COMPUTER SECURITY
Mohammad Ahsan Junaid
BS CIS Serial 19
1.1 The OSI Security Architecture is a design that gives a purposeful
strategy for describing the necessities for security and depicting the
ways of managing satisfying those necessities. The record portrays
security attacks, parts, and organizations, and the associations
among these arrangements.
1.2 Passive perils have to do with snoopping on, or checking,
transmissions. Electronic mail, record moves, and client/server
exchanges are occasions of transmissions that can be noticed. Dynamic
perils fuse the change of sent data and tries to
secure unapproved induction to PC systems.
1.3 Passive attacks: appearance of message substance and traffic assessment.
Dynamic attacks: mask, replay, modification of messages, and
denial of organization.
1.4 Authentication: The certification that the passing on substance is the
one that it maintains to be.
Access control: The countering of unapproved use of a resource (i.e.,
this help controls who can move toward a resource, under what
conditions access can occur, and what those getting to the resource are
allowed to do).
Data protection: The security of data from unapproved
disclosure.
Data dependability: The insistence that data got are really as sent by
an endorsed substance (i.e., contain no change, consideration, wiping out, or
replay).
Nonrepudiation: Provides protection from repudiation by one of the
components drew in with a correspondence of having taken an interest taking everything together or
part
of the correspondence.
Availability organization: The property of a system or a structure resource
being accessible and usable upon demand by a supported system
substance, as shown by execution judgments for the structure (i.e., a
system is available in case it offers sorts of help as demonstrated by the structure plan
whenever customers request them).
1.6 Authentication: The affirmation that the passing on substance is the
one that it claims to be.
Access control: The evasion of unapproved use of a resource (i.e.,
this assistance controls who can move toward a resource, under what
conditions access can occur, and what those getting to the resource are
allowed to do).
Data protection: The protection of data from unapproved
divulgence.
Data uprightness: The insistence that data got are all things considered as sent by
an endorsed component (i.e., contain no adjustment, consideration, eradication, or
replay).
Nonrepudiation: Provides protection from repudiation by one of the
components drew in with a correspondence of having shared taking everything together or part
of the correspondence.
Openness organization: The property of a system or a structure resource
being accessible and usable upon demand by an endorsed system
substance, as demonstrated by execution subtleties for the system (i.e., a
structure is open if it offers sorts of help as shown by the system plan
whenever customers request them).
1.7 An attack surface involves the reachable and exploitable
shortcomings in a structure. An attack tree is a spreading, moderate
data structure that tends to a lot of expected procedures for
exploiting security shortcomings.
1.1 The system should keep individual distinctive evidence numbers characterized, both
in the host system and during transmission for a trade. It must
secure the reliability of record records and of individual trades.
Availability of the host system is basic to the money related flourishing
of the bank, but not to its trustee commitment. The availability of
individual teller machines is of less concern.
1.2 The system doesn't have high necessities for genuineness on individual
trades, as suffering mischief will not be achieved by inconsistently
losing a call or charging record. The genuineness of control programs and
configuration records, regardless, is fundamental. Without these, the trading
limit would be squashed and the principle characteristic of all -
availability - would be compromised. A telephone trading system must
also save the mystery of individual calls, preventing one visitor
from getting another.
1.3
a. The structure should ensure mystery in the event that it is being used to
convey corporate prohibitive material.
b. The system should ensure uprightness in the event that it is being used to laws or
rules.
c. The structure should ensure availability in the event that it is being used to disperse
a consistently paper.
1.4
a. An affiliation supervising public information on its web server
finds that there is no conceivable impact from an insufficiency of
protection (i.e., order requirements are not proper), a
moderate anticipated impact from an insufficiency of dependability, and a moderate
anticipated impact from an inadequacy of availability.
b. A law execution affiliation administering unquestionably sensitive
logical information checks that the conceivable impact from a
loss of order is high, the logical impact from an inadequacy of
uprightness is moderate, and the possible impact from an inadequacy of
openness is moderate.
c. A financial affiliation managing routine legitimate information
(not security related information) affirms that the logical impact
from a lack of characterization is low, the reasonable impact from an inadequacy of
trustworthiness is low, and the normal impact from a lack of availability is
low.
d. The organization inside the contracting affiliation affirms that:
(I) for the delicate understanding information, the normal impact from a
loss of protection is moderate, the logical impact from an insufficiency of
decency is moderate, and the possible impact from a lack of
availability is low; and (ii) for the routine definitive information
(non-assurance related information), the possible impact from an inadequacy of
mystery is low, the conceivable impact from an insufficiency of decency is
low, and the normal impact from an insufficiency of availability is low.
e. The organization at the power plant confirms that: (I) for the
sensor data being obtained by the SCADA structure, there is no
reasonable impact from an insufficiency of security, a high anticipated impact
from an inadequacy of decency, and a high conceivable impact from a lack of
availability; and (ii) for the administrative information being
taken care of by the system, there is a low anticipated impact from an adversity
of grouping, a low conceivable impact from an insufficiency of reliability, and a
low conceivable impact from an insufficiency of availability. Models from FIPS
199.
1.8
We present the tree in message structure; call the association X:
Survivability Compromise: Disclosure of X restrictive insider realities
On the other hand
1. In reality scavenge discarded things from X
On the other hand
1. Survey dumpster content close by
2. Survey reject after removal from site
2. Screen transmissions from X machines
Moreover,
1. Study real boundary to choose ideal noticing position
2. Obtain significant actually looking at equipment
3. Game plan really looking at site
4. Screen spreads from site
3. Select help of trusted in X insider
Then again
1. Plant spy as trusted in insider
2. Use existing trusted in insider
4. Really access X associations or machines
Of course
1. Get physical, on the spot permission to Intranet
2. Get genuine induction to external machines
5. Attack X intranet using its relationship with Internet
Then again
1. Screen correspondences over Internet for spillage
2. Get trusted in cycle to send sensitive information to attacker over Internet
3. Gain limited induction to Web server
6. Attack X intranet using its relationship with public telephone association (PTN)
Then again
1. Screen correspondences over PTN for spillage of tricky information
