Cyber security

Unit I

Introduction- Introduction to Information Systems, Types of Information Systems, Development of Information Systems, Introduction to Information Security and CIA triad, Need for Information Security, Threats to Information Systems, Information Assurance and Security Risk Analysis,Cyber Security.

Unit II Application Security- (Database, E-mail and Internet),Data Security Considerations-(Backups, Archival Storage and Disposal of Data), Security Technology-(Firewall , VPNs, Intrusion Detection System),Access Control.

Security Threats -Viruses, Worms, Trojan Horse, Bombs, Trapdoors, Spoofs,E-mail Viruses, Macro Viruses, Malicious Software, Network and Denial of Services Attack.

Unit III Introduction to E-Commerce , Threats to E-Commerce, Electronic Payment System, e- Cash, Credit/Debit Cards. Digital Signature, Cryptography Developing Secure Information Systems, Application Development Security,

Information Security Governance & Risk Management, Security Architecture & Design Security Issues in Hardware, Data Storage & Downloadable Devices, Physical Security of IT Assets - Access Control, CCTV, BackupSecurity Measures.

**************************************************

Unit I

Introduction- Introduction to Information Systems, Types of Information

Systems, Development of Information Systems, Introduction to Information

Security and CIA triad, Need for Information Security, Threats to

Information Systems, Information Assurance and Security Risk Analysis,

Cyber Security.

*********************************************************

INTRODUCTION TO INFORMATION SYSTEMS

Meaning of Information System

To understand information system in a better way, let us first try to understand what information and system are Information refers to the knowledge or facts about any particular subject, person or thing System refers to a set of interrelated and interdependent components, entities or methodologies which accomplish a particular purpose. And now we can define information system as follows "Information System is an integrated structure that compiles the services of software, human resources and physical components of technology to gather, store, process and retrieve the information whenever required, in a useful form. This information is used by an individual or an organization for planning, decision-making and various purposes for the smooth running of the organization"

The various aspects of information systems include gathering, handling, processing, storing encrypting, releasing and disposing the data, and the methodologies that govern the transmission. Information system (S) has become the need of the hour. As the technology enhanced, population grew and more people became part of the modern technologies, it became difficult to manage the information and records of such diversified human activities in any company, government department, institution or hospital. However, a well maintained record of people and operations are needed for

Efficient working and smooth running of any organization. Thus, the requirement for IS which

consisted of hardware and software to combat such issues, became inevitable.

____________

TYPES OF INFORMATION SYSTEMS

The development of information systems was done with a sole objective of simplifying complex data management and meeting. Different purposes of an organization. There can be numerous needs in an enterprise and hence there can be various categories of information systems. Each information system has a role to play.

We have taken a pyramidal model as shown in figure 1.2. Information System can be classified into following six categories:

1. Transaction Processing System 2. Office Information System

3. Management Information System 4. Decision Support System

5. Expert System

6. Executive Support System.

1. Transaction Processing System

Transaction processing systems abbreviated as TPS were developed to collect and process larm amounts of data for day to day business transactions (deposit, payment, order etc.). TPS access records and maintains data by adding new data, changing existing data, or removing unwanted data.

_______

Some of it’s characterizes features are listed below

Reduces the tedious task of necessary operational transactions by computerizing the ruang manual system This brought fader processing of data in the organization, better service to customers, more efficient work etc.

TPS was one of the first computerized systems developed for handling and processing business data reduces the time once required to perform the processing manually However, manual work is still needed to feed the data. • Decision-making in an organization becomes more efficient, because TPS makes available up-to-the-minute data to the decision making.

Examples Payroll and inventory As the technologies have advanced online transaction processing systems (OTPS) have become the latest concept in TPS

2. Office Information System

An office information system (OIS) is the type of information system that enhances the performance of office work try improving work flow and the communication among the employees OS collects and distributes necessary information to those who needs it in the office by making use of hardware, software and networking Some of its characteristic features are listed below 015 is also described as Office Automation System.

The functions of this system are word processing, e-mails, creating and distributing graphics documents, work group programming facsimile processing e-document, imaging and management of work flow, sending messages, scheduling and accounting. • Various software can be used, such as word processing presentation graphics, spreadsheets,

databases, email, web browser, personal information management etc Electronic means of communication are used to establish quicker interconnection such as e-mail, video-conferencing, facsimile dax, and text, graphics, audio, and video transfer using electronic means

OIS associates various hardware such as computers, laptops, modems, routers, video cameras,

speakers, printers, microphones, scanners, and lax machines

All level of employees enjoys the comforts of OtS

For example, in a manually operated office, a document was sent to an employee on a paper, which required it to be generated on a paper and then camned by an office worker But in Ots, most of the documents can be e-mailed. Thus, eliminating the use of paper and

need of the worker, saving time, ensuring delivery and maintaining confidentiality

3. Management Information System

Management Information Systems (MIS) are management level systems in which managers evaluate the performance of an organization by analyzing data provided by lower levels. They take actions for smooth running of the organization Some of its characteristic features are listed below

• Management information systems (MIS) do not replace transaction processing systems, it rather integrates transaction processing.

________

MIS help in accomplishing a broader spectrum of organizational tasks than transacm processing systems, including planning controlling, decision analysis and decision-mak in the organization. • The system provides accurate, timely and meaningfully organized information which enaba

managers to make decisions, solve problems, monitor, direct, provide feedback, superv

activities, track progress, and take strategic, operational and tactical decisions. for example, a TPS keeps a record of the sale of a product, credit, debit, the raw mater used etc. This data is used by the managers to decide future policies and purchase t required raw material.

4. Decision Support System

Decision support systems (DSS) are higher-level class of computerized information systems. The main focus of this information system is for the effectiveness of the manager in analyzing the information and making a decision, when a decision-making situation anses. Some of its characteristi features are listed below

• DSS uses interactive information system, databases and analytical tools to allow managers

to project the potential effects of their decisions into the future Simulation model is used that calculates the simulated outcome of tentative decisions and assumptions • It uses optimization models which determine optimal decisions based on criteria supplied by the user, mathematical search techniques, and constraints.

It is used for handling decisions in unstructured situations, Le, decisions which are made

during an emergency

A decision support system uses data from internal (such as organization's database) and/or

external sources (such as interest rates, population trends, and costs of raw material). This system uses a database management system, query language, data manipulation tools, financial modeling, simulation models, electronic spreadsheet, online analytical processing data mining, statistical analysis program, report generator or graphic software for supplying the information needed.

5. Expert Systems

Expert systems are a very special class of information system that realizes the high value of expertise owned by the experts An expert system collects stores and utilizes the knowledge of a human expertise to solve a particular problem experienced in an organization. Some of its characteristic features are listed below:

• Expert systems imitate human reasoning and decision-making processes.

Expert system has two components a knowledge base and user-inference Whenever a user. describes a situation to the expert system, the user-interface makes use of logical judgments, reasoning and expertise from the knowledge-base, and comes up with a solution. • Knowledge engineers collect the expertise and knowledge of experts and implement it on

a computer system. It is also called knowledge based system. • Artificial intelligence that develops machines that behave intelligently has emerged as an overwhelming application of expert systems. It imparts human intelligence to machines by sensing our actions, based on experience and logical assumptions and takes the required action. It has divene capabilities including voice recognition and creative responses It differs from DSS In DSS, eventually the decision-making resh on a few people's judgments

Expert system selects the best solution to a problem or a specific class of problems based

on a knowledge-base

6. Executive Support Systems

A strategic level of information system, called an executive support system (ESS) that lies on top of the pyramidal model. It helps executives and senior managers analyze the environment in which the organization operates, to identify long-term trends. Some of its characteristic features are listed below

• It focuses on fulfilling the strategic information needs of the top management to plan appropriate strategy for the organization Information in an EIS is presented in charts and tables that show trends, ratios, and other managerial statistics.

EISS explore internal data sources (such as data from MIS or TPS) as well as external data sources such as the share markets news, retrieval service or the Intemet. These extemal data sources can provide current information on interest rates, commodity prices, and other leading economic indicators.

ESS supports and extends the inherent capabilities of senior executives, by creating an environment that helps them think about strategic problems in an informed way and permitting them to make sense of their environments. • To store all the necessary decision-making data, EISs often use extremely large databases to analyze historical and current business circumstances.

With today's sophisticated hardware, software and communications technologies, it often is

difficult to classify a system as belonging uniquely to one of the types discussed. Now-a-days, an integrated information system is often used that combines the features of more than one type of Information System

Development of Information Systems

information System Development Stages

An information system development consists of six important stages; it is system survey, needs analysis, design, implementation, testing, change and maintenance.

1) System Survey

The SLDC phase also consists of three main points: system identification, selection, and system planning.

1) System Identification

This process is to identify the problems facing the company and the system it has. The team will look for any opportunities that can be done to overcome this.

2) Selection

The selection phase will apply evaluation points to the development project to ensure the solutions are created in accordance with the company’s expected targets.

3) System Planning

This step is the step of developing a formal plan to start working on and implementing the information system development concept that has been chosen.

2) Needs Analysis

System requirements analysis is a technique for solving problems by decomposing the components of the system. The aim is none other than to find out more about how each component works and the interaction between one component with other components.

Some aspects that need to be targeted in the needs analysis in the development of information systems include business users, job analysis, business processes, agreed rules, problems and solutions, business tools, and business plans.

3) Design

The design or design of system development is intended to provide a complete blueprint as a guideline for the IT team (especially programmers) in making applications. Thus the IT team no longer makes decisions or works in a sporadic way.

4) Implementation

The stage of developing this information system is to work on a previously designed development.

5) Testing

A system needs to be tested to ensure that the development carried out is appropriate or not with the expected results. Tests that are applied are various, such as performance, input efficiency, syntax (program logic), output, and so on.

This information system development stage requires preparation of various supporting aspects. In addition to applications, hardware readiness and several other related facilities also need to be prepared. As for implementation, several activities carried out include data migration (conversion), training for users, and trials.

6) Change and Maintenance

This step covers the whole process in order to ensure the continuity, smoothness and improvement of the system. In addition to monitoring the system at a certain time, maintenance also includes activities to anticipate minor bugs (bugs), system improvements, and anticipation of some risks from factors outside the system.

What is Information Security?

Information Security is not only about securing information from unauthorized access. Information Security is basically the practice of preventing unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction of information. Information can be physical or electronic one. Information can be anything like Your details or we can say your profile on social media, your data in mobile phone, your biometrics etc. Thus Information Security spans so many research areas like Cryptography, Mobile Computing, Cyber Forensics, Online Social Media etc.

During First World War, Multi-tier Classification System was developed keeping in mind sensitivity of information. With the beginning of Second World War formal alignment of Classification System was done. Alan Turing was the one who successfully decrypted Enigma Machine which was used by Germans to encrypt warfare data.

Information Security programs are build around 3 objectives, commonly known as CIA – Confidentiality, Integrity, Availability.

1. Confidentiality – means information is not disclosed to unauthorized individuals, entities and process. For example if we say I have a password for my Gmail account but someone saw while I was doing a login into Gmail account. In that case my password has been compromised and Confidentiality has been breached.

2. Integrity – means maintaining accuracy and completeness of data. This means data cannot be edited in an unauthorized way. For example if an employee leaves an organisation then in that case data for that employee in all departments like accounts, should be updated to reflect status to JOB LEFT so that data is complete and accurate and in addition to this only authorized person should be allowed to edit employee data.

3. Availability – means information must be available when needed. For example if one needs to access information of a particular employee to check whether employee has outstanded the number of leaves, in that case it requires collaboration from different organizational teams like network operations, development operations, incident response and policy/change management.
Denial of service attack is one of the factor that can hamper the availability of information.

Apart from this there is one more principle that governs information security programs. This is Non repudiation.

· Non repudiation – means one party cannot deny receiving a message or a transaction nor can the other party deny sending a message or a transaction. For example in cryptography it is sufficient to show that message matches the digital signature signed with sender’s private key and that sender could have a sent a message and nobody else could have altered it in transit. Data Integrity and Authenticity are pre-requisites for Non repudiation.

· Authenticity – means verifying that users are who they say they are and that each input arriving at destination is from a trusted source.This principle if followed guarantees the valid and genuine message received from a trusted source through a valid transmission. For example if take above example sender sends the message along with digital signature which was generated using the hash value of message and private key. Now at the receiver side this digital signature is decrypted using the public key generating a hash value and message is again hashed to generate the hash value. If the 2 value matches then it is known as valid transmission with the authentic or we say genuine message received at the recipient side

· Accountability – means that it should be possible to trace actions of an entity uniquely to that entity. For example as we discussed in Integrity section Not every employee should be allowed to do changes in other employees data. For this there is a separate department in an organization that is responsible for making such changes and when they receive request for a change then that letter must be signed by higher authority for example Director of college and person that is allotted that change will be able to do change after verifying his bio metrics, thus timestamp with the user(doing changes) details get recorded. Thus we can say if a change goes like this then it will be possible to trace the actions uniquely to an entity.

At the core of Information Security is Information Assurance, which means the act of maintaining CIA of information, ensuring that information is not compromised in any way when critical issues arise. These issues are not limited to natural disasters, computer/server malfunctions etc.

Thus, the field of information security has grown and evolved significantly in recent years. It offers many areas for specialization, including securing networks and allied infrastructure, securing applications and databases, security testing, information systems auditing, business continuity planning etc.

The need for Information security:

1. Protecting the functionality of the organization:
The decision maker in organizations must set policy and operates their organization in compliance with the complex, shifting legislation, efficient and capable applications.

2. Enabling the safe operation of applications:
The organization is under immense pressure to acquire and operates integrated, efficient and capable applications. The modern organization needs to create an environment that safeguards application using the organizations IT systems, particularly those application that serves as important elements of the infrastructure of the organization.

3. Protecting the data that the organization collect and use:
Data in the organization can be in two forms are either in rest or in motion, the motion of data signifies that data is currently used or processed by the system. The values of the data motivated the attackers to seal or corrupts the data. This is essential for the integrity and the values of the organization’s data. Information security ensures the protection of both data in motion as well as data in rest.

4. Safeguarding technology assets in organizations:
The organization must add intrastate services based on the size and scope of the organization. Organizational growth could lead to the need for public key infrastructure, PKI an integrated system of the software, encryption methodologies. The information security mechanism used by large organizations is complex in comparison to a small organization. The small organization generally prefers symmetric key encryption of data.

Threats to Information Security

Information Security threats can be many like Software attacks, theft of intellectual property, identity theft, theft of equipment or information, sabotage, and information extortion.

Threat can be anything that can take advantage of a vulnerability to breach security and negatively alter, erase, harm object or objects of interest.

Software attacks means attack by Viruses, Worms, Trojan Horses etc. Many users believe that malware, virus, worms, bots are all same things. But they are not same, only similarity is that they all are malicious software that behaves differently.

Malware is a combination of 2 terms- Malicious and Software. So Malware basically means malicious software that can be an intrusive program code or anything that is designed to perform malicious operations on system. Malware can be divided in 2 categories:

1. Infection Methods

2. Malware Actions

Malware on the basis of Infection Method are following:

1. Virus – They have the ability to replicate themselves by hooking them to the program on the host computer like songs, videos etc and then they travel all over the Internet. The Creeper Virus was first detected on ARPANET. Examples include File Virus, Macro Virus, Boot Sector Virus, Stealth Virus etc.

2. Worms – Worms are also self-replicating in nature but they don’t hook themselves to the program on host computer. Biggest difference between virus and worms is that worms are network-aware. They can easily travel from one computer to another if network is available and on the target machine they will not do much harm, they will, for example, consume hard disk space thus slowing down the computer.

3. Trojan – The Concept of Trojan is completely different from the viruses and worms. The name Trojan is derived from the ‘Trojan Horse’ tale in Greek mythology, which explains how the Greeks were able to enter the fortified city of Troy by hiding their soldiers in a big wooden horse given to the Trojans as a gift. The Trojans were very fond of horses and trusted the gift blindly. In the night, the soldiers emerged and attacked the city from the inside.

Their purpose is to conceal themselves inside the software that seem legitimate and when that software is executed they will do their task of either stealing information or any other purpose for which they are designed.

They often provide backdoor gateway for malicious programs or malevolent users to enter your system and steal your valuable data without your knowledge and permission. Examples include FTP Trojans, Proxy Trojans, Remote Access Trojans etc.

4. Bots –: can be seen as advanced form of worms. They are automated processes that are designed to interact over the internet without the need for human interaction. They can be good or bad. Malicious bot can infect one host and after infecting will create connection to the central server which will provide commands to all infected hosts attached to that network called Botnet.

Malware on the basis of Actions:

1. Adware – Adware is not exactly malicious but they do breach privacy of the users. They display ads on a computer’s desktop or inside individual programs. They come attached with free-to-use software, thus main source of revenue for such developers. They monitor your interests and display relevant ads. An attacker can embed malicious code inside the software and adware can monitor your system activities and can even compromise your machine.

2. Spyware – It is a program or we can say software that monitors your activities on computer and reveal collected information to an interested party. Spyware are generally dropped by Trojans, viruses or worms. Once dropped they install themselves and sits silently to avoid detection.

One of the most common example of spyware is KEYLOGGER. The basic job of keylogger is to record user keystrokes with timestamp. Thus capturing interesting information like username, passwords, credit card details etc.

3. Ransomware – It is type of malware that will either encrypt your files or will lock your computer making it inaccessible either partially or wholly. Then a screen will be displayed asking for money i.e. ransom in exchange.

4. Scareware – It masquerades as a tool to help fix your system but when the software is executed it will infect your system or completely destroy it. The software will display a message to frighten you and force to take some action like pay them to fix your system.

5. Rootkits – are designed to gain root access or we can say administrative privileges in the user system. Once gained the root access, the exploiter can do anything from stealing private files to private data.

6. Zombies – They work similar to Spyware. Infection mechanism is same but they don’t spy and steal information rather they wait for the command from hackers.

· Theft of intellectual property means violation of intellectual property rights like copyrights, patents etc.

· Identity theft means to act someone else to obtain person’s personal information or to access vital information they have like accessing the computer or social media account of a person by login into the account by using their login credentials.

· Theft of equipment and information is increasing these days due to the mobile nature of devices and increasing information capacity.

· Sabotage means destroying company’s website to cause loss of confidence on part of its customer.

· Information extortion means theft of company’s property or information to receive payment in exchange. For example ransomware may lock victims file making them inaccessible thus forcing victim to make payment in exchange. Only after payment victim’s files will be unlocked.

These are the old generation attacks that continue these days also with advancement every year. Apart from these there are many other threats. Below is the brief description of these new generation threats.

· Technology with weak security – With the advancement in technology, with every passing day a new gadget is being released in the market. But very few are fully secured and follows Information Security principles. Since the market is very competitive Security factor is compromised to make device more up to date. This leads to theft of data/ information from the devices

· Social media attacks – In this cyber criminals identify and infect a cluster of websites that persons of a particular organization visit, to steal information.

· Mobile Malware –There is a saying when there is a connectivity to Internet there will be danger to Security. Same goes for Mobile phones where gaming applications are designed to lure customer to download the game and unintentionally they will install malware or virus on the device.

· Outdated Security Software – With new threats emerging everyday, updation in security software is a prerequisite to have a fully secured environment.

· Corporate data on personal devices – These days every organization follows a rule BYOD. BYOD means Bring your own device like Laptops, Tablets to the workplace. Clearly BYOD pose a serious threat to security of data but due to productivity issues organizations are arguing to adopt this.

· Social Engineering – is the art of manipulating people so that they give up their confidential information like bank account details, password etc. These criminals can trick you into giving your private and confidential information or they will gain your trust to get access to your computer to install a malicious software- that will give them control of your computer. For example email or message from your friend, that was probably not sent by your friend. Criminal can access your friends device and then by accessing the contact list, he can send infected email and message to all contacts. Since the message/ email is from a known person recipient will definitely check the link or attachment in the message, thus unintentionally infecting the computer.

Information Assurance

Information Assurance (IA) is the practice of managing information-related risks and the steps involved to protect information systems such as computer and network systems.

The US Government's definition of information assurance is:

“measures that protect and defend information and information systems by ensuring their availability, integrity, authentication, confidentiality, and non-repudiation. These measures include providing for restoration of information systems by incorporating protection, detection, and reaction capabilities.”

The 5 pillars of Information Assurance

Information Assurance (IA) is essentially protecting information systems, and is often associated with the following five pillars:

Integrity
Availability
Authentication
Confidentiality
Nonrepudiation

The five pillars of information assurance can be applied various ways, depending on the sensitivity of your organization’s information or information systems. Currently, these five pillars are used at the heart of the US Government’s ability to conduct safe and secure operations in a global environment.

Cyber Security Risk Analysis

Risk analysis refers to the review of risks associated with the particular action or event. The risk analysis is applied to information technology, projects, security issues and any other event where risks may be analysed based on a quantitative and qualitative basis. Risks are part of every IT project and business organizations. The analysis of risk should be occurred on a regular basis and be updated to identify new potential threats. The strategic risk analysis helps to minimize the future risk probability and damage.

Enterprise and organization used risk analysis:

To anticipates and reduce the effect of harmful results occurred from adverse events.
To plan for technology or equipment failure or loss from adverse events, both natural and human-caused.
To evaluate whether the potential risks of a project are balanced in the decision process when evaluating to move forward with the project.
To identify the impact of and prepare for changes in the enterprise environment.

Steps in the risk analysis process

The basic steps followed by a risk analysis process are:

7.9K

Defence secretary apologises after Afghan data breach

Conduct a risk assessment survey:

Getting the input from management and department heads is critical to the risk assessment process. The risk assessment survey refers to begin documenting the specific risks or threats within each department.

Identify the risks:

This step is used to evaluate an IT system or other aspects of an organization to identify the risk related to software, hardware, data, and IT employees. It identifies the possible adverse events that could occur in an organization such as human error, flooding, fire, or earthquakes.

Analyse the risks:

Once the risks are evaluated and identified, the risk analysis process should analyse each risk that will occur, as well as determine the consequences linked with each risk. It also determines how they might affect the objectives of an IT project.

Develop a risk management plan:

After analysis of the Risk that provides an idea about which assets are valuable and which threats will probably affect the IT assets negatively, we would develop a plan for risk management to produce control recommendations that can be used to mitigate, transfer, accept or avoid the risk.

Implement the risk management plan:

The primary goal of this step is to implement the measures to remove or reduce the analyses risks. We can remove or reduce the risk from starting with the highest priority and resolve or at least mitigate each risk so that it is no longer a threat.

Monitor the risks:

This step is responsible for monitoring the security risk on a regular basis for identifying, treating and managing risks that should be an essential part of any risk analysis process.

Cyber Security.

Cybersecurity is the practice of protecting critical systems and sensitive information from digital attacks. Also known as information technology (IT) security, cybersecurity measures are designed to combat threats against networked systems and applications, whether those threats originate from inside or outside of an organization.

Unit II

Application Security- (Database, E-mail and Internet),

Data Security Considerations-(Backups, Archival Storage and Disposal of

Data), Security Technology-(Firewall , VPNs, Intrusion Detection System),

Access Control.

Security Threats -Viruses, Worms, Trojan Horse, Bombs, Trapdoors, Spoofs,

E-mail Viruses, Macro Viruses, Malicious Software, Network and Denial of

Services Attack.

******************************************************************************************************************

Database security

Database security concerns the use of a broad range of information security controls to protect databases (potentially including the data, the database applications or stored functions, the database systems, the database servers and the associated network links) against compromises of their confidentiality, integrity and availability. It involves various types or categories of controls, such as technical, procedural/administrative and physical.

Security risks to database systems include, for example:

· Unauthorized or unintended activity or misuse by authorized database users, database administrators, or network/systems managers, or by unauthorized users or hackers (e.g. inappropriate access to sensitive data, metadata or functions within databases, or inappropriate changes to the database programs, structures or security configurations);

· Malware infections causing incidents such as unauthorized access, leakage or disclosure of personal or proprietary data, deletion of or damage to the data or programs, interruption or denial of authorized access to the database, attacks on other systems and the unanticipated failure of database services;

· Overloads, performance constraints and capacity issues resulting in the inability of authorized users to use databases as intended;

· Physical damage to database servers caused by computer room fires or floods, overheating, lightning, accidental liquid spills, static discharge, electronic breakdowns/equipment failures and obsolescence;

· Design flaws and programming bugs in databases and the associated programs and systems, creating various security vulnerabilities (e.g. unauthorized privilege escalation), data loss/corruption, performance degradation etc.;

· Data corruption and/or loss caused by the entry of invalid data or commands, mistakes in database or system administration processes, sabotage/criminal damage etc.

Many layers and types of information security control are appropriate to databases, including:

· Access control

· Auditing

· Authentication

· Encryption

· Integrity controls

· Backups

· Application security

· Database Security applying Statistical Method

Databases have been largely secured against hackers through network security measures such as firewalls, and network-based intrusion detection systems. While network security controls remain valuable in this regard, securing the database systems themselves, and the programs/functions and data within them, has arguably become more critical as networks are increasingly opened to wider access, in particular access from the Internet. Furthermore, system, program, function and data access controls, along with the associated user identification, authentication and rights management functions, have always been important to limit and in some cases log the activities of authorized users and administrators. In other words, these are complementary approaches to database security, working from both the outside-in and the inside-out as it were.

E-mail security

Email security can be defined as the use of various techniques to secure sensitive information in email communication and accounts against unauthorized access, loss, or compromise. In simpler terms, email security allows an individual or organization to protect the overall access to one or more email addresses or accounts.

Types of Email Attacks

Cyber criminals use many different tactics to hack email, and some methods can cause considerable damage to an organization’s data and/or reputation. Malware, which is malicious software used to harm or manipulate a device or its data, can be placed on a computer using each of the following attacks.

Phishing

A phishing attack targets users by sending them a text, direct message, or email. The attacker pretends to be a trusted individual or institution and then uses their relationship with the target to steal sensitive data like account numbers, credit card details, or login information.

Phishing comes in several forms, such as spear phishing, regular phishing, and whaling. Spear phishing targets a particular person, while a whaler targets someone high up in the organization by pretending to be someone they trust.

Spam

Spoofing

Spoofing is a dangerous email threat because it involves fooling the recipient into thinking the email is coming from someone other than the apparent sender. This makes spoofing an effective business email compromise (BEC) tool. The email platform cannot tell a faked email from a real one because it merely reads the metadata—the same data the attacker has changed.

e-mail security protocol

Pretty Good Privacy (PGP)

Pretty Good Privacy provides confidentiality by encrypting messages to be transmitted or data files to be stored using an encryption algorithm such as Triple DES or CAST-128. Email messages can be protected by using cryptography in various ways, such as the following:

· Digitally signing the message to ensure its integrity and confirm the sender's identity.

· Encrypting the message body of an email message to ensure its confidentiality.

· Encrypting the communications between mail servers to protect the confidentiality of both message body and message header.

The first two methods, message signing and message body encryption, are often used together; however, encrypting the transmissions between mail servers is typically used only when two organizations want to protect emails regularly sent between them. For example, the organizations could establish a virtual private network (VPN) to encrypt communications between their mail servers.Unlike methods that only encrypt a message body, a VPN can encrypt all communication over the connection, including email header information such as senders, recipients, and subjects. However, a VPN does not provide a message signing mechanism, nor can it provide protection for email messages along the entire route from sender to recipient.

Message Authentication Code

A Message authentication code (MAC) is a cryptography method that uses a secret key to digitally sign a message. This method outputs a MAC value that can be decrypted by the receiver, using the same secret key used by the sender. The Message Authentication Code protects both a message's data integrity as well as its authenticity.

Internet security

Internet security is a branch of computer security. It encompasses the Internet, browser security, web site security, and network security as it applies to other applications or operating systems as a whole. Its objective is to establish rules and measures to use against attacks over the Internet. The Internet is an inherently insecure channel for information exchange, with high risk of intrusion or fraud, such, online viruses, trojans, ransomware and worms.

Countermeasures

Network layer security

TCP/IP protocols may be secured with cryptographic methods and security protocols. These protocols include Secure Sockets Layer (SSL), succeeded by Transport Layer Security (TLS) for web traffic, Pretty Good Privacy (PGP) for email, and IPsec for the network layer security.[14]

Internet Protocol Security (IPsec)

IPsec is designed to protect TCP/IP communication in a secure manner. It is a set of security extensions developed by the Internet Engineering Task Force (IETF). It provides security and authentication at the IP layer by transforming data using encryption. Two main types of transformation form the basis of IPsec: the Authentication Header (AH) and ESP. They provide data integrity, data origin authentication, and anti-replay services. These protocols can be used alone or in combination.

Basic components include:

Security protocols for AH and ESP

Security association for policy management and traffic processing

Manual and automatic key management for the Internet key exchange (IKE)

Algorithms for authentication and encryption

The algorithm allows these sets to work independently without affecting other parts of the implementation. The IPsec implementation is operated in a host or security gateway environment giving protection to IP traffic.

Threat modeling

Threat Modeling tools helps you to proactively analyze the cyber security posture of a system or system of systems and in that way prevent security threats.

Multi-factor authentication

Multi-factor authentication (MFA) is an access control method of in which a user is granted access only after successfully presenting separate pieces of evidence to an authentication mechanism – two or more from the following categories: knowledge (something they know), possession (something they have), and inherence (something they are). Internet resources, such as websites and email, may be secured using this technique.

Security token

Some online sites offer customers the ability to use a six-digit code which randomly changes every 30–60 seconds on a physical security token. The token has built-in computations and manipulates numbers based on the current time. This means that every thirty seconds only a certain array of numbers validate access. The website is made aware of that device's serial number and knows the computation and correct time to verify the number. After 30–60 seconds the device presents a new random six-digit number to log into the website.[17]

E-mail security

Firewalls

A computer firewall controls access to a single computer. A network firewall controls access to an entire network. A firewall is a security device — computer hardware or software — that filters traffic and blocks outsiders. It generally consists of gateways and filters. Firewalls can also screen network traffic and block traffic deemed unauthorized.

Web security

Firewalls restrict incoming and outgoing network packets. Only authorized traffic is allowed to pass through it. Firewalls create checkpoints between networks and computers. Firewalls can block traffic based on IP source and TCP port number. They can also serve as the platform for IPsec. Using tunnel mode, firewalls can implement VPNs. Firewalls can also limit network exposure by hiding the internal network from the public Internet.

Browser choice

Web browser market share predicts the share of hacker attacks. For example, Internet Explorer 6, which used to lead the market, was heavily attacked.

Protections

Antivirus

Antivirus software can protect a programmable device by detecting and eliminating malware.[23] A variety of techniques are used, such as signature-based, heuristics, rootkit, and real-time.

Password managers

A password manager is a software application that creates, stores and provides passwords to applications. Password managers encrypt passwords. The user only needs to remember a single master password to access the store.

Security suites

Security suites were first offered for sale in 2003 (McAfee) and contain firewalls, anti-virus, anti-spyware and other components. They also offer theft protection, portable storage device safety check, private Internet browsing, cloud anti-spam, a file shredder or make security-related decisions (answering popup windows) and several were free of charge.

Data Security Considerations-(Backups, Archival Storage and Disposal of Data)

Backups

Backups are used to ensure data which is lost can be recovered and nowadays it's very important to keep a backup of any data.

Backups have two distinct purposes. The primary purpose is to recover data after its loss, be it by data deletion or corruption. The secondary purpose of backups is to recover data from an earlier time, according to a user-defined data retention policy, typically configured within a backup application for how long copies of data are required. Though backups popularly represent a simple form d disaster recovery, and should be part of a disaster recovery plan, by themselves, backups should not alone be considered disaster recovery.

Various forms of backup techniques are listed as follows

• Data repository models: The backup data needs to be stored, and probably should be organized to a degree.

• Unstructured: An unstructured repository is a repoutory with minimal information about what was backed up and when. This is the easiest to implement, but probably the least likely to achieve a high level of recoverability

Full only/System imaging: A repository of this type contains complete system images taken at one or more specific points in time. This technology is frequently used by computer technicians to record known good configurations.

Incremental: An incremental style repository aims o make it more feasible to store backups from more points in time by organizing the data into increments of change between points in time. Typically, a full backup (of all files) is made on one occasion (or at infrequent intervals) and serves as the reference point for an incremental backup set. After that, a number of incremental backups are made after successive time periods. Restoring the whole back-up would sum-up the last available back-up and the new back-ups there after.

• Differential: Each differential backup saves the data that has changed since the last full backup. It has the advantage that only a maximum of two data sets are needed to restore the data.

• Reverse delta: A reverse delta type repository stores a recent "mirror" of the source data and a series of differences between the mirror in its current state and its previous states.

. Continuous data protection: Instead of scheduling periodic backups, the system immediately

logs every change on the host system. This is generally done by saving byte or block-level

differences rather than file-level differences.

Archival Storage

In computers, archival storage is storage for data that may not be actively needed but is kept for possible future use or for record-keeping purposes. Archival storage is often provided using the same system as that used for backup storage. Typically, archival and backup storage can be retrieved using a restore process.

In library and archival science, digital preservation is a formal endeavor to ensure that digital information of continuing value remains accessible and usable. It involves planning, resource allocation, and application of preservation methods and technologies, and it combines policies, strategies and actions to ensure access to reformatted and "born-digital" content, regardless of the challenges of media failure and technological change. The goal of digital preservation is the accurate rendering of authenticated content over time. Digital preservation is the method of keeping digital material alive so that they remain usable as technological advances render original hardware and software specification obsolete.

Data integrity provides the comerstone of digital preservation, representing the intent to "ensure data is recorded exactly as intended and upon later retrieval, ensure the data is the same as it was when it was originally recorded. Unintentional changes to data are to be avoided, and responsible strategies put in place to detect unintentional changes and react as appropriately determined.

Digital sustainability encompasses a range of issues and concems that contribute to the longe of digital information. Unlike traditional, temporary strategies, and more permanent solutions, digu sustainability implies a more active and continuous process. Digital sustainability concentrates on the solution and technology and more on building an infrastructure and approach that is flex with an emphasis on interoperability, continued maintenance and continuous development Dig sustainability incorporates activities in the present that will facilitate access and availability in t future.

Disposal of Data

Data disposallerasure is a method of software based overwriting that completely destroys all electronic data residing on a hard drive or other digital media to ensure that no sensitive data is leaked whes an asset is retired or reused.

Data erasure also called data clearing or data wiping) is a software-based method of overwriting the data that aims to completely destroy all electronic data residing on a hard disk drive or other digital media. Permanent data erasure goes beyond basic file deletion commands, which only remove direct pointers to the data disk sectors and make the data recovery possible with common software tools. Unlike degaussing and physical destruction, which render the storage media unusable, data erasure removes all information while leaving the disk operable, preserving IT assets and the environment

Software-based overwriting uses a software application to write a stream of meaningless pseudorandom data onto all of a hard drive's section. There are key differentiators between data erasure and other overwriting methods, which can leave data intact and raise the risk of data breach, identity theft and/or failure to achieve regulatory compliance. Many data eradication programs also provide multiple overwrites so that they support recognized government and industry standards. Good software should provide verification of data removal, which is necessary for meeting certain standards.

Security Technology-(Firewall, VPNs, Intrusion Detection System),Access Control.

Firewall

A firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted network and an untrusted network, such as the Internet.

Types

1. Packet Filtering Firewalls

Packet filtering firewalls are the oldest, most basic type of firewalls. Operating at the network layer, they check a data packet for its source IP and destination IP, the protocol, source port, and destination port against predefined rules to determine whether to pass or discard the packet. Packet filtering firewalls are essentially stateless, monitoring each packet independently without any track of the established connection or the packets that have passed through that connection previously. This makes these firewalls very limited in their capacity to protect against advanced threats and attacks.

Packet filtering firewalls are fast, cheap, and effective. But the security they provide is very basic. Since these firewalls cannot examine the content of the data packets, they are incapable of protecting against malicious data packets coming from trusted source IPs. Being stateless, they are also vulnerable to source routing attacks and tiny fragment attacks. But despite their minimal functionality, packet filtering firewalls paved the way for modern firewalls that offer stronger and deeper security.

2. Circuit-Level Gateways

Working at the session layer, circuit-level gateways verify established Transmission Control Protocol (TCP) connections and keep track of the active sessions. They are quite similar to packet filtering firewalls in that they perform a single check and utilize minimal resources. However, they function at a higher layer of the Open Systems Interconnection (OSI) model. Primarily, they determine the security of an established connection. When an internal device initiates a connection with a remote host, circuit-level gateways establish a virtual connection on behalf of the internal device to keep the identity and IP address of the internal user hidden.

Circuit-level gateways are cost-efficient, simplistic, barely impact a network’s performance. However, their inability to inspect the content of data packets makes them an incomplete security solution on their own. A data packet containing malware can bypass a circuit-level gateway easily if it has a legitimate TCP handshake. That is why another type of firewall is often configured on top of circuit-level gateways for added protection.

3. Stateful Inspection Firewalls

A step ahead of circuit-level gateways, stateful inspection firewalls, and verifying and keeping track of established connections also perform packet inspection to provide better, more comprehensive security. They work by creating a state table with source IP, destination IP, source port, and destination port once a connection is established. They create their own rules dynamically to allow expected incoming network traffic instead of relying on a hardcoded set of rules based on this information. They conveniently drop data packets that do not belong to a verified active connection.

Stateful inspection firewalls check for legitimate connections and source and destination IPs to determine which data packets can pass through. Although these extra checks provide advanced security, they consume a lot of system resources and can slow down traffic considerably. Hence, they are prone to DDoS (distributed denial-of-service attacks).

4. Application-Level Gateways (Proxy Firewalls)

Application-level gateways, also known as proxy firewalls, are implemented at the application layer via a proxy device. Instead of an outsider accessing your internal network directly, the connection is established through the proxy firewall. The external client sends a request to the proxy firewall. After verifying the authenticity of the request, the proxy firewall forwards it to one of the internal devices or servers on the client’s behalf. Alternatively, an internal device may request access to a webpage, and the proxy device will forward the request while hiding the identity and location of the internal devices and network.

Unlike packet filtering firewalls, proxy firewalls perform stateful and deep packet inspection to analyze the context and content of data packets against a set of user-defined rules. Based on the outcome, they either permit or discard a packet. They protect the identity and location of your sensitive resources by preventing a direct connection between internal systems and external networks. However, configuring them to achieve optimal network protection can be tricky. You must also keep in mind the tradeoff—a proxy firewall is essentially an extra barrier between the host and the client, causing considerable slowdowns.

virtual private network, or VPN, is an encrypted connection over the Internet from a device to a network. The encrypted connection helps ensure that sensitive data is safely transmitted. It prevents unauthorized people from eavesdropping on the traffic and allows the user to conduct work remotely. VPN technology is widely used in corporate environments.

How does a VPN work?

A VPN hides your IP address by letting the network redirect it through a specially configured remote server run by a VPN host. This means that if you surf online with a VPN, the VPN server becomes the source of your data. This means your Internet Service Provider (ISP) and other third parties cannot see which websites you visit or what data you send and receive online. A VPN works like a filter that turns all your data into "gibberish". Even if someone were to get their hands on your data, it would be useless.

Types of VPN

SSL VPN

Often not all employees of a company have access to a company laptop they can use to work from home. During the corona crisis in Spring 2020, many companies faced the problem of not having enough equipment for their employees. In such cases, use of a private device (PC, laptop, tablet, mobile phone) is often resorted to. In this case, companies fall back on an SSL-VPN solution, which is usually implemented via a corresponding hardware box.

The prerequisite is usually an HTML-5-capable browser, which is used to call up the company's login page. HTML-5 capable browsers are available for virtually any operating system. Access is guarded with a username and password.

Site-to-site VPN

A site-to-site VPN is essentially a private network designed to hide private intranets and allow users of these secure networks to access each other's resources.

A site-to-site VPN is useful if you have multiple locations in your company, each with its own local area network (LAN) connected to the WAN (Wide Area Network). Site-to-site VPNs are also useful if you have two separate intranets between which you want to send files without users from one intranet explicitly accessing the other.

Site-to-site VPNs are mainly used in large companies. They are complex to implement and do not offer the same flexibility as SSL VPNs. However, they are the most effective way to ensure communication within and between large departments.

Client-to-Server VPN

Connecting via a VPN client can be imagined as if you were connecting your home PC to the company with an extension cable. Employees can dial into the company network from their home office via the secure connection and act as if they were sitting in the office. However, a VPN client must first be installed and configured on the computer.

This involves the user not being connected to the internet via his own ISP, but establishing a direct connection through his/her VPN provider. This essentially shortens the tunnel phase of the VPN journey. Instead of using the VPN to create an encryption tunnel to disguise the existing internet connection, the VPN can automatically encrypt the data before it is made available to the user.

This is an increasingly common form of VPN, which is particularly useful for providers of insecure public WLAN. It prevents third parties from accessing and compromising the network connection and encrypts data all the way to the provider. It also prevents ISPs from accessing data that, for whatever reason, remains unencrypted and bypasses any restrictions on the user's internet access (for instance, if the government of that country restricts internet access).

The advantage of this type of VPN access is greater efficiency and universal access to company resources. Provided an appropriate telephone system is available, the employee can, for example, connect to the system with a headset and act as if he/she were at their company workplace. For example, customers of the company cannot even tell whether the employee is at work in the company or in their home office.

Intrusion Detection System (IDS)

An Intrusion Detection System (IDS) is a system that monitors network traffic for suspicious activity and issues alerts when such activity is discovered. It is a software application that scans a network or a system for the harmful activity or policy breaching. Any malicious venture or violation is normally reported either to an administrator or collected centrally using a security information and event management (SIEM) system. A SIEM system integrates outputs from multiple sources and uses alarm filtering techniques to differentiate malicious activity from false alarms.

Although intrusion detection systems monitor networks for potentially malicious activity, they are also disposed to false alarms. Hence, organizations need to fine-tune their IDS products when they first install them. It means properly setting up the intrusion detection systems to recognize what normal traffic on the network looks like as compared to malicious activity.

Intrusion prevention systems also monitor network packets inbound the system to check the malicious activities involved in it and at once send the warning notifications.

Classification of Intrusion Detection System:
IDS are classified into 5 types:

1. Network Intrusion Detection System (NIDS):
Network intrusion detection systems (NIDS) are set up at a planned point within the network to examine traffic from all devices on the network. It performs an observation of passing traffic on the entire subnet and matches the traffic that is passed on the subnets to the collection of known attacks. Once an attack is identified or abnormal behavior is observed, the alert can be sent to the administrator. An example of a NIDS is installing it on the subnet where firewalls are located in order to see if someone is trying to crack the firewall.

2. Host Intrusion Detection System (HIDS):
Host intrusion detection systems (HIDS) run on independent hosts or devices on the network. A HIDS monitors the incoming and outgoing packets from the device only and will alert the administrator if suspicious or malicious activity is detected. It takes a snapshot of existing system files and compares it with the previous snapshot. If the analytical system files were edited or deleted, an alert is sent to the administrator to investigate. An example of HIDS usage can be seen on mission-critical machines, which are not expected to change their layout.

3. Protocol-based Intrusion Detection System (PIDS):
Protocol-based intrusion detection system (PIDS) comprises a system or agent that would consistently resides at the front end of a server, controlling and interpreting the protocol between a user/device and the server. It is trying to secure the web server by regularly monitoring the HTTPS protocol stream and accept the related HTTP protocol. As HTTPS is un-encrypted and before instantly entering its web presentation layer then this system would need to reside in this interface, between to use the HTTPS.

4. Application Protocol-based Intrusion Detection System (APIDS):
Application Protocol-based Intrusion Detection System (APIDS) is a system or agent that generally resides within a group of servers. It identifies the intrusions by monitoring and interpreting the communication on application-specific protocols. For example, this would monitor the SQL protocol explicit to the middleware as it transacts with the database in the web server.

5. Hybrid Intrusion Detection System :
Hybrid intrusion detection system is made by the combination of two or more approaches of the intrusion detection system. In the hybrid intrusion detection system, host agent or system data is combined with network information to develop a complete view of the network system. Hybrid intrusion detection system is more effective in comparison to the other intrusion detection system. Prelude is an example of Hybrid IDS.

Detection Method of IDS:

1. Signature-based Method:
Signature-based IDS detects the attacks on the basis of the specific patterns such as number of bytes or number of 1’s or number of 0’s in the network traffic. It also detects on the basis of the already known malicious instruction sequence that is used by the malware. The detected patterns in the IDS are known as signatures.

Signature-based IDS can easily detect the attacks whose pattern (signature) already exists in system but it is quite difficult to detect the new malware attacks as their pattern (signature) is not known.

2. Anomaly-based Method:
Anomaly-based IDS was introduced to detect unknown malware attacks as new malware are developed rapidly. In anomaly-based IDS there is use of machine learning to create a trustful activity model and anything coming is compared with that model and it is declared suspicious if it is not found in model. Machine learning-based method has a better-generalized property in comparison to signature-based IDS as these models can be trained according to the applications and hardware configurations.

Access control

Access control is a method of limiting access to a system or to physical or virtual resources. It is a process by which users can access and are granted certain prerogative to systems, resources or information. Access control is a security technique that has control over who can view different aspects, what can be viewed and who can use resources in a computing environment. It is a fundamental concept in security that reduces risk to the business or organization.

To establish a secure system, electronic access control systems are used that depend on user credentials, access card readers, auditing and reports to track employee access to restricted business locations and areas. These systems include access control panels to prohibit entry to sensitive areas like alarms and lock down areas to prevent unauthorized access or operations.

Access control systems perform identification, authentication, and authorization of users and entities by evaluating required login credentials that may include passwords, pins, bio-metric scans or other authentication factors. There is multi-factor authentication which requires two or more authentication factors which is often an important part of the layered defense to protect access control systems.

Authentication Factors:

· Password or PIN

· Bio-metric measurement (fingerprint & retina scan)

· Card or Key

Different access control models are used depending on the compliance requirements and the security levels of information technology that is to be protected. Basically access control is of 2 types:

1. Physical Access Control:
Physical access control restricts entry to campuses, buildings, rooms and physical IT assets.

2. Logical Access Control:
Logical access control limits connections to computer networks, system files and data.

Access Control Models:

1. Attribute-based Access Control (ABAC):
In this model, access is granted or declined by evaluating a set of rules, policies, and relationships using the attributes of users, systems and environmental conditions.

2. Discretionary Access Control (DAC):
In DAC, the owner of data determines who can access specific resources.

3. History-Based Access Control (HBAC):
Access is granted or declined by evaluating the history of activities of the inquiring party that includes behavior, the time between requests and content of requests.

4. Identity-Based Access Control (IBAC):
By using this model network administrators can more effectively manage activity and access based on individual requirements.

5. Mandatory Access Control (MAC):
A control model in which access rights are regulated by a central authority based on multiple levels of security. Security Enhanced Linux is implemented using MAC on the Linux operating system.

6. Organization-Based Access control (OrBAC):
This model allows the policy designer to define a security policy independently of the implementation.

7. Role-Based Access Control (RBAC):
RBAC allows access based on the job title. RBAC eliminates discretion on a large scale when providing access to objects. For example, there should not be permissions for human resources specialist to create network accounts.

8. Rule-Based Access Control (RAC):
RAC method is largely context based. Example of this would be only allowing students to use the labs during a certain time of day.

Security Threats -Viruses, Worms, Trojan Horse, Bombs, Trapdoors, Spoofs

Virus is a computer program or software that connect itself to another software or computer program to harm computer system. When the computer program runs attached with virus it perform some action such as deleting a file from the computer system. Virus can’t be controlled by remote.

Worms:
Worms is also a computer program like virus but it does not modify the program. It replicate itself more and more to cause slow down the computer system. Worms can be controlled by remote.

Trojan Horse:
Trojan Horse does not replicate itself like virus and worms. It is a hidden piece of code which steal the important information of user. For example, Trojan horse software observe the e-mail ID and password while entering in web browser for logging.

Difference between Virus, Worm and Trojan Horse:

Virus	Worm	Trojan Horse
Virus is a software or computer program that connect itself to another software or computer program to harm computer system.	Worms replicate itself to cause slow down the computer system.	Trojan Horse rather than replicate capture some important information about a computer system or a computer network.
Virus replicates itself.	Worms are also replicates itself.	But Trojan horse does not replicate itself.
Virus can’t be controlled by remote.	Worms can be controlled by remote.	Like worms, Trojan horse can also be controlled by remote.
Spreading rate of viruses are moderate.	While spreading rate of worms are faster than virus and Trojan horse.	And spreading rate of Trojan horse is slow in comparison of both virus and worms.
The main objective of virus to modify the information.	The main objective of worms to eat the system resources.	The main objective of Trojan horse to steal the information.
Viruses are executed via executable files.	Worms are executed via weaknesses in system.	Trojan horse executes through a program and interprets as utility software.

Types of Viruses

A virus is a fragment of code embedded in a legitimate program. Viruses are self-replicating and are designed to infect other programs. They can wreak havoc in a system by modifying or destroying files causing system crashes and program malfunctions. On reaching the target machine a virus dropper(usually a trojan horse) inserts the virus into the system.

Various types of viruses:

· File Virus:
This type of virus infects the system by appending itself to the end of a file. It changes the start of a program so that the control jumps to its code. After the execution of its code, the control returns back to the main program. Its execution is not even noticed. It is also called a Parasitic virus because it leaves no file intact but also leaves the host functional.

· Boot sector Virus:
It infects the boot sector of the system, executing every time system is booted and before the operating system is loaded. It infects other bootable media like floppy disks. These are also known as memory viruses as they do not infect the file systems.

· Macro Virus:
Unlike most viruses which are written in a low-level language(like C or assembly language), these are written in a high-level language like Visual Basic. These viruses are triggered when a program capable of executing a macro is run. For example, the macro viruses can be contained in spreadsheet files.

· Source code Virus:
It looks for source code and modifies it to include virus and to help spread it.

· Polymorphic Virus:
A virus signature is a pattern that can identify a virus(a series of bytes that make up virus code). So in order to avoid detection by antivirus a polymorphic virus changes each time it is installed. The functionality of the virus remains the same but its signature is changed.

· Encrypted Virus:
In order to avoid detection by antivirus, this type of virus exists in encrypted form. It carries a decryption algorithm along with it. So the virus first decrypts and then executes.

· Stealth Virus:
It is a very tricky virus as it changes the code that can be used to detect it. Hence, the detection of viruses becomes very difficult. For example, it can change the read system call such that whenever the user asks to read a code modified by a virus, the original form of code is shown rather than infected code.

· Tunneling Virus:
This virus attempts to bypass detection by antivirus scanner by installing itself in the interrupt handler chain. Interception programs, which remain in the background of an operating system and catch viruses, become disabled during the course of a tunneling virus. Similar viruses install themselves in device drivers.

· Multipartite Virus:
This type of virus is able to infect multiple parts of a system including the boot sector, memory, and files. This makes it difficult to detect and contain.

· Armored Virus:
An armored virus is coded to make it difficult for antivirus to unravel and understand. It uses a variety of techniques to do so like fooling antivirus to believe that it lies somewhere else than its real location or using compression to complicate its code.

· Browser Hijacker:
As the name suggests this virus is coded to target the user’s browser and can alter the browser settings. It is also called the browser redirect virus because it redirects your browser to other malicious sites that can harm your computer system.

· Resident Virus:

Resident viruses installation store for your RAM and meddle together along with your device operations. They’re so sneaky that they could even connect themselves for your anti-virus software program files.

Logic Bomb

A Logic Bomb is a piece of often-malicious code that is intentionally inserted into software. It is activated upon the host network only when certain conditions are met.

Logic bombs execute their functions, or launch their payload, once a certain condition is met such as upon the termination of an employee. This makes their presence undetected until it executes their function, which can range from inflicting harm through files deletion to self-propagation to the unusual.

A trap door is kind of a secret entry point into a program that allows anyone gain access to any system without going through the usual security access procedures. Other definition of trap door is it is a method of bypassing normal authentication methods. Therefore it is also known as back door.

Programmers use Trap door legally to debug and test programs. Trap doors turns to threats when any dishonest programmers to gain illegal access. Program development and software update activities should be first focus of security measures. Operating system that controls the trap doors is difficult to implement.

Trapdoors

Spoofing

Spoofing is a fraudulent act in which communication from an unknown source is disguised as being from a source that is known to and trusted by the recipient. A spoofing attack occurs when a person (referred to as a spoofer) pretends to be someone else in order to trick their target into sharing their personal data or performing some action on behalf of the spoofer. The spoofer will often take time and make an effort to build trust with their target, thus ensuring that they will share their sensitive data more easily.

As a type of impersonation carried out via technological means, spoofing can take on many forms. In its most primitive form, spoofing refers to impersonation via telephone. For example, when a caller on the other end falsely introduces themselves as a representative of your bank and asks for your account or credit card info, you are a victim of phone spoofing. To make their fake calls seem more believable, spoofers have also started using software to fake caller IDs, an act known as phone number spoofing.

The most sophisticated forms of spoofing, however, are taking place online. In most cases, they involve the sending of fraudulent emails to unsuspecting targets, but may also include the spoofing of devices and addresses. Regardless of their type, most spoofing attacks are malicious. The attackers behind them usually aim to gain access to the victim’s personal data, distribute malware, access private networks, create botnets for the purpose of carrying out cyber attacks, or cause financial losses to the victim.

Spoofing isn’t illegal in itself, as you might sometimes need to fake your phone number, your IP address, or even your name to protect your identity and be able to access certain services that may otherwise be unavailable in your location. However, it is illegal to use spoofing to defraud someone and engage in criminal activity. Depending on the severity of their attack, spoofers may be fined and/or sentenced to prison. They may also have to compensate their victim for any losses suffered as a result of the attack.

email virus

An email virus consists of malicious code distributed in email messages to infect one or more devices. This malicious code can be activated in numerous ways: when the email recipient clicks on an infected link within the message, opens an infected attachment or interacts with the message in some other way.

Macro Virus:
Unlike most viruses which are written in a low-level language(like C or assembly language), these are written in a high-level language like Visual Basic. These viruses are triggered when a program capable of executing a macro is run. For example, the macro viruses can be contained in spreadsheet files.

Malicious software

Malicious software (often called malware for short) is any type of software that is intended to harm or hack the user. They might be attempting to steal your information, or they might simply do it for malicious reasons

Malware is a software that gets into the system without user consent with an intention to steal private and confidential data of the user that includes bank details and password. They also generates annoying pop up ads and makes changes in system settings
They get into the system through various means:

1. Along with free downloads.

2. Clicking on suspicious link.

3. Opening mails from malicious source.

4. Visiting malicious websites.

5. Not installing an updated version of antivirus in the system.

Types:

1. Virus

2. Worm

3. Logic Bomb

4. Trojan/Backdoor

5. Rootkit

6. Advanced Persistent Threat

7. Spyware and Adware

What is computer virus:
Computer virus refers to a program which damages computer systems and/or destroys or erases data files. A computer virus is a malicious program that self-replicates by copying itself to another program. In other words, the computer virus spreads by itself into other executable code or documents. The purpose of creating a computer virus is to infect vulnerable systems, gain admin control and steal user sensitive data. Hackers design computer viruses with malicious intent and prey on online users by tricking them.

Symptoms:

· Letter looks like they are falling to the bottom of the screen.

· The computer system becomes slow.

· The size of available free memory reduces.

· The hard disk runs out of space.

· The computer does not boot.

Types of Computer Virus:
These are explained as following below.

1. Parasitic –
These are the executable (.COM or .EXE execution starts at first instruction). Propagated by attaching itself to particular file or program. Generally resides at the start (prepending) or at the end (appending) of a file, e.g. Jerusalem.

2. Boot Sector –
Spread with infected floppy or pen drives used to boot the computers. During system boot, boot sector virus is loaded into main memory and destroys data stored in hard disk, e.g. Polyboot, Disk killer, Stone, AntiEXE.

3. Polymorphic –
Changes itself with each infection and creates multiple copies. Multipartite: use more than one propagation method. >Difficult for antivirus to detect, e.g. Involutionary, Cascade, Evil, Virus 101., Stimulate.

Three major parts: Encrypted virus body, Decryption routine varies from infection to infection, and Mutation engine.

4. Memory Resident –
Installs code in the computer memory. Gets activated for OS run and damages all files opened at that time, e.g. Randex, CMJ, Meve.

5. Stealth –
Hides its path after infection. It modifies itself hence difficult to detect and masks the size of infected file, e.g. Frodo, Joshi, Whale.

6. Macro –
Associated with application software like word and excel. When opening the infected document, macro virus is loaded into main memory and destroys the data stored in hard disk. As attached with documents; spreads with those infected documents only, e.g. DMV, Melissa, A, Relax, Nuclear, Word Concept.

7. Hybrids –
Features of various viruses are combined, e.g. Happy99 (Email virus).

Worm:
A worm is a destructive program that fills a computer system with self-replicating information, clogging the system so that its operations are slowed down or stopped.

Types of Worm:

1. Email worm – Attaching to fake email messages.

2. Instant messaging worm – Via instant messaging applications using loopholes in network.

3. Internet worm – Scans systems using OS services.

4. Internet Relay Chat (IRC) worm – Transfers infected files to web sites.

5. Payloads – Delete or encrypt file, install backdoor, creating zombie etc.

6. Worms with good intent – Downloads application patches.

Logical Bomb:
A logical bomb is a destructive program that performs an activity when a certain action has occurred. These are hidden in programming code. Executes only when a specific condition is met, e.g. Jerusalem.

Script Virus:
Commonly found script viruses are written using the Visual Basic Scripting Edition (VBS) and the JavaScript programming language.

Trojan / Backdoor:
Trojan Horse is a destructive program. It usually pretends as computer games or application software. If executed, the computer system will be damaged. Trojan Horse usually comes with monitoring tools and key loggers. These are active only when specific events are alive. These are hidden with packers, crypters and wrappers.< Hence, difficult to detect through antivirus. These can use manual removal or firewall precaution.

RootKits:
Collection of tools that allow an attacker to take control of a system.

· Can be used to hide evidence of an attacker’s presence and give them backdoor access.

· Can contain log cleaners to remove traces of attacker.

· Can be divided as:
– Application or file rootkits: replaces binaries in Linux system
– Kernel: targets kernel of OS and is known as a loadable kernel module (LKM)

· Gains control of infected m/c by:
– DLL injection: by injecting malicious DLL (dynamic link library)
– Direct kernel object manipulation: modify kernel structures and directly target trusted part of OS
– Hooking: changing applicant’s execution flow

Advanced Persistent Threat:
Created by well funded, organized groups, nation-state actors, etc. Desire to compromise government and commercial entities, e.g. Flame: used for reconnaissance and information gathering of system.

Spyware and Adware:
Normally gets installed along with free software downloads. Spies on the end-user, attempts to redirect the user to specific sites. Main tasks: Behavioral surveillance and advertising with pop up ads Slows down the system.

Network attacks

Network attacks are unauthorized actions on the digital assets within an organizational network. Malicious parties usually execute network attacks to alter, destroy, or steal private data. Perpetrators in network attacks tend to target network perimeters to gain access to internal systems.

There are two main types of network attacks: passive and active. In passive network attacks, malicious parties gain unauthorized access to networks, monitor, and steal private data without making any alterations. Active network attacks involve modifying, encrypting, or damaging data.

Denial-of-Service (DoS)

A Denial-of-Service (DoS) attack is an attack meant to shut down a machine or network, making it inaccessible to its intended users. DoS attacks accomplish this by flooding the target with traffic, or sending it information that triggers a crash. In both instances, the DoS attack deprives legitimate users (i.e. employees, members, or account holders) of the service or resource they expected.

Victims of DoS attacks often target web servers of high-profile organizations such as banking, commerce, and media companies, or government and trade organizations. Though DoS attacks do not typically result in the theft or loss of significant information or other assets, they can cost the victim a great deal of time and money to handle.

There are two general methods of DoS attacks: flooding services or crashing services. Flood attacks occur when the system receives too much traffic for the server to buffer, causing them to slow down and eventually stop. Popular flood attacks include:

Buffer overflow attacks – the most common DoS attack. The concept is to send more traffic to a network address than the programmers have built the system to handle. It includes the attacks listed below, in addition to others that are designed to exploit bugs specific to certain applications or networks
ICMP flood – leverages misconfigured network devices by sending spoofed packets that ping every computer on the targeted network, instead of just one specific machine. The network is then triggered to amplify the traffic. This attack is also known as the smurf attack or ping of death.
SYN flood – sends a request to connect to a server, but never completes the handshake. Continues until all open ports are saturated with requests and none are available for legitimate users to connect to.

Other DoS attacks simply exploit vulnerabilities that cause the target system or service to crash. In these attacks, input is sent that takes advantage of bugs in the target that subsequently crash or severely destabilize the system, so that it can’t be accessed or used.

An additional type of DoS attack is the Distributed Denial of Service (DDoS) attack. A DDoS attack occurs when multiple systems orchestrate a synchronized DoS attack to a single target. The essential difference is that instead of being attacked from one location, the target is attacked from many locations at once. The distribution of hosts that defines a DDoS provide the attacker multiple advantages:

He can leverage the greater volume of machine to execute a seriously disruptive attack
The location of the attack is difficult to detect due to the random distribution of attacking systems (often worldwide)
It is more difficult to shut down multiple machines than one
The true attacking party is very difficult to identify, as they are disguised behind many (mostly compromised) systems

Modern security technologies have developed mechanisms to defend against most forms of DoS attacks, but due to the unique characteristics of DDoS, it is still regarded as an elevated threat and is of higher concern to organizations that fear being targeted by such an attack.

Unit III

Introduction to E-Commerce , Threats to E-Commerce, Electronic Payment System, e- Cash, Credit/Debit Cards. Digital Signature, Cryptography Developing Secure Information Systems, Application Development Security, Information Security Governance & Risk Management, Security Architecture & Design Security Issues in Hardware, Data Storage & Downloadable Devices, Physical Security of IT Assets - Access Control, CCTV, Backup Security Measures.

*************************************************************************************

Introduction to E-Commerce

E-commerce (electronic commerce) is the buying and selling of goods and services, or the transmitting of funds or data, over an electronic network, primarily the internet. These business transactions occur either as business-to-business (B2B), business-to-consumer (B2C), consumer-to-consumer or consumer-to-business.

E-commerce is basically the process of buying and selling commodities and goods over the Internet. In E-commerce, transactions take place via digital methods via electronic funds and the processing of online transactions.

Since E-commerce deals with the transfer of money digitally, hackers and attackers use this as an opportunity to break into E-commerce websites and gain some financial profit from them.

Threats to E-Commerce

Types of threats to E-commerce:

· Tax Evasion: Organizations show the legal paper records of revenue to the IRS. But in the case of E-commerce shopping, online transactions take place due to which funds get transferred electronically due to which IRS is not able to count the transactions properly and there are high chances of tax evasions by these organizations.

· Payment conflict: In E-commerce, payment conflicts can arise between users and the E-commerce platforms. These electronic funds transferring systems might process extra transactions from the users which will lead to a payment conflict by the users due to some glitches or errors.

· Financial fraud: Whenever an online transaction or transfer of funds takes place, it always asks for some pin or passwords to authenticate and allows only the authorized person to process the transactions. But due to some spyware and viruses used by attackers, they can also process the transactions of the users by allowing the unauthorized person, which will lead to causing a financial fraud with the user.

· E-wallets: E-wallets are now an essential part of E-commerce platforms. Attack on E-wallets can lead to the leak of the sensitive banking credentials of the users which can be used by the attackers for their own profit. Regulators tend to monitor all the activities related to the financial security of the money of the users.

· Phishing: It is one of the most common attacks nowadays on the users, where the attackers send emails and messages to a large number of users which contain a special link in it. When the users open that link in their browser, the malware starts downloading in the background and the attacker gets full control over the financial information about the users. They make fake websites to make the users believe their website and fill out their financial credentials.

· SQL injections: SQL injections are used by attackers to manipulate the database of large organizations. Attackers enter malicious code full of malware into the database and then they search for targeted queries in the database and then they collect all the sensitive information in the database.

· Cross-site scripting (XSS): Hackers target the website of E-commerce companies by entering malicious code into their codebase. It is a very harmful attack as the control of the entire website goes into the hands of the attackers. It can enable the attackers to track the users by using their browsing activity and their cookies. For More details please read the what is cross-site scripting XSS article.

· Trojans: Attackers make software that may appear to be useful before downloading, but after downloading the software it installs all the malicious programs on the computer. It collects data like personal details, address, email, financial credentials and it may cause data leaks.

· Brute force attacks: Hackers draw patterns and use random methods to crack into someone else’s account as an unauthorized user. It requires the use of multiple algorithms and permutations and combinations to crack the password of an account by the attacker.

· Bots: The hackers use a large number of bots on E-commerce websites to track the competitor in the E-commerce industry rankings and his user’s buying policies in order to scrap the sales and revenue of the competitor. It also decreases the ranking of their E-commerce website as compared to the competitors due to bad experiences faced by the users. It results in overall price decreasing and less revenue overall in sales.

· DDoS attacks: Distributed Denial of Service (DDoS) attacks are most commonly used by hackers to not allow original legitimate users to access and buy and sell products from the E-commerce platforms. Hackers use a large number of computers to flood the number of requests to the server so that at one time the server crashes out.

· Skimming: Skimming is a popular method to spread out the malware on the website’s main pages which are used by a large number of people. It steals and leaks all information entered by the users on that webpage and all this information goes to the attacker through skimming.

· Middlemen attack: In this type of attack, the attacker can clearly get all the information in the conversation taking place between the consumer and the E-commerce platform itself. The attacker sees the conversation between both of them and uses this as an opportunity to make the user face some vulnerability.

Prevent threats:

We can prevent the following E-commerce threats in the following ways:

· Anti-malware: We can deploy Anti-malware and Anti-virus software on all our computer systems so that we can prevent these conditions to happen. Anti-malware and Anti-virus software prevent all types of malware and viruses to infect the data on our computer.

· HTTPS: HTTPS helps to keep the website data secure from any kind of digital attack. SSL and HTTPS encrypt all the data of the users which is harder to crack by the hackers.

· Payment gateway: We can secure the payment gateway used on the E-commerce websites which very high security and strict policies against leaking of any financial credentials of any user.

Electronic payment system

Electronic payment is the process where customers make payments by using electronic methods. Whether you want to pay for your favourite food or you want to pay your nearby retailer, you can do it easily via electronic payment solutions.

The different types of e-commerce payments in use today are:

Credit Card

The most popular form of payment for e-commerce transactions is through credit cards. It is simple to use; the customer has to just enter their credit card number and date of expiry in the appropriate area on the seller’s web page. To improve the security system, increased security measures, such as the use of a card verification number (CVN), have been introduced to on-line credit card payments. The CVN system helps detect fraud by comparing the CVN number with the cardholder's information

Debit Card

Debit cards are the second largest e-commerce payment medium in India. Customers who want to spend online within their financial limits prefer to pay with their Debit cards. With the debit card, the customer can only pay for purchased goods with the money that is already there in his/her bank account as opposed to the credit card where the amounts that the buyer spends are billed to him/her and payments are made at the end of the billing period.

Smart Card

It is a plastic card embedded with a microprocessor that has the customer’s personal information stored in it and can be loaded with funds to make online transactions and instant payment of bills. The money that is loaded in the smart card reduces as per the usage by the customer and has to be reloaded from his/her bank account.

E-Wallet

E-Wallet is a prepaid account that allows the customer to store multiple credit cards, debit card and bank account numbers in a secure environment. This eliminates the need to key in account information every time while making payments. Once the customer has registered and created E-Wallet profile, he/she can make payments faster.

Netbanking

This is another popular way of making e-commerce payments. It is a simple way of paying for online purchases directly from the customer’s bank. It uses a similar method to the debit card of paying money that is already there in the customer’s bank. Net banking does not require the user to have a card for payment purposes but the user needs to register with his/her bank for the net banking facility. While completing the purchase the customer just needs to put in their net banking id and pin.

Mobile Payment

One of the latest ways of making online payments are through mobile phones. Instead of using a credit card or cash, all the customer has to do is send a payment request to his/her service provider via text message; the customer’s mobile account or credit card is charged for the purchase. To set up the mobile payment system, the customer just has to download a software from his/her service provider’s website and then link the credit card or mobile billing information to the software.

eCash

eCash was a digital-based system that facilitated the transfer of funds anonymously. A pioneer in cryptocurrency, its goal was to secure the privacy of individuals that use the Internet for micropayments. eCash was created by Dr. David Chaum under his company, DigiCash, in 1990. Though there was interest in the platform from large banks, eCash never took off and DigiCash filed for bankruptcy in 1998. DigiCash, along with its eCash patents, was eventually sold off. In 2018, Chaum launched a new startup focused on cryptography.

Digital Signatures

“Digital Signatures is an authentication tool.”

Digital signatures are the public-key primitives of message authentication. In the physical world, it is common to use handwritten signatures on handwritten or typed messages. They are used to bind signatory to the message.

Similarly, a digital signature is a technique that binds a person/entity to the digital data. This binding can be independently verified by receiver as well as any third party.

Digital signature is a cryptographic value that is calculated from the data and a secret key known only by the signer.

In real world, the receiver of message needs assurance that the message belongs to the sender and he should not be able to repudiate the origination of that message. This requirement is very crucial in business applications, since likelihood of a dispute over exchanged data is very high.

Model of Digital Signature

As mentioned earlier, the digital signature scheme is based on public key cryptography. The model of digital signature scheme is depicted in the following illustration −

The following points explain the entire process in detail −

· Each person adopting this scheme has a public-private key pair.

· Generally, the key pairs used for encryption/decryption and signing/verifying are different. The private key used for signing is referred to as the signature key and the public key as the verification key.

· Signer feeds data to the hash function and generates hash of data.

· Hash value and signature key are then fed to the signature algorithm which produces the digital signature on given hash. Signature is appended to the data and then both are sent to the verifier.

· Verifier feeds the digital signature and the verification key into the verification algorithm. The verification algorithm gives some value as output.

· Verifier also runs same hash function on received data to generate hash value.

· For verification, this hash value and output of verification algorithm are compared. Based on the comparison result, verifier decides whether the digital signature is valid.

· Since digital signature is created by ‘private’ key of signer and no one else can have this key; the signer cannot repudiate signing the data in future.

It should be noticed that instead of signing data directly by signing algorithm, usually a hash of data is created. Since the hash of data is a unique representation of data, it is sufficient to sign the hash in place of data. The most important reason of using hash instead of data directly for signing is efficiency of the scheme.

Cryptography

Cryptography is a technique of securing information and communications through use of codes so that only those person for whom the information is intended can understand it and process it.

Thus preventing unauthorized access to information. The prefix “crypt” means “hidden” and suffix graphy means “writing”.

In Cryptography the techniques which are use to protect information are obtained from mathematical concepts and a set of rule based calculations known as algorithms to convert messages in ways that make it hard to decode it. These algorithms are used for cryptographic key generation, digital signing, verification to protect data privacy, web browsing on internet and to protect confidential transactions such as credit card and debit card transactions.

Types Of Cryptography:

In general there are three types Of cryptography:

1. Symmetric Key Cryptography:
It is an encryption system where the sender and receiver of message use a single common key to encrypt and decrypt messages. Symmetric Key Systems are faster and simpler but the problem is that sender and receiver have to somehow exchange key in a secure manner. The most popular symmetric key cryptography system is Data Encryption System(DES).

2. Hash Functions:
There is no usage of any key in this algorithm. A hash value with fixed length is calculated as per the plain text which makes it impossible for contents of plain text to be recovered. Many operating systems use hash functions to encrypt passwords.

3. Asymmetric Key Cryptography:
Under this system a pair of keys is used to encrypt and decrypt information. A public key is used for encryption and a private key is used for decryption. Public key and Private Key are different. Even if the public key is known by everyone the intended receiver can only decode it because he alone knows the private key.

DEVELOPING SECURE INFORMATION SYSTEMS

Every information system is prone to threats like unauthorized access, disclosure, destruction, use or modification. So, for handling such threats we need to develop security programs or policies for the information system. The information security program help in selecting and implementing counter measures against any security breaches. A good security program helps in ensuring that everyone within organization works cooperatively to secure the whole system.

Thus, developing a security program is the first action to implement information security. A sell defined information security program outlines the strategies which need to be implemented for achieving the objectives of information system in a secure way. Information security program can also be used to integrate various aspects of an organization to meet business objectives. After developing an information security program, it is also necessary that everyone within the

organization should follow this program. This is important because computers are inherently very much vulnerable to a wide variety of threats and thus need to be periodically reviewed and tested.

So, for safeguarding the information system, information systems security programs are used to

address the threats like hacking or accidental loss.

Information Security Program Objectives

The main objectives of an information security program are as follows: To protect information assets and ensure confidentiality, integrity and availability of information throughout the system

> To ensure that any information should not be revealed to persons who are not part of theOrganization

> To provide strength an internal controlling and prevention of improper or unauthorised access to information

> To make sure that all security flaw or accident must be reported, so that proper analysis and handling of such cases can be done.

Management Commitment

Management commitment to security is very essential for developing a successful information security

System Management commitment helps in motivating the information resource owner and user and also provides the visibility which is needed by the information security team for ensuring the suppon of business units. All the individuals within the show commitment towards security by following the security guidelines and practices given by the authoritative sources Management support helps in better handling of security issues and leads to decrease in likelihood of failures. If the top management do not show support for information system security efforts, then their employees w also show less support for efforts If the organization emphasizes the negative effects of loss re information, then this will put pressure on business units and will motivate them to improve security Also if a ranking system for business units is established within the organization based on quality of their information security, then this will ensure an active participation of all the units in information security within the organization and will also apply pressure on the individual who do not

Information System Security Program Development Responsibilities

The information system security team should be responsible for developing the information security program. As an alternative, a management committee within the organization can be given the responsibility to draft security policies and guidelines. It is important that the team which will be making the information security program must be familiar with current business culture and technologies. This will help in making intelligent decisions. Knowing the business culture helps in designing an information security program that will ensure compatibility and familiarity with technology helps to know the limitations of technological solutions and security capabilities. The team ater considering all the important aspects of the information security, design a information security program to protect the system from threats

Application Development Security

Application development security includes foundation, principle and design guidelines which are based on basic aims of information security for developing safe applications.

The framework helps in secure development of applications which helps as a component to defense part of the system and at the same time protects information assets.

Foundation

Foundation includes the basic aspects of applications development which one needs to know before developing a secure application. It includes • Knowledge of company's security policy, methods and guidelines.

• Knowledge of application development methodology.

• Knowledge of programming languages and translators

Principles

The following principles need to be followed when developing a secure application.

Adhering to trusted standards. Protection of information assets.

Authentication

• Mechanism of overcoming failures.

• Use of accuracy in date and time.

• Users need to know how it works, rather that its implementation.

• Use of security mechanisms

Security is implemented as a part of design.

Assuming hostile situations

• Minimize use of computing elements and there protection.

Design Guidelines

It guides the application development towards the use of best practices for securing the application The best known and widely accepted security methods are used for implementing the code for the application.

They are as follows

Input Validation

Exception Handling

Random Numbers

Canonical Representation

Cryptography.

Information Security Governance & Risk Management

Information security governance is defined as “a subset of enterprise governance that provides strategic direction, ensures that objectives are achieved, manages risk appropriately, uses organizational resources responsibly, and monitors the success or failure of the enterprise security program,” according to the Information Systems Audit and Control Association.

Need an Information Security Governance Framework?

While the definition sounds complex, it can be simplified. An information security governance framework helps you prepare for risks or events before they occur by forcing you to continually reevaluate critical IT and business functions through:

· Integrated risk management functions

· Threat and vulnerability analysis

· Data governance and threat protection

· Aligning business strategy with IT strategy

Reactive Versus Proactive

Information security governance also helps an organization move from a reactive approach to cybersecurity to a proactive approach. It allows you to:

· Categorize and mitigate risks and threats

· Prepare an organization for identifying, remediating, and recovering from a cyberattack or breach

· Provide a method for executive leadership to understand their risk posture and maturity levels

· Outline a risk-based approach to the people, systems, and technology that are used every day

Main Components of Information Security Governance?

There are four main components to the information security governance framework:

· Strategy

· Implementation

· Operation

· Monitoring

Strategy

Information security should align with business objectives. IT strategic plans need to satisfy the current and future business requirements. The goal of information security governance is to align business and IT strategies with organizational objectives.

Implementation

Information security governance requires commitment, resources, assignment of responsibilities, and implementation of policies and procedures that address the controls within a chosen framework. Buy-in from senior management and above is critical to the implementation of the program.

Operation

It’s important that adequate resources are in place, projects that align with your overall strategy are deployed, and operational and technology risks are addressed and mitigated to appropriate levels.

Monitoring

Metrics and monitoring help document the effectiveness of the program provide information to help management make decisions, address any compliance issues, and establish information security controls with a more proactive approach.

Information security risk management or ISRM

Information security risk management, or ISRM, is the process of managing risks associated with the use of information technology. It involves identifying, assessing, and treating risks to the confidentiality, integrity, and availability of an organization’s assets. The end goal of this process is to treat risks in accordance with an organization’s overall risk tolerance. Businesses shouldn’t expect to eliminate all risks; rather, they should seek to identify and achieve an acceptable risk level for their organization.

Stages of ISRM:

Identification

Identify assets: What data, systems, or other assets would be considered your organization’s “crown jewels”? For example, which assets would have the most significant impact on your organization if their confidentiality, integrity or availability were compromised? It’s not hard to see why the confidentiality of data like social security numbers and intellectual property is important. But what about integrity? For example, if a business falls under Sarbanes-Oxley (SOX) regulatory requirements, a minor integrity problem in financial reporting data could result in an enormous cost. Or, if an organization is an online music streaming service and the availability of music files is compromised, then they could lose subscribers.
Identify vulnerabilities: What system-level or software vulnerabilities are putting the confidentiality, integrity, and availability of the assets at risk? What weaknesses or deficiencies in organizational processes could result in information being compromised?
Identify threats: What are some of the potential causes of assets or information becoming compromised? For example, is your organization’s data center located in a region where environmental threats, like tornadoes and floods, are more prevalent? Are industry peers being actively targeted and hacked by a known crime syndicate, hacktivist group, or government-sponsored entity? Threat modeling is an important activity that helps add context by tying risks to known threats and the different ways those threats can cause risks to become realized via exploiting vulnerabilities.
Identify controls: What do you already have in place to protect identified assets? A control directly addresses an identified vulnerability or threat by either completely fixing it (remediation) or lessening the likelihood and/or impact of a risk being realized (mitigation). For example, if you’ve identified a risk of terminated users continuing to have access to a specific application, then a control could be a process that automatically removes users from that application upon their termination. A compensating control is a “safety net” control that indirectly addresses a risk. Continuing with the same example above, a compensating control may be a quarterly access review process. During this review, the application user list is cross-referenced with the company’s user directory and termination lists to find users with unwarranted access and then reactively remove that unauthorized access when it’s found.

Assessment
This is the process of combining the information you’ve gathered about assets, vulnerabilities, and controls to define a risk. There are many frameworks and approaches for this, but you’ll probably use some variation of this equation:

Risk = (threat x vulnerability (exploit likelihood x exploit impact) x asset value ) - security controls

Note: this is a very simplified formula analogy. Calculating probabilistic risks is not nearly this straightforward, much to everyone’s dismay.

Treatment
Once a risk has been assessed and analyzed, an organization will need to select treatment options:

Remediation: Implementing a control that fully or nearly fully fixes the underlying risk.
Example: You have identified a vulnerability on a server where critical assets are stored, and you apply a patch for that vulnerability.
Mitigation: Lessening the likelihood and/or impact of the risk, but not fixing it entirely.
Example: You have identified a vulnerability on a server where critical assets are stored, but instead of patching the vulnerability, you implement a firewall rule that only allows specific systems to communicate with the vulnerable service on the server.
Transference: Transferring the risk to another entity so your organization can recover from incurred costs of the risk being realized.
Example: You purchase insurance that will cover any losses that would be incurred if vulnerable systems are exploited. (Note: this should be used to supplement risk remediation and mitigation but not replace them altogether.)
Risk acceptance: Not fixing the risk. This is appropriate in cases where the risk is clearly low and the time and effort it takes to fix the risk costs more than the costs that would be incurred if the risk were to be realized.
Example: You have identified a vulnerability on a server but concluded that there is nothing sensitive on that server; it cannot be used as an entry point to access other critical assets, and a successful exploit of the vulnerability is very complex. As a result, you decide you do not need to spend time and resources to fix the vulnerability.
Risk avoidance: Removing all exposure to an identified risk
Example: You have identified servers with operating systems (OS) that are about to reach end-of-life and will no longer receive security patches from the OS creator. These servers process and store both sensitive and non-sensitive data. To avoid the risk of sensitive data being compromised, you quickly migrate that sensitive data to newer, patchable servers. The servers continue to run and process non-sensitive data while a plan is developed to decommission them and migrate non-sensitive data to other servers.

Communication
Regardless of how a risk is treated, the decision needs to be communicated within the organization. Stakeholders need to understand the costs of treating or not treating a risk and the rationale behind that decision. Responsibility and accountability needs to be clearly defined and associated with individuals and teams in the organization to ensure the right people are engaged at the right times in the process.

Rinse and Repeat
This is an ongoing process. If you chose a treatment plan that requires implementing a control, that control needs to be continuously monitored. You’re likely inserting this control into a system that is changing over time. Ports being opened, code being changed, and any number of other factors could cause your control to break down in the months or years following its initial implementation.

Security Architecture & Design Security Issues in Hardware

Security architecture and Design

• Security Architecture and Design of a system means a bundle of following components:-hardware, software and operating system and how to use those component to design, architect, and evaluate secure computer systems.

• Security Architecture and Design is a three-part domain.

1. The first part covers the hardware and software required to have a secure computer system

2. The second part covers the logical models required to keep the system secure

3. and the third part covers evaluation models that quantify how secure the system really is.

Secure System Design Concept

We can design a secure system by implementing software and hardware specifically and including following principles

– Layering

– Abstraction

– Security domains

– The ring model

– Open-closed systems

• Layering

Layering separates hardware and software functionality into modular tiers.

A generic list of security architecture layers is as follows :

1. Hardware (bottom layer)

2. Kernel and device drivers

3. Operating System

4. Applications (Top Layer)

• Abstraction: Abstraction hides unnecessary details from the user.

• Complexity is the enemy of security:

– the more complex a process is, the less secure it is. That said, computers are tremendously complex machines.

• Abstraction provides a way to manage that complexity.

– For example ,while music is being played from a file through the speaker of the computer system. The user is only concerned with playing of music just with click without knowing the internal working of music player.

Security Domains : A security domain is the list of objects a subject is allowed to access.

• With respect to kernels, two domains are user mode and kernel mode.

– Kernel mode (also known as supervisor mode) is where the kernel lives, allowing low-level access to memory, CPU, disk, etc. It is the most trusted and powerful part of the system.

– User mode is where user accounts and their processes live. The two domains are separated: an error or security lapse in user mode should not affect the kernel.

The Ring Model:

• The ring model is a form of CPU hardware layering that separates and protects domains (such as kernel mode and user mode) from each other.

• Many CPUs, such as the Intel 86 family, have four rings, ranging from ring 0 (kernel) to ring 3.

• The rings are (theoretically) used as follows:

Ring 0: Kernel

Ring 1: Other OS components that do not fit into ring 0

Ring 2: Device drivers

Ring 3: User applications

Open and Closed Systems:

• An open system uses open hardware and standards, using standard components from a variety of vendors.

– Ex - Assembled Desktop computer

• Close systems- only use proprietary hardware or software from specific vendor.

– Ex- Branded Desktop (HP)

Secure hardware architecture

• Secure Hardware Architecture focuses on the physical computer hardware required to have a secure system.

• The hardware must provide confidentiality, integrity, and availability for processes, data, and users.

Security issues in 1.hardware, 2.data storage and 3.downloadable device

• Securing computer system means to protect all of its components that includes

– hardware, software, storage devices, operating system and peripheral devices.

• Each component has its own vulnerability or weakness.

– Hardware parts can be stolen and destroyed .

• Security of every component of the system is equally important.

– We need to be able to control our computer system completely so that the information asset can be protected.

Security Issues in Hardware

• Hardware is the component on which the entire computer system is based this include processor, hard drive and monitor.

• Hardware mainly faces security issues related to stealing, destruction, gaining unauthorized access and breaking the security code of conduct.

• Any breaking of code of conduct needs proper security measures such as placing the hardware with your controlled environment.

Counter Security Measures in hardware To secure H/W from unauthorized access, following mechanism should be used-

• Biometric access control.

• Authentication token (entry via smart card).

• Radio Frequency Identification (RFID).

• Use VPN to provide complete security over internet.

• Use strong passwords.

• Provide limited access to the devices.

2. Security Issues with Storage Devices

• Data storage devices are used to save information.

• Devices such as compact disk(CD), digital versatile disk(DVD), memory cards, flash drives etc.

• The main issue faced by these devices is-

– Loss and theft of data.

– Improper disposal of data.

– Introduction to malwares in your system.

– Denial of data i.e., attack on availability of data.

• All these issues can be overcome by using following measures-

– Making people aware of the various kinds of attacks.

– Educating people regarding various cyber laws of the nation.

– Making the people understandable the importance of security.

– Implement certain policies and procedures that provide security for the storage devices and data.

2. Security Issues with Storage Devices

• E.g. PD-USB: PDA, External Hard Drive

• Security Issues related to them are-

– Stealing of data.

– Destruction of data.

– External attacks(virus etc.).

• Measures include:

– Protection of data from theft/ manipulation

– Protection of devices from being stolen or destroyed

– Protection of environment from undesired access.

Physical Security of IT Assets

• An IT asset is a piece of software or hardware within an information technology environment.

• Tracking of IT assets within an IT asset management system can be crucial to the operational or financial success of an enterprise.

• IT assets are integral components of the organization’s systems and network infrastructure.Security of data and asset is equally important.

• Physical security of our asset, especially the IT asset is also very important.

– There are several issues that need to be countered in order to apply total security control.

• We may need to lock and other access control techniques to protect our asset from unwanted users.

Physical Security of IT Assets(Threats)

• Threats for physical security are as follows:-

(1) Physical access exposure to human beings : Organizations own employees are one of the main factors to cause physical security threats.

• Can be controlled through

– strong authentication mechanism

– restricted use of resources

– restricted area and building

– Proper standards for verification and validation of user identity.

(2) Physical access exposure to natural disasters:- Natural disasters may destroy your computer systems or all data storage systems and might interrupt your network.

– for example fire, lightening, or electronic interruption

– Can’t be controlled, but recovery measures could be taken.

• Measures to ensure physical security of IT assets-

(1)Physical access controls

• Through photo IDs, biometric authentication systems, entry logs, magnetic locks using electronic keycard, computer terminal locks.

(2)Electronic and visual surveillance systems

• Through closed circuit television(CCTV), RFID sensors

• CCTV cameras are also called the third eye because if human being missed noticing some people entering a restricted zone, these cameras could capture the event or photos.

(3) Intrusion Detection Systems(IDS):-

IDS is a way of dealing with unauthorized access to information system assets.

Physical Security of IT Assets(Measures)

Backup Security Measures

• Following practices should be performed for maintaining proper data backup security-

– Assigning responsibility, authority and accountability.

– Assessing risks.

– Developing data protection processes.

– Communicating the processes to the concerning

people.

– Executing and testing the process.

1. Assign Accountability, Responsibility and Authority

• Make storage security a function of overall information security policies and architecture

• Divide duties where data is highly sensitive.

• ensure that the person authorizing access is not the person charged with responsibility for execution.

2. Assessing Risk

• Perform a Risk Analysis of the Entire Backup Process.

• Execute a Cost/Benefit Analysis on Backup Data Encryption

• Identify Sensitive Data.

3. Develop Data Protection Process

• Adopt a Multi-Layered Security Approach

. Authentication: Authorization: Encryption Auditing:

• Copy Your Backup Tapes

4. Communicating the processes to the concerning people

• it is important to ensure that the people responsible for carrying out its security are informed and trained.

• Security policies are the most important aspect of assigning accountability, responsibility and authority.

5. Executing and testing the process

• Once the end-to-end plan has been developed, defined and communicated to the appropriate people, it is time to begin execution and testing process.

Access Control

• Access Control is the process or mechanism for giving the authority to access the specific resources, applications and system.

• Access control defines a set of conditions or criteria to access the system and its resources.

• There are three main accesses Control model first is Mandatory access control model,second is Discretionary access control model and third is Role based access control models.

Types of Access control

• Mandatory access control (MAC) :

in this security policy users do not have the authority to override the policies and it totally controlled centrally by the security policy administrator.

The security policy administrator defines the usage of resources and their access policy, which cannot be overridden by the end users, and the policy, will decide who has authority to access the particular programs and files.

MAC is mostly used in a system where priority is based on confidentiality.

• Discretionary access control (DAC) :

This policy Contrast with Mandatory Access Control (MAC) which is determined by the system administrator while DAC policies are determined by the end user with permission.

In DAC, user has the complete authority over the all resources it owns.

and also determines the permissions for other users who have those resources and programs.

• Role-based access control (RBAC) :

This policy is very simple to use.

In RBAC roles are assigned by the system administrator statically. In which access is controlled depending on the roles that the users have in a system.

(RBAC) is mostly used to control the access to computer or network resources depending on the roles

of individual users within an organization.

Due to the static role assignment it does not have complexity. Therefore it needs the low attention for

maintenance.

A closed-circuit television camera can produce images or recordings for surveillance or other private purposes. Cameras can be either video cameras, or digital stills cameras. Walter Bruch was the inventor of the CCTV camera. The main purpose of a CCTV camera is to capture light and convert it into a video signal. Underpinning a CCTV camera is a CCD sensor (charge-coupled device). The CCD converts light into an electrical signal and then signal processing converts this electrical signal into a video signal that can be recorded or displayed on the screen

Data storage and downloadable devices

Data storage and downloadable devices are two important aspects of data management. Data storage refers to the physical or electronic media used to store data, while downloadable devices are devices that can be used to transfer data from one location to another.

There are many different types of data storage devices, including hard drives, solid-state drives (SSDs), optical discs (CDs, DVDs, and Blu-rays), and flash drives. Each type of device has its own advantages and disadvantages, such as capacity, speed, durability, and cost.

Downloadable devices include smartphones, tablets, laptops, and desktop computers. These devices can be used to download data from the internet, such as music, movies, software, and documents. They can also be used to transfer data between devices, such as transferring photos from a camera to a computer.

The choice of data storage device and downloadable device will depend on the specific needs of the user. For example, a user who needs to store a large amount of data may choose a hard drive, while a user who needs a portable device may choose a flash drive.

Here are some of the benefits of using data storage and downloadable devices:

Data security: Data storage devices can help to protect data from unauthorized access. For example, hard drives and SSDs can be encrypted to prevent unauthorized access to the data stored on them.
Data backup: Data storage devices can be used to backup data, which can help to protect data from loss in the event of a hardware failure or other disaster.
Data sharing: Data storage devices can be used to share data with others. For example, a user can share photos or documents with friends or family by transferring them to a flash drive or cloud storage.

Here are some of the risks associated with using data storage and downloadable devices:

Data loss: Data can be lost if a data storage device is damaged or lost.
Data corruption: Data can be corrupted if a data storage device is not properly formatted or if it is infected with a virus.
Data theft: Data can be stolen if a data storage device is lost or stolen.

It is important to take steps to protect data stored on data storage devices and downloadable devices. These steps include:

Encrypting data: Encrypting data can help to protect it from unauthorized access.
Backing up data: Backing up data can help to protect it from loss in the event of a hardware failure or other disaster.
Using strong passwords: Using strong passwords can help to protect data from unauthorized access.
Keeping data storage devices safe: Keeping data storage devices safe can help to protect them from damage, loss, or theft.

Data storage and downloadable devices are essential tools for data management. By understanding the benefits and risks of these devices, users can take steps to protect their data.

cctv :

What is CCTV?

CCTV stands for closed-circuit television. It is a system of video cameras that are used to transmit a signal to a specific place, on a limited set of monitors. CCTV systems are often used for security purposes, but they can also be used for other purposes, such as traffic monitoring or retail analytics.

How does CCTV work?

CCTV systems typically consist of three main components:

Video cameras: The cameras capture images of the area that is being monitored.
Recording devices: The recording devices store the images that are captured by the cameras.
Monitors: The monitors display the images that are captured by the cameras.

CCTV systems can be wired or wireless. Wired CCTV systems use cables to connect the cameras, recorders, and monitors. Wireless CCTV systems use radio waves to connect the cameras, recorders, and monitors.

Benefits of CCTV

CCTV systems offer a number of benefits, including:

Security: CCTV systems can help to deter crime and to identify criminals.
Safety: CCTV systems can help to keep people safe by providing a visual record of events.
Monitoring: CCTV systems can be used to monitor activities in a variety of settings, such as businesses, schools, and public areas.
Analytics: CCTV systems can be used to collect data about traffic patterns, customer behavior, and other activities.

Drawbacks of CCTV

CCTV systems also have some drawbacks, including:

Privacy concerns: Some people have concerns about the privacy implications of CCTV surveillance.
Cost: CCTV systems can be expensive to install and maintain.
Maintenance: CCTV systems require regular maintenance to ensure that they are working properly.

Backup security measures

Backup security measures are important to protect your data from unauthorized access, corruption, or loss. Here are some of the most important backup security measures to consider:

Use strong passwords and encryption: Your backup files should be encrypted with a strong password that you do not use for any other purpose. This will help to protect your data from unauthorized access.
Store your backups in a secure location: Your backup files should be stored in a secure location that is not accessible to unauthorized individuals. This could be a physical location, such as a safe or a locked cabinet, or a cloud-based storage service.
Encrypt your backup media: If you are using physical backup media, such as an external hard drive or a tape drive, you should encrypt the media with a strong password. This will help to protect your data from unauthorized access if the media is lost or stolen.
Rotate your backups: You should rotate your backups on a regular basis. This means that you should create new backups and delete old backups. This will help to protect your data from corruption or loss if one of your backups becomes corrupted or lost.
Test your backups regularly: You should test your backups regularly to make sure that they are working properly. This will help to ensure that you can restore your data if it is ever lost or corrupted.

By following these backup security measures, you can help to protect your data from unauthorized access, corruption, or loss.

Here are some additional backup security measures that you may want to consider:

Use a cloud-based backup service: Cloud-based backup services offer a number of security features, such as encryption, access control, and disaster recovery.
Use a backup software solution with security features: There are a number of backup software solutions that offer security features, such as encryption, access control, and auditing.
Keep your backup software up to date: Backup software vendors regularly release security updates. It is important to keep your backup software up to date to ensure that you are protected from the latest security threats.

*********************************************************************************************

*******************************************************************************

one solution

Saturday, May 7, 2022

AKTU MCA II SEMESTER " CYBER SECURITY " NOTES UNIT I II and III