a program. Needed disks, tapes, or printers may not be available. DoS attacks can be every bit as disruptive as actual information theft, attacking system availability by spreading through networks, creating new processes, and effectively blocking all other work on the infected computers.

In some ways, availability is a baseline security need for everyone. If you can't use your computer, you won't be able to tell whether your secrecy and accuracy goals are being met. Even users who abhor "security" agree that their computer systems have to keep working. Many of them don't realize that keeping systems running is also a type of security.

Chapters 5 and 6 discuss two important ways to ensure the availability of a network system: careful system administration and sound system design.