Recent Post

Protection and Security

Protection refers to the actual mechanism implemented to enforce the specified policy.
Security refers to the policy of authorising accesses.Security aims to prevent intentional misuses of a system,while protection aims to prevent either accidental or intentional misuses.

A secure system tries to accomplish three goals:-
  (i) Data confidentiality: secret data remains secret.
  (ii) Data integrity: unauthorized users should not be able to modify any data without the owner's permission.
  (iii) System availability: nobody can disturb the system to make it.

There are three components of security:
  (i) Authentication determines who the user is.
  (ii) Authorization determines who is allowed to do what.
  (iii) Enforcement makes sure that people do only what they are supposed to do.

SECURITY ATTACKS

Eavesdropping

 Eavesdropping is the listener approach.
One can tap into the serial line on the Ethernet, and see everything typed in; almost everything goes over network unencrypted.

Abuse of Privilege

If the superuser is evil,there is nothing you can do.


Imposter

An imposter breaks into the system by pretending to be someone else.
A countermeasure against the imposter attack is to use behavioral monitoring to look for suspicious activates.

Trojan Horse

A Trojan horse is a seemingly innocent program that contains code that will perform an unexpected and undesirable function.
A countermeasure against the Trojan horse is integrity checking.

Salami Attack 

The idea is to build up a chunk one-bit at a time.
A countermeasure is for companies to have code reviews as a standard practice.

Logic Bombs

A programmer may secretly insert a piece of code into the production system.
A countermeasure is to have code reviews.

Denial-of-service Attack

Denial-of-service attack refer to attacks on system availability.
A handful of compromised machines can flood a victim machine with network packets to disrupt its normal use.

No comments