Information Privacy and
Security
Lecture 01,02,03
Introduction
Areesha Sajjad
NCBA&E FLC
Security???
What is security
• Security revolves around CIA
Confidentiality
• Preventing the unauthorized disclosure of sensitive information.
• disclosure could be
• Intentional (Breaking)
• Unintentional (Carelessness)
• Confidentiality VS Privacy
• Privacy:
• Degree to which entity will interact with its environment.
• Privacy is a reason for confidentiality
Integrity
• Goals of integrity (e.g. email)
• Prevention of the modification of information by unauthorized users.
• Prevention of the unauthorized or unintentional modification of information
by authorized users
Availability
• a system’s authorized users have timely and uninterrupted access
• DoS/DDoS
What is Privacy
• Right to Access
• Privileges defined by the owner on the resource.
• Legislations (HIPPA/US Laws/EU laws)
Other Terms
• Vulnerability: An error or weakness in the design, implementation,
or operation of a system
• Attack: A mean of exploiting some vulnerability in a system.
• Threat: An adversary that is motivated and capable of exploiting a
vulnerability.
Attacks, Services and Mechanisms
• Security Attack: Any action that compromises the security of
information.
• Security Mechanism: A mechanism that is designed to detect, prevent,
or recover from a security attack.
• Security Service: A service that enhances the security of data processing
systems and information transfers. A security service makes use of one
or more security mechanisms. E.g., virus detection, firewall, etc.
Security Attacks
• Active attacks ( affects integrity & availability)
• Modifies data
• Passive attacks (Affects confidentiality)
• Don’t harm data
Active Attacks
• Masquerade
• Pretending to be a different entity
Active Attacks
• Replay Attacks (to trick the system into accepting the re transmission
of the data as legitimate one)
Active Attacks
• Denial of service (A denial-of-service (DoS) attack occurs when
legitimate users are unable to access information systems, devices,
or other network resources due to the actions of a malicious cyber
threat actor.)
• Easy to detect
• Hard to prevent
Passive Attacks
• Eavesdropping on transmissions to obtain information
• Release of message contents
• Outsider learns content of transmission
• Traffic analysis
• By monitoring frequency and length of messages, even encrypted, nature of
communication may be guessed (ID, location, session, file transfer)
• Difficult to detect
• Can be prevented
Attackers
• 1. Hacker: The one who is only interested in penetrating into your
system. They do not cause any harm to your system they only get
satisfied by getting access to your system.
• 2. Intruders: These attackers intend to do damage to your system or
try to obtain the information from the system which can be used to
attain financial gain.
• The attacker can place a logical program on your system through the
network which can affect the software on your system. This leads to
two kinds of risks:
• a. Information threat: This kind of threats modifies data on the
user’s behalf to which actually user should not access. Like enabling
some crucial permission in the system.
• b. Service threat: This kind of threat disables the user from
accessing data on the system.
Security Attacks (active and passive, affects CIA)
Security Attacks
• Interruption: This is an attack on availability
• Interception: This is an attack on confidentiality
• Modification: This is an attack on integrity
• Fabrication: This is an attack on authenticity
Security Services
• Confidentiality (privacy)
• Authentication (who created or sent the data)
• Integrity (has not been altered)
• Non-repudiation (cannot deny authenticity of message i.e. signature)
• Access control (prevent misuse of resources)
• Availability
• Denial of Service Attacks
• Virus that deletes files
Methods of Defence
• Encryption
• Software Controls (access limitations in a database, in operating
system protect each user from other users)
• Hardware Controls (smartcard)
• Policies (frequent changes of passwords)
• Physical Controls
Internet RFC Publication Process
Recommended Reading
• Pfleeger, C. Security in Computing. Prentice Hall, 1997.
• Mel, H.X. Baker, D. Cryptography Decrypted. Addison
Wesley, 2001.
