Information Security.

Authors Avatar
GCSE ICT

               Information Security

Palestine Polytechnic University
Department of Administrative Science and Informatics
Information Technology



Information Security
By:
Fadi Swate
Mohammad A. Amro
Mohammad M. Haddad
Rana Al-Natsheh
Somaya Al-Qwasmeh

Presented to:
Ms Ahlam Qura'

2004

Introduction

What is computer security?

Computer security is the process of preventing and detecting unauthorized use of your computer. Prevention measures help you to stop unauthorized users (also known as "intruders") from accessing any part of your computer system. Detection helps you to determine whether or not someone attempted to break into your system, if they were successful, and what they may have done.

What's before applying security ?

What resources are we trying to protect?

A hacker who compromises or impersonates a host will usually have access to all of its resources; like files, storage devices, phone lines .. etc. and from a practical perspective , some hackers are most interested in busing the identity of the host , not only to reach its dedicated resources but also  to have an opportunity to make a link or some connection to other target ,possibly more interesting targets.

Other might actually be interested in the data on your machine , weather it is sensitive company material or government secrets.

Many enhanced techniques enable the entering your computer although you have a security system.

The strength of ones computer security defenses should be suitable to the threat outsiders.

So computer security is not a goal it’s a means toward a goal that is "Information Security".

The last question to be answered before deploying a security is:

How much security can be offered?

We can spilt the cost in two parts direct financial expenditures such as building a firewall.

so as a solution , machines with sensitive files may require extra level of passwords or file encryption , and we will talk about this later in this study.

The fact is one or every one wants to protect all such resources , here the obvious answer is to stop attackers at the front door or not let them into the computer system in the first place.

This leads us to our second major question :

Against whom must the computer system be defended?

Techniques that maybe enough  against a teenager with a modem are quite useless against a major intelligence agency so they may use gateway

The other type is the in direct ones resulting from problems of convenience and productively and even moral problems.

Too much security can hurt as surly as too little can.

  • Finding the proper balance is tricky but surly necessary
  • One more point is worth mentioning . even if you do not believe you have valuable assets it is still worth keeping hackers out of your machine.

   

The Need For Data Security

Each major advance in information technology changes our ideas about data security. Consider the use of written messages to replace those carried in the  memory of a messenger. Written messages are less prone to error, and since the courier need not know the message, but can destroy it in an emergency, there could be better security. Yet written messages can be concrete evidence of conspiracy or ‘spying whereas a carrier of a spoken message might escape unsuspected.  The need to hide the content of a written message must therefore have been realized very soon, and there is evidence that codes and ciphers appeared almost with the beginning of writing.

Such varied data security problems a from the more resent  advances in information technology — large stores and microprocessors which give us processing  wherever we need it. The microprocessor and the floppy disc create a new and urgent  problem of safeguarding software. The requirements summed up by the phrase ‘data security’ do not stay the same; they change as the technology changes.

In order to avoid repeating the same phrases we will use conventional names  for the actors in the security drama. The bad guys who are trying to do something with the system which the designers would like to avoid will be called the enemy’ 11 their activities will be called ‘attacking’ the system.

The advance of information technology has sparked off a public debate on the Subject of individual privacy. Like many public debates it expresses both rational

And irrational fears. Everyone is now alerted to the real dangers of inaccurate personal information and uncontrolled access to files. Most advanced countries have introduced laws to enforce a reasonable degree of individual data privacy and others have such laws in preparation. If we think of privacy as the legal concept, then security of data is one of the means by which the privacy can be obtained.

The implementation of these new laws is likely to produce applications for data security techniques.

Of the three operations carried out in information systems, storage, processing and transmission, it is undoubtedly data transmission that carries the greatest of security risks. A communication network consists of numbers of cables, radio links, switches and multiplexers in a variety of locations, all of these parts of the system being potential targets for ‘line taps’ or ‘bugs’. It is impossible to make a widespread network physically secure, therefore security measures depend on information Techniques such as cryptography.

No data can be made secure without physical protection of some sort, of the equipment The effect of good design is to concentrate the need for physical security not to circumvent it entirely. In particular, processing of data usually (perhaps always) requires those data to be in clear form, not enciphered; therefore processors themselves must be protected from intrusion, such as the attachment of radio bugs. In many systems the data and operations needing the greater degree of security can be contained in one box of modest size, physically strong and designed to destroy its stored secrets when it is opened. This is called a tamper- resistant module and it is a central element of many systems which this book  will describe

Security and people

The owners of a system depend for its security in the first place on the integrity

of the supplier which itself depends on the people who design build and maintain the system When it is in operation keys and passwords are introduced which protect it from enemies outside, including enemies in the ranks of the suppliers, unless software changes have subverted the protection. With good design, the security then depends on the people who operate the system and carry out its security –related procedures.

In a well-designed system it should be clear who is being trusted and to what

extent, but there is no way to  make the system proof against, unlimited deceit.

The Law

the 1986 act contains terms that are not defined  Law, for that matter, even within the country, is not much help The Internet should be available  to everyone even hackers The internet provides many new opportunities, but these cannot be accessed if you have a fortress-under-siege mentality. Still there are risks associated with opining up your system .

In the aftermath of the worm, question   have been raised about how the virus spread how it was contained and what steps if any are needed to increase   Internet security. These questions have been the meetings and reports prepared by government agencies and university researchers. A GAO report filed on the request of the government reported the main vulnerabilities The 1dentified vulnerabilities included the lack of a focal point for addressing internet wide security problems security weaknesses at some host sites and problems in developing distributing  and installing systems software fixes and inept or ill-trained administrators ten years down the road new and emerging web security problem still can be broadly traced back to these underlying problems

Security in Web-based s stems is a fundamental question where much could have been learned from failures in earliend to the basic t access points to the enterprise network from remote locations. In addition, organizations need to provide security for:

  1. Network and system administrators accessing network equipment and connected devices.
  2. . Laptop computers used by mobile professionals and telecommuters.
  3. Specific websites within the corporate intranet or extranet.
  4. E-mail messages transported over private or public networks.
  5. Several aspects of the organization’s information assets’ security ties in very tightly with its web server security, starting with the publicly accessible site, the intranet. The main focus throughout this book, however, is on the Web-connected systems.
Join now!

Intruders and Networks

Hacking

Why Hack?

Intruders (hackers, attackers, or crackers) may not care about your identity. Often they want to gain control of your computer so they can use it to launch attacks on other computer systems.

Having control of your computer gives them the ability to hide their true location as they launch attacks, often against high-profile computer systems such as government or financial systems.

Intruders may be able to watch all your actions on the computer, or cause damage to your computer by reformatting your hard drive or changing your data.

How ...

This is a preview of the whole essay

Information Security.
Document Details
  • Word Count
    6679
  • Page Count
    30
  • Level
    GCSE
  • Subject
    ICT
Related Essays
Internet banking security Peer reviewed
Internet banking security
Email and Email Security. Peer reviewed
Email and Email Security.
Digital Security Within the Workplace Peer reviewed
Digital Security Within the Workplace
The Internet as a network – Security.
The Internet as a network – Security.