An Overview of Information Security and Cryptography
๐
Computer security ๐
What is computer security?
Protection provided by an automated information system to preserve the integrity, availability, and confidentiality of information. Protected resources: Hardware, software, firmware, information and data, and communication networks.
- The CIA triad
- Confidentiality.
- Integrity.
- Availability.
- Additional requirements: Authenticity and accountability.
Types of vulnerabilities, attacks, and countermeasures ๐
- Vulnerabilities
- Corruption: Loss of integrity.
- Disclosure: Loss of confidentiality.
- Unavailability or extreme slowness: Loss of availability.
- Attacks
- Passive vs. active attacks.
- Insider vs. external attacks.
- Countermeasures
- Prevention, detection, and recovery.
Attack surface ๐
Every path through which an attacker may attempt an attack.
Examples include networks, software, and people.
Computer security strategy ๐
- Security policy: The rules and practices specifying how a system or organization provides services to protect sensitive and important system resources.
- Security implementation: Processes such as prevention, detection, response, and recovery.
- Security assurance: Confidence in how effectively security measures protect a system and its information as intended.
- Security evaluation: The process of examining a computer product or system against specified criteria.