OSI Security Architecture 2

1
Network Security
Lecture 3 OSI Security Architecture

• Inam Ul Haq
• MS Computer Science (Sweden)
• Inam.bth_at_gmail.com, mr.inam.ulhaq_at_ieee.org
• Discussion forum questions.computingcage.com
• Member of IEEE, ACM, Movement Disorder Society,
  PDF, BossMedia, Michealjfox, Association for
  Information Systems and Internet Society.

2
Table of Contents

• OSI Security Architecture
• 4 Common Attacks
• Handling Attacks
• Exercise

3
OSI Security Architecture

• An international and systematic standard of
  defining and providing security requirements.
• Security requirements(confidentiality, integrity,
  availability)
• Used by IT managers and vendors in their products
• Proposed by ITU-T in recommendations X.800 as
  Security Architecture for OSI
• Security Attack
• Security Mechanism
• A process (or a device) that is designed to
  detect, prevent, or recover from a security
  attack. (methods are defined here)

4
Security Mechanisms (X.800)

• Specific Security Mechanisms
• Encipherment, digital signatures, access
  controls, data integrity, authentication
  exchange, traffic padding, routing control,
  notarization
• Pervasive Security Mechanisms
• Trusted functionality, security labels, event
  detection, security audit trails, security
  recovery
• Security Service
• These services make use of one or more security
  mechanisms to provide the service. It enhances
  the security of the data processing systems and
  the information transfers of an organization.
  (methods are implemented here)
• It includes Authentication, Confidentiality,
  Integrity, Availability, Non-repudiation, Access
  Control

5
4 Common Types of Threats
6
4 Common Types of Threats (2)
7
Handling Attacks

• Passive attacks focus on Prevention
• Easy to stop
• Hard to detect
• Active attacks focus on Detection and Recovery
• Hard to stop
• Easy to detect

8
Exercise

1. What is the OSI security architecture?
2. Define X.800, Traffic Padding, Routing Control,
   Notarization, Security Audit.
3. What is the difference between passive and active
   security threats?
4. Enlist and briefly define categories of passive
   and active security attacks.
5. Enlist and briefly define categories of security
   services.
6. Enlist and briefly define categories of security
   mechanisms.Security Audit Checklist
   (https//chrishardie.com/2003/04/computer-security
   -audit-checklist/ )