Introduction

1

Defining Security
• The security of a system, application, or protocol is always relative to
– A set of desired properties – An adversary with specific capabilities

• For example, standard file access permissions in Linux and Windows are not effective against an adversary who can boot from a CD

2

Security Goals
Integrity

• C.I.A.

Confidentiality

Availability

3

Confidentiality
• Confidentiality is the avoidance of the unauthorized disclosure of information.
– confidentiality involves the protection of data, providing access for those who are allowed to see it while disallowing others from learning anything about its content.

4

Tools for Confidentiality
• Encryption: the transformation of information using a secret, called an encryption key, so that the transformed information can only be read using another secret, called the decryption key (which may, in some cases, be the same as the encryption key).
Sender Communication channel Recipient

encrypt ciphertext p ain ex plaintext int

decrypt plaintext

shared secret key

shared secret key

Attacker (eavesdropping)
5

Tools for Confidentiality
• Access control: rules and policies that limit access to confidential information to those people and/or systems with a “need to know.”
– This need to know may be determined by identity, such as a person’s name or a computer’s serial number, or by a role that a person has, such as being a manager or a computer security specialist.

6

Tools for Confidentiality
• Authentication: the determination of the identity or role that someone has. This determination can be done in a number of different ways, but it is usually based on a combination of
– something the person has (like a smart card or a radio key fob storing secret keys), – something the person knows (like a password), – something the person is