Security

1
Security

• Authorization - WHO? Can do What?
• Scope of Security Concerns
• Goals
• Measures

2
Security Concerns

• Authorization
• Where is the information?
• Who has possible access?
• Who has authorized access?
• Who can change the information?
• Who can find the information accidentally?
• Who can change the security?

3
Security Goals

• NIST Data Security goals
• http//security.isu.edu/isl/800-4.html
• Sealed Tamper Proof
• Sequenced unique, time stamped, traceable
• Secret understood by authorized individuals
• Signed sender identity
• Stamped received by intended recipient

4
Security Measures

• Transmission Facilities
• Ease of tapping
• Ease of overhearing
• Ease of disruption
• Passwords
• Levels Workstation, OS, Application
• Other identity authorization
• Logging -
• Historical Oink! (what was done)
• Statistical summary (who was on)
• Used after-the-fact

5
Security Measures (2)

• Closed User Groups who can use a channel?
• Packet switching networks
• e.g usenet lists posters must be subscribers
• Firewalls
• Hardware and/or software (wwu cryptocards)
• Isolates systems from outsiders
• Packet filtering source destination
• e.g. IP filtering
• Level network (dialup) .. Application
  (Subscriber)

6
Security Measures (3) Encryption

• Encryption (Decryption)
• Hardware/Software
• Text encrypt Cipher text decrypt text
• Encryption key algorithm (cipher)
• Secret Keys changeable/breakable
• Symmetric/Asymmetric

7
Encryption

• DES (NIS) DEA (ANSI) standard algorithm
• Triple DES
• Asymmetric
• Public Private Keys (paired)
• encrypt (recipient public key)
• decrypt (recipient private key)
• http//www.geekgirls.com/publick.htm
• Can also verify sender (digital signature)
• Session symmetric keys
• Certificates time stamps
• Hardware, Software, Firmware

8
Encryption (continued)

• Privacy, Legal Regulatory issues.
• http//www.computerprivacy.org
• PGP
• http//www.pgpi.org/
• http//www.scramdisk.clara.net/pgpfaq.html
• AlgorithmsRSA