Computer System and Network Security

Gregory B. White, Eric A. Fisch, Udo W. Pooch, Udo W. Pooch

• Editorial: CRC Press
• Año: 2017
• ISBN:
  9781351458719
• Edición: 1
• Categoría: Computer Science
• Categoría: Cyber Security

Computer System and Network Security provides the reader with a basic understanding of the issues involved in the security of computer systems and networks. Introductory in nature, this important new book covers all aspects related to the growing field of computer security. Such complete coverage in a single text has previously been unavailable, and college professors and students, as well as professionals responsible for system security, will find this unique book a valuable source of information, either as a textbook or as a general reference.
Computer System and Network Security discusses existing and potential threats to computer systems and networks and outlines the basic actions that are generally taken to protect them. The first two chapters of the text introduce the reader to the field of computer security, covering fundamental issues and objectives. The next several chapters describe security models, authentication issues, access control, intrusion detection, and damage control. Later chapters address network and database security and systems/networks connected to wide-area networks and internetworks. Other topics include firewalls, cryptography, malicious software, and security standards. The book includes case studies with information about incidents involving computer security, illustrating the problems and potential damage that can be caused when security fails.
This unique reference/textbook covers all aspects of computer and network security, filling an obvious gap in the existing literature.

1

Fundamentals of Computer Security

“Undetected Theft of Credit-Card Data Raises Concern About On-Line Security” The Wall Street Journal. Friday, February 17, 1995.

“Computer Experts See Hackers Gaining An Upper Hand in Fight Over Security” The Wall Street Journal. Tuesday, January 24, 1995.

“Internet Web Found to Have Security Lapse” The Wall Street Journal, Tuesday, February 21, 1995.

Computers have become commonplace in today’s society. They are used in banking for everyday actions such as Electronic Funds Transfer (EFT) and Automated Teller Machine (ATM) transactions. They are used to store a wide range of information about us such as medical, credit, and financial data. They are used to help fly the commercial aircrafts we travel in and to operate the cars we drive. They store trade secrets for corporations and military and diplomatic secrets for governments. They are used to help control our telephone communication networks and to process our paychecks. It can be truly said that everyone’s life has somehow been touched by a computer.

With this tremendous amount of interaction comes a comparable level of responsibility for those who control these computers. It is of the utmost importance that the records computers contain paint an accurate picture of who we are. We have probably all heard stories about individuals who have had their credit rating inadvertently affected by a mistake in one of these systems. Mistakes of this kind can affect our ability to buy a home or car, or can even lead to legal actions against us until the mistake has been corrected. Even more important than the computers that control our financial well-being are those that are used in critical applications that can affect our physical well-being. The modern hospital is filled with advanced medical equipment run by or with the aid of computers. Should one of these machines malfunction, it could result in a loss of life.

The unintentional error in a program or entry in a database are not the only problems that we must worry about; we must also be concerned with the intentional misuse of these computer systems. Dishonest employees may try to modify account information in order to funnel funds or goods to themselves. Companies may attempt to access marketing plans and trade secrets of rivals in order to gain a sales advantage. Individuals who feel they have been treated unfairly or have been offended in some way may attempt to seek revenge by attacking another person’s financial or credit records. It is these and similar problems that Computer System and Network Security is concerned with.

1.1 Objectives of Computer Security

When computers were first developed, computer security was simply a matter of providing the physical protection mechanisms to limit access to all but a few authorized individuals. With today’s worldwide networks, however, computer security involves much more. Despite its expanded nature and increased importance, computer security today has the same basic objectives as forty years ago. The three fundamental objectives of computer security are:

• Confidentiality
• Integrity
• Availability

Confidentiality requires that the data in a computer system, as well as the data transmitted between computer systems, be revealed only to authorized individuals. This may not only include protection from unauthorized disclosure of the actual data, but the fact that certain data even exists. The fact that an individual has a criminal record, for example, is often just as important as the details of the crime committed.

Integrity stipulates that the data in a computer system, as well as the data transmitted between computer systems, be free from unauthorized modification or deletion. It also includes the unauthorized creation of data. The unauthorized insertion of false credit records, for example, could jeopardize an individuars ability to obtain credit. It is important that records such as these are only created, modified, or deleted by authorized individuals and that this occurs in a prescribed manner.

The objective of availability requires that the authorized users of the computer systems and communications media not be denied access when access is desired. This objective is also associated with the concept of denial of service which is manifested by a reduction in system performance. This does not include normal degradation of the system performance during peak operating periods but rather specific acts taken by attackers to influence the ability of authorized users to access the system.

Most research in computer security has been in the area of confidentiality. The historical reason for this is that the majority of funding for computer security has been supplied by the federal government whose chief concern has always been maintaining the secrecy of its classified documents. The problems caused by the destruction or modification of data have always taken a back seat to the one of disclosure. Fortunately for proponents of integrity issues, the safeguards and techniques used to implement confidentiality are closely related to that of integrity. If a person can’t see the data, it will generally also be hard to destroy or modify.

In addition to the three fundamental objectives already mentioned, several other secondary objectives are frequently listed including authorized use, message authentication, and nonrepudiation. Authorized use simply means that only authorized individuals may use the computer system or its peripherals and then only in a prescribed manner. Message authentication and nonrepudiation are both associated with the widespread use of computer networks. Often when a message is received we want to be sure that the individual who the system claims sent the message did indeed transmit it. This is message authentication. At other times we want to know that an individual did receive a message that was transmitted. This is nonrepudiation. Taken together, all of these objectives serve to provide the needed foundation for computer and network security.

1.2 Issues Involved in Computer Security

The objectives of computer security seem simple enough yet a foolproof implementation still eludes us. The reason for this is that, fundamentally, securing a computer system is a complex task. There are several factors which make securing a computer system or network hard. These include:

• Secure operating systems involve a tremendous amount of software and large software projects have historically proven to be nearly impossible to implement error-free.
• Security is often not included in the originally designed or implemented system but is added later in the project.
• Security costs and often “gets in the way”.
• Very often the problem lies with the people who use the system and not in the technology.

The first issue is a common one in computer science. Anyone who has ever written software knows how hard it is to create a program that is error-free. The larger the program the more this is true. For a “normal” program, the existence of a few bugs can generally be tolerated as the users simply learn to live with the problem or to somehow work around them. In security, however, the existence of a single error can result in a hole through which intruders can gain access to the system. This is clearly not acceptable. For security then, the existence of a single error is often fatal. In addition, an intruder does not have to find all holes that exist in an operating system in order to break in, only one hole is required. The programmer responsible for the operating system, however, needs to worry about all holes in order to plug them.

The second issue is a financial one. Most projects in the government and industry operate under very tight budgetary constraints. When the purchase or development of a computer system is contemplated, the chief concern will be whether the system will be able to accomplish the task it was intended to perform. Secondary concerns generally are centered around issues such as how much will the system cost and how fast will it accomplish the required task. Seldom is security considered, in fact, security is often not considered until later when the occurrence of a security incident forces the issue. Attempting to retrofit security is an expensive process, both in terms of money and labor.

Another issue in implementing security is that it is often viewed as “getting in the way” of the user. For example, many computer operating systems provide the capability to record the actions of all users on the system. The resulting audit trail may occupy a tremendous amount of disk space and recording the actions, especially if any analysis of the data is performed, takes valuable CPU time away from other processes. This security feature is thus often viewed as an expensive overhead that can be done without. Another example of a security feature that is often viewed by users as bothersome is passwords. Passwords are used to control access to the computer system and its data. They are analogous in many respects to a combination for a safe and just like the combination, they are often hard to remember. Often users are allowed to select their own password to use. This leads to an interesting dilemma. If a user picks a password that is easy to remember, then it is probably also easy for an intruder to guess. This defeats the purpose of the password in the first place. If, on the other hand, a totally random sequence of characters is chosen for the password, then it is hard to guess but also hard for the authorized user to remember. If we make it easy for the authorized users, then we make it easier for the intruders. If we make it hard for the intruders, then we also make it hard for the authorized users. Thus security, in terms of passwords, is often viewed as either worthless or cumbersome.

One final issue that must be considered in any discussion on computer security is that often the problem is not technology, but people. The majority of computer crimes committed by “insiders” (i.e., authorized users) do not involve any violation of the system’s security rules. Instead they involve an abuse of the individual’s authority which has been granted to them in order that they may perform their assigned job. This can be illustrated by examining what occurred in one office of an agency of the Federal Government. An employee discovered that the computer system she worked with would allow an individual who had been receiving benefits to be “resurrected” should the individual inadvertently be listed as deceased (through some clerical error). This individual could then be issued a special check to retroactively provide for the benefits that should have been received while the individual was listed as deceased. The employee decided to take advantage of this system and collected a series of names of people who had been dead for at least five years. She then used the resurrection feature to generate a check for each, which she had sent to her own post office box. After the check was issued, she changed the individual’s records back to show them as deceased [1]. This was not a case of an unauthorized intruder gaining access to a system to perpetrate a crime but rather an authorized individual abusing her authorized permissions. To prevent this sort of crime involves a different approach to computer security than does protecting a computer system or network from an unauthorized individual attempting to gain access.

1.3 Privacy and Ethics

An issue related to computer security provides an interesting paradox involving the joint concerns of privacy and ethics. One of the reasons we are so concerned with the security of computer systems is to maintain the privacy of the individuals whose records the computers maintain. This is a reasonable desire which few, if any, would argue with. If we lived in a society where everyone acted in an ethical manner we would not have a problem. Unfortunately, we live in a society where the actions of a few require certain precautions. This is really no different than the fact that we must lock our homes because a small percentage in our society would take advantage of a more trusting environment. The paradox in computer security occurs when we try to enforce what individual ethics have failed to do. To illustrate this point, consider a common technique used by administrators. One way suggested to ensure the confidentiality and integrity of individual records is to monitor the actions of those who have access to the system. The extent of this monitoring for security purposes has sometimes extended so far as to include the reading of an individual’s electronic mail to ensure that no unauthorized activity is occurring. The action of looking through an individual’s U.S. Postal Service mail is strictly regulated by law and can only be done under very specific circumstances. Many, however, see no problem with the monitoring of an individual’s electronic mail. We must be sure that we are not enforcing the privacy of the records maintained on the system at the cost of the privacy of the users. It should be noted that this is a drastic simplification of a very complex issue. Nevertheless, as we consider the various techniques discussed in this text, we should also consider our actions and how, in the name of security, these actions affect the rights and privacy of all individuals involved.

1.4 Exercises

1.1 Try to create a list of jobs in today’s society that do not somehow involve the use of a computer. Don’t forget modern telephone switching is controlled by computers or the more mundane but commonplace applications such as word processors which have all but eliminated the use of typewriters in today’s business world.

1.2 What are the privacy implications of local merchants maintaining a database of customers and their purchases? What if the business is a grocery store that sells alcoholic beverages or a bookstore that sells pornographic magazines? What if the business rents video tapes? Does it matter if this type of information about an individual becomes public knowledge?

1.3 Many of the individuals who break into computer systems never cause any damage but claim to do it only because of the intellectual challenge involved. In addition, a number claim that they actually are helping computer and network security professionals by revealing holes or weaknesses in security packages. Comment on these assertions.

1.4 Computer networks have been used for a variety of illegal activities including the transmission of child pornography. Individuals who send and receive these files often encrypt (disguise) them so it isn’t obvious what they contain. Some law enforcement agencies want to restrict the use of encryption schemes so that they can uncover these (and other) criminal activities and to be able to obtain the evidence necessary to convict the individuals involved. is this a valid request by our law enforcement agencies or is this an infringement on our right to privacy? How is it helpful to consider the rules that govern U.S. Postal Service mail when considering this problem? What about laws governing wiretaps and electronic surveillance?

1.5 References

1.1 Martin, L, “Unethical ‘Comput...