Information Security
Security Design Principles
Security design principles serve as foundational guidelines for building secure systems.
These principles help in creating robust, reliable, and defendable software and systems.
Key principles include:
1. Least Privilege: Every user/process should operate using the least set of
privileges necessary to complete the job.
2. Fail-Safe Defaults: Access should be denied by default, and only explicitly granted
when necessary.
3. Economy of Mechanism: System designs should be as simple as possible to
reduce vulnerabilities.
4. Complete Mediation: Every access to every resource must be checked for
authorization.
5. Open Design: The design should not rely on secrecy for security. The system
should remain secure even if the attacker knows the design.
6. Separation of Privilege: Access should depend on more than one condition to
reduce risk (e.g., two-factor authentication).
7. Least Common Mechanism: Resources should not be shared unnecessarily to
avoid unintended interactions.
8. Psychological Acceptability: Security mechanisms should not make systems hard
to use or users will bypass them.
Security Mechanisms
Security mechanisms are technical controls used to enforce security policies and protect
assets from threats. Examples include:
- Encryption: Ensures confidentiality by converting data into unreadable format
for unauthorized users.
- Digital Signatures: Ensures integrity and non-repudiation.
- Authentication: Verifies user identity using credentials (passwords, tokens,
biometrics).
- Access Control: Manages who can access what resources.
- Firewalls: Monitors and filters incoming/outgoing network traffic.
- IDS/IPS: Intrusion Detection and Prevention Systems identify and respond to
malicious activity.
- Hash Functions: Ensures data integrity by generating unique values for unique
data inputs.
Software Security
Software security is about integrating security practices throughout the software
development lifecycle (SDLC). It includes:
- Secure Coding: Avoid coding patterns that lead to vulnerabilities (e.g., input
validation).
- Code Review: Manual inspection of code to find security flaws.
- Static Analysis: Analyzing code without executing it to find weaknesses.
- Dynamic Analysis: Analyzing running code to detect vulnerabilities.
- Security Testing: Includes fuzzing, penetration testing, vulnerability scanning.
- Patching: Regular updates to fix known vulnerabilities in software.
Vulnerabilities and Protections
Common software vulnerabilities include:
- Buffer Overflows: Writing outside the allocated memory.
- SQL Injection: Inserting malicious SQL in user input fields.
- Cross-site Scripting (XSS): Injecting scripts into web pages viewed by others.
- Insecure File Permissions: Giving excessive access rights to files or folders.
Protections involve:
- Input Validation: Ensure all inputs are safe before processing.
- Principle of Least Privilege: Minimize access rights for users.
- Use of secure functions and libraries.
- Regular security audits and updates.
Network Security
Network security involves protecting data during transmission and ensuring the integrity
of communication. Key elements include:
- Firewalls: Prevent unauthorized access by filtering traffic.
- IDS/IPS: Detect and block suspicious network activities.
- VPNs: Encrypt internet traffic to protect data in transit.
- Secure Protocols: HTTPS, SSL/TLS ensure secure data exchange.
- Network Segmentation: Limits access to sensitive areas of the network.
- Antivirus/Antimalware: Detect and remove malicious software from networked
systems.
Firewalls
Firewalls are network security systems that monitor and control incoming and outgoing
traffic based on security rules. Types include:
1. Packet-Filtering Firewalls: Filter traffic based on IP address, port, and protocol.
2. Stateful Inspection Firewalls: Track active connections and allow packets that
match.
3. Proxy Firewalls: Act as intermediaries between user and service.
4. Next-Generation Firewalls (NGFW): Combine traditional firewall with additional
features like DPI and intrusion prevention.
Intrusion Detection Systems (IDS)
IDS are systems that detect unauthorized access or anomalies in network/system
activity.
- Host-Based IDS (HIDS): Monitors logs and activities on individual devices.
- Network-Based IDS (NIDS): Monitors traffic on entire networks.
Detection Techniques:
- Signature-Based: Matches known attack patterns.
- Anomaly-Based: Flags unusual behavior that deviates from the baseline.
Security Policies (Formation & Enforcement)
Security policies are formal documents that define how an organization manages and
protects its assets.
Steps to develop a policy:
1. Identify assets and stakeholders.
2. Conduct risk assessment.
3. Define acceptable use and behavior.
4. Document rules and responsibilities.
5. Train users on the policies.
6. Enforce using software tools, access control, and regular audits.
Risk Assessment
Risk assessment identifies and evaluates potential threats and vulnerabilities.
Steps include:
- Asset Identification: What needs protection?
- Threat Identification: What could harm the asset?
- Vulnerability Assessment: What weaknesses exist?
- Risk Evaluation: Likelihood and impact analysis.
- Risk Mitigation: Apply controls to reduce risk (technical, administrative, physical).
Cybercrime
Cybercrime involves illegal activities carried out using computers or networks.
Types:
- Financial Fraud (credit card theft, banking fraud)
- Identity Theft
- Unauthorized Access (hacking)
- Cyberbullying, Harassment
- Intellectual Property Theft
Governed by laws like:
- Pakistan’s PECA (Prevention of Electronic Crimes Act)
- International: GDPR, HIPAA, CFAA
Law and Ethics in Information Security
Laws define what is legally acceptable, while ethics define what is morally acceptable.
- Laws: Enforceable by courts (e.g., PECA, GDPR, DMCA).
- Ethics: Personal and professional standards of conduct (e.g., honesty, respect for
privacy).
Codes of Conduct:
- ACM Code of Ethics
- IEEE Code of Ethics
Importance:
- Guides professionals in responsible behavior.
- Prevents misuse of access and power.
Privacy and Anonymity of Data
Privacy ensures that personal information is used responsibly. Anonymity hides the
identity of individuals in data.
Techniques to preserve privacy/anonymity:
- Data Masking: Replacing sensitive data with fake but realistic data.
- Tokenization: Replacing sensitive elements with non-sensitive equivalents.
- Encryption: Making data unreadable without a key.
- Pseudonymization: Replacing identifying data with pseudonyms.
- Differential Privacy: Statistical methods to prevent identification.
