About the Presentations

The presentations cover the objectives found in the opening of each chapter. All chapter objectives are listed in the beginning of each presentation. You may customize the presentations to fit your class needs. Some figures from the chapters are included. A complete set of images from the book can be found on the Instructor Resources disc.

Security+ Guide to Network Security Fundamentals, Fourth Edition

Chapter 1 Introduction to Security

Objectives
Describe the challenges of securing information Define information security and explain why it is important Identify the types of attackers that are common today List the basic steps of an attack Describe the five basic principles of defense

Security+ Guide to Network Security Fundamentals, Fourth Edition

Challenges of Securing Information

Security figures prominently in 21st century world
Personal security Information security

Securing information
No simple solution Many different types of attacks Defending against attacks often difficult

Security+ Guide to Network Security Fundamentals, Fourth Edition

Todays Security Attacks

Advances in computing power
Make password-breaking easy

Software vulnerabilities often not patched

Smartphones a new target

Security+ Guide to Network Security Fundamentals, Fourth Edition

Todays Security Attacks (contd.)

Examples of recent attacks
Bogus antivirus software
Marketed by credit card thieves

Online banking attacks Hacking contest Nigerian 419 advanced fee fraud
Number one type of Internet fraud

Identity theft using Firesheep Malware Infected USB flash drive devices
Security+ Guide to Network Security Fundamentals, Fourth Edition 6

Table 1-1 Selected security breaches involving personal information in a one-month period
Security+ Guide to Network Security Fundamentals, Fourth Edition 7

Difficulties in Defending Against Attacks

Universally connected devices Increased speed of attacks Greater sophistication of attacks Availability and simplicity of attack tools Faster detection of vulnerabilities

Security+ Guide to Network Security Fundamentals, Fourth Edition

Difficulties in Defending Against Attacks (contd.)

Delays in patching
Weak distribution of patches

Distributed attacks User confusion

Security+ Guide to Network Security Fundamentals, Fourth Edition

Table 1-2 Difficulties in defending against attacks

Security+ Guide to Network Security Fundamentals, Fourth Edition

10

What Is Information Security?

Before defense is possible, one must understand:
What information security is Why it is important Who the attackers are

Security+ Guide to Network Security Fundamentals, Fourth Edition

11

Defining Information Security

Security
Steps to protect person or property from harm
Harm may be intentional or nonintentional

Sacrifices convenience for safety

Information security
Guarding digitally-formatted information:
That provides value to people and organizations

Security+ Guide to Network Security Fundamentals, Fourth Edition

12

Defining Information Security (contd.)

Three types of information protection: often called CIA
Confidentiality
Only approved individuals may access information

Integrity
Information is correct and unaltered

Availability
Information is accessible to authorized users

Security+ Guide to Network Security Fundamentals, Fourth Edition

13

Defining Information Security (contd.)

Protections implemented to secure information
Identification
Proof of who you are

Authentication
Individual is who they claim to be

Authorization
Grant ability to access information

Accounting
Provides tracking of events

Security+ Guide to Network Security Fundamentals, Fourth Edition

14

Figure 1-3 Information security components

Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition

15

Defining Information Security (contd.)

Table 1-3 Information security layers

Security+ Guide to Network Security Fundamentals, Fourth Edition

16

Information Security Terminology

Asset
Item of value

Threat
Actions or events that have potential to cause harm

Threat agent
Person or element with power to carry out a threat

Security+ Guide to Network Security Fundamentals, Fourth Edition

17

Table 1-4 Information technology assets

Security+ Guide to Network Security Fundamentals, Fourth Edition 18

Information Security Terminology (contd.)

Vulnerability
Flaw or weakness
Threat agent can bypass security

Risk
Likelihood that threat agent will exploit vulnerability Cannot be eliminated entirely
Cost would be too high Take too long to implement

Some degree of risk must be assumed

Security+ Guide to Network Security Fundamentals, Fourth Edition

19

Figure 1-4 Information security components analogy

Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition

20

Information Security Terminology (contd.)

Options to deal with risk
Accept
Realize there is a chance of loss

Diminish
Take precautions Most information security risks should be diminished

Transfer risk to someone else

Example: purchasing insurance

Security+ Guide to Network Security Fundamentals, Fourth Edition

21

Understanding the Importance of Information Security

Preventing data theft
Security often associated with theft prevention Business data theft
Proprietary information

Individual data theft

Credit card numbers

Security+ Guide to Network Security Fundamentals, Fourth Edition

22

Understanding the Importance of Information Security (contd.)

Thwarting identity theft
Using anothers personal information in unauthorized manner
Usually for financial gain

Example:
Steal persons SSN Create new credit card account Charge purchases Leave unpaid

Security+ Guide to Network Security Fundamentals, Fourth Edition

23

Understanding the Importance of Information Security (contd.)

Avoiding legal consequences
Laws protecting electronic data privacy
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) The Sarbanes-Oxley Act of 2002 (Sarbox) The Gramm-Leach-Bliley Act (GLBA) Californias Database Security Breach Notification Act (2003)

Security+ Guide to Network Security Fundamentals, Fourth Edition

24

Understanding the Importance of Information Security (contd.)

Maintaining productivity
Post-attack clean up diverts resources
Time and money

Table 1-6 Cost of attacks

Security+ Guide to Network Security Fundamentals, Fourth Edition 25

Understanding the Importance of Information Security (contd.)

Foiling cyberterrorism
Premeditated, politically motivated attacks Target: information, computer systems, data Designed to:
Cause panic Provoke violence Result in financial catastrophe

Security+ Guide to Network Security Fundamentals, Fourth Edition

26

Understanding the Importance of Information Security (contd.)

Potential cyberterrorism targets
Banking Military Energy (power plants) Transportation (air traffic control centers) Water systems

Security+ Guide to Network Security Fundamentals, Fourth Edition

27

Who Are the Attackers?

Categories of attackers
Hackers Script kiddies Spies Insiders Cybercriminals Cyberterrorists

Security+ Guide to Network Security Fundamentals, Fourth Edition

28

Hackers
Hacker
Person who uses computer skills to attack computers Term not common in security community

White hat hackers

Goal to expose security flaws Not to steal or corrupt data

Black hat hackers

Goal is malicious and destructive

Security+ Guide to Network Security Fundamentals, Fourth Edition

29

Script Kiddies
Script kiddies
Goal: break into computers to create damage Unskilled users Download automated hacking software (scripts)
Use them to perform malicious acts

Attack software today has menu systems

Attacks are even easier for unskilled users

40 percent of attacks performed by script kiddies

Security+ Guide to Network Security Fundamentals, Fourth Edition

30

Spies
Computer spy
Person hired to break into a computer:
To steal information

Hired to attack a specific computer or system:

Containing sensitive information

Goal: steal information without drawing attention to their actions Possess excellent computer skills:
To attack and cover their tracks
Security+ Guide to Network Security Fundamentals, Fourth Edition 31

Insiders
Employees, contractors, and business partners 48 percent of breaches attributed to insiders Examples of insider attacks
Health care worker publicized celebrities health records
Disgruntled over upcoming job termination

Government employee planted malicious coding script Stock trader concealed losses through fake transactions U.S. Army private accessed sensitive documents
Security+ Guide to Network Security Fundamentals, Fourth Edition 32

Cybercriminals
Network of attackers, identity thieves, spammers, financial fraudsters Difference from ordinary attackers
More highly motivated Willing to take more risk Better funded More tenacious Goal: financial gain

Security+ Guide to Network Security Fundamentals, Fourth Edition

33

Cybercriminals (contd.)
Organized gangs of young attackers
Eastern European, Asian, and third-world regions

Table 1-7 Characteristics of cybercriminals

Security+ Guide to Network Security Fundamentals, Fourth Edition 34

Cybercriminals (contd.)
Cybercrime
Targeted attacks against financial networks Unauthorized access to information Theft of personal information

Financial cybercrime
Trafficking in stolen credit cards and financial information Using spam to commit fraud

Security+ Guide to Network Security Fundamentals, Fourth Edition

35

Cyberterrorists
Cyberterrorists
Ideological motivation
Attacking because of their principles and beliefs

Goals of a cyberattack:
Deface electronic information
Spread misinformation and propaganda

Deny service to legitimate computer users Commit unauthorized intrusions

Results: critical infrastructure outages; corruption of vital data
Security+ Guide to Network Security Fundamentals, Fourth Edition 36

Attacks and Defenses

Wide variety of attacks
Same basic steps used in attack

To protect computers against attacks:

Follow five fundamental security principles

Security+ Guide to Network Security Fundamentals, Fourth Edition

37

Steps of an Attack
Probe for information
Such as type of hardware or software used

Penetrate any defenses

Launch the attack

Modify security settings

Allows attacker to reenter compromised system easily

Circulate to other systems

Same tools directed toward other systems

Paralyze networks and devices

Security+ Guide to Network Security Fundamentals, Fourth Edition 38

Figure 1-6 Steps of an attack

Cengage Learning 2012

Security+ Guide to Network Security Fundamentals, Fourth Edition

39

Defenses Against Attacks

Fundamental security principles for defenses
Layering Limiting Diversity Obscurity Simplicity

Security+ Guide to Network Security Fundamentals, Fourth Edition

40

Layering
Information security must be created in layers
Single defense mechanism may be easy to circumvent Unlikely that attacker can break through all defense layers

Layered security approach

Can be useful in resisting a variety of attacks Provides the most comprehensive protection

Security+ Guide to Network Security Fundamentals, Fourth Edition

41

Limiting
Limiting access to information:
Reduces the threat against it

Only those who must use data granted access

Amount of access limited to what that person needs to know

Methods of limiting access

Technology
File permissions

Procedural
Prohibiting document removal from premises
Security+ Guide to Network Security Fundamentals, Fourth Edition 42

Diversity
Closely related to layering
Layers must be different (diverse)

If attackers penetrate one layer:

Same techniques unsuccessful in breaking through other layers

Breaching one security layer does not compromise the whole system Example of diversity
Using security products from different manufacturers

Security+ Guide to Network Security Fundamentals, Fourth Edition

43

Obscurity
Obscuring inside details to outsiders Example: not revealing details
Type of computer Operating system version Brand of software used

Difficult for attacker to devise attack if system details are unknown

Security+ Guide to Network Security Fundamentals, Fourth Edition

44

Simplicity
Nature of information security is complex Complex security systems
Difficult to understand and troubleshoot Often compromised for ease of use by trusted users

Secure system should be simple:

For insiders to understand and use

Simple from the inside

Complex from the outside

Security+ Guide to Network Security Fundamentals, Fourth Edition

45

Summary
Information security attacks growing exponentially in recent years Several reasons for difficulty defending against todays attacks Information security protects informations integrity, confidentiality, and availability:
On devices that store, manipulate, and transmit information Using products, people, and procedures

Security+ Guide to Network Security Fundamentals, Fourth Edition

46

Summary (contd.)
Goals of information security
Prevent data theft Thwart identity theft Avoid legal consequences of not securing information Maintain productivity Foil cyberterrorism

Different types of people with different motivations conduct computer attacks An attack has five general steps
Security+ Guide to Network Security Fundamentals, Fourth Edition 47