main | links

Security notes

an introduction to computer security

 Last change: May 14, 2003 AD

Index:

Preface

        Once, when I got again one of the "virus alert" e-mails that incited me to delete one of the important system files, pretending that it was a virus, I found it necessary to explain to the sender (respectively 'forwarder') what a virus is and how to distinguish true virus alert from a hoax. Then I realized that most of my friends who use Internet know little or nothing about security and I decided to make this page as a brief overview of computer security especially with respect to Internet. The page is intended to be an entry point into the field of security for a novice and a reference for an experienced user. It covers number of topics with varying level of details. It is not supposed to be read all at once, from the beginning to the end. Instead, you can read only the parts interesting for you and skip the rest.
        I'm not a security expert and most of my knowledge comes from two courses I've taken and books and web pages I've read. So why do I write about security? Most on-line resources cover in depth one issue while this page is intended to be a superficial overview of a number of issues with links to the appropriate web sites to help you to find whatever you need to know. My knowledge is sufficient for such overview and, since I don't know too much, it should be understandable for those who are new to security. Please keep in mind that the information presented here are not 100% reliable; to be sure, refer to the linked pages written by security experts.

Introduction into Computer Security

What is security?

Quotation from an unknown author's dictionary:
Security
1. Mythological state of perfection, Heaven, Nirvana, Cloud Cuckoo Land, etc.
2. Ability to prove that whatever goes wrong is not your fault.
(end of quotation)


       In general terms, security could be defined as "the state of risking nothing important in the case an unwanted event happens". This definition is of course too general and even if we restrict ourselves to computer security, the set of 'unwanted events' is huge, including such diverse things like disk failure and disclosure of confidential information. Hence I'll write only about few of them, mostly about those that could be of interest for an ordinary curious Internet user. But you should keep in mind there is much more about security.

Computer security goals

Terms:

Threat
Any possible unwanted event.
Security service
A security service provides protection against a particular kind of threats.
Mechanism
A technique used to implement one or more security services.

The goals:

       There are four important security services, or goals, that you meet again and again, first three of them sometimes referred to as 'CIA':

Security layers

        A computer system may be seen as consisting of a number of layers with increasing level of abstraction and complexity: 


system layers  examples of services

application layer
Operating system (OS) layer
OS kernel layer
hardware layer

<-- e-mail client, browser
<-- file system operations
<-- basic I/O, processor scheduling
<-- processor, memory, I/O devices

        For security to be effective, it must be implemented on all these layer, for two reasons:

  1. low level (layer) doesn't allow for sophisticated solutions that are needed
  2. protection on a higher level can be easily bypassed on a lower level, unless it's also sufficiently protected

        But security is even more complicated than that and we have to add two new layers:


 

security layers  examples of protection

application layer security
Operating system (OS) security
OS kernel security
hardware security
physical security
human factor

<-- SSL, S/MIME, PGP
<-- access control
<-- privileged instructions
<-- normal vs. superuser mode
<-- lockable drive and keyboard
<-- security education

         Why are the two new layers important, even more important than the others? Because it doesn't matter how sophisticated access control system do you have, as long as anybody can come, take the hard disk with your confidential data and put it into his machine that will read it's content without asking the operating system. And even if you buy a special super secure door, it makes no change, as long as your employees do not lock it or give the key to anybody who asks. It's tempting to solve the human factor problem by issuing a set of rules, but don't fool yourself, everybody knows, that no strict rules help here. The more strict rules the higher frequency of their violations. The only thing you can do is to educate people, to explain why they have to behave in certain way and what are the risks when they fail to do so.

Threats

       There are many possible unwanted events, both intentional(virus attack) and unintentional(disk failure). The measures against intentional events prevent accidents as well (for example regularly made backup of all important files).

       I'll consider two sources of threats: human intruders and malicious software. Both of them do with your computer something you don't want - steal or destroy data, occupy disk space, or whatever else.

Viruses and Company

This is only a brief description, because many good on-line resources are available. Refer to the links section for more details.

Classification of Malicious Software


 

Viruses

        There are not always clear borders among different types of viruses, because a virus can combine several approaches together (e.g. it could have boot sector part and binary file infector part).

How to Get Infected


 

Virus vs. Anti-virus Software

What viruses do to hide (few examples):

What Anti-virus does to find them (few examples):

Extension tricks

Creators of viruses use several 'dirty tricks' with file extensions (.exe, .txt ...) to hide that it's an executable file.

  1. multiple extensions ( .exe -> .txt.exe )

    2. Instead of naming the file "myvirus.exe" they name it "myvirus.jpg.exe" (or perhaps "KOURNIKOVA.JPG.exe"). And since people read from left to right they see '.jpg' first and click on it. In Windows Explorer, file extensions of known types are hidden by default. Hence the last extension is hidden and you see only "kournikova.jpg" which seems to be quite innocent (though you could be warned by the fact that it has the icon of an executable file). For more information see CERT article.
  2. false extensions ( .exe -> .txt )

    3. Some operating systems (UNIX, for instance) do not distinguish files according to their extension, but according to some other attributes. You can name an executable however you want, for example "readme.txt", it will stay executable.

Intruders and Hackers

I'll mention this issue only briefly, though it's very interesting too.

       A malicious person can either penetrate a system - an intruder - or enter into communication between two parties (for example observe or disturb it). Intruder is a person that does in you system something he is not allowed to do. An intruder can pretend to be somebody else (use account of another user), try to acquire higher privileges than he's authorized to, or acquire administrator (superuser) privileges to suppress the collection of log information or to change them. It's noteworthy that most intruders are internal ones, for instance an employee that seeks higher privileges to be able to use director's printer or to hide his on-line activity.
        It should be  mentioned that individuals are not the only ones who can misuse computer systems and particularly Internet. There are many great opportunities for organized crime as well. And since mafias and the like have rich resources, they are much more dangerous than individuals (they can hire hackers, bad guys with guns, corrupt employees and so on). The keyword here is 'organized'. With the power of organization and co-operation you can do much - that's actually how the humans conquered the Earth. Imagine a virus that infects a bank (thanks to a corrupted employee), creating a trap door; a group of hacker uses the trap door to shut down the on-line bank server, while another group puts up a faked copy of the on-line bank. For few hours, customers entrust their confident data to this faked bank. Consequently, their accounts are robbed and some of them are blackmailed.

Some of the techniques used by intruders:

Some of the techniques used against intruders:

Links

Sections: general | cryptography |

General

Cryptology and related technologies

Viruses, worms and the like

Glossaries


 

Other


 

Bibliography

1. on-line resources mentioned in "Links" section.
2. course "Computer Security" given by Viiveke Fåk at ISY department of the Linkopings Universitet, Sweden; fall term 2001
3. course "Cryptology" given by Viiveke Fåk at ISY department of the Linkopings Universitet, Sweden; fall term 2001
4. Stallings, W: "Network Security Essentials: Applications and Standards" New Jersey: Prentice-Hall, Inc., 2000.

Notes:

"There are many Mail User Agents and each has many features, some even useful. " -Larry Rogers-


Jakub Holy 2002 AD