Network security - OSI Security Architecture
- 2. What is a Network? Network Security The OSI Security Architecture Security Attacks Security Services Security Mechanism A model for Network Security
- 3. A network is a collection of computers, servers, mainframes, network devices, peripherals, or other devices connected to one another to allow the sharing of data. For example, network is the Internet, which connects millions of people all over the world
- 4. Network security is a broad term that covers a multitude of technologies, devices and processes. A set of rules and configurations designed to protect the integrity, confidentiality and accessibility of computer networks and data using both software and hardware technologies.
- 5. The OSI Architecture is useful to managers as a way of organizing the task of providing security. The OSI security architecture focuses on security attacks, mechanisms,and services.
- 6. Security attack: Any action that compromises the security of information owned by an organization. Security mechanism: A process (or a device incorporating such a process) that is designed to detect, prevent, or recover from a security attack. Security service: A processing or communication service that enhances the security of the data processing systems and the information transfers of an organization.The services are intended to counter security attacks, and they make use of one or more security mechanisms to provide the service.
- 8. A passive attack attempts to learn or make use of information from the system but does not affect system resources. An active attack attempts to alter system resources or affect their operation.
- 9. Passive attacks are in the nature of eavesdropping on, or monitoring of, transmissions. The goal of the opponent is to obtain information that is being transmitted. Two types of passive attacks are : Release Of Message Contents Traffic Analysis. The release of message contents is easily understood. A telephone conversation, an electronic mail message, and a transferred file may contain sensitive or confidential information traffic analysis, is subtler. Suppose that we had a way of masking the contents of messages or other information traffic so that opponents, even if they captured the message, could not extract the information from the message.
- 11. Active attacks involve some modification of the data stream or the creation of a false stream It can be subdivided into four categories masquerade replay, modification of messages and denial of service. A masquerade takes place when one entity pretends to be a different entity. Replay involves the passive capture of a data unit and its subsequent retransmission to produce an unauthorized effect Modification of messages simply means that some portion of a legitimate message is altered, or that messages are delayed or reordered, to produce an unauthorized effect The denial of service prevents or inhibits the normal use or management of communications facilities
- 17. A processing or communication service that enhances the security of the data processing systems and the information transfers of an organization. These services are intended to counter security attacks, and they make use of one or more security mechanisms to provide the service.
- 18. Authentication: The assurance that the communicating entity is the one that it claims to be. Peer Entity Authentication: Used in association with a logical connection to provide confidence in the identity of the entities connected. Data-Origin Authentication: In a connectionless transfer, provides assurance that the source of received data is as claimed. Data Confidentiality: Protects data from unauthorized disclosure. Access Control: The prevention of unauthorized use of a resource (i.e., this service controls who can have access to a resource, under what conditions access can occur, and what those accessing the resource are allowed to do). Data Integrity: The assurance that data received are exactly as sent by an authorized entity (i.e., contain no modification, insertion, deletion, or replay). Non-repudiation: Protects against denial by one of the entities involved in a communication of having participated in all or part of the communication. Proof of Origin: Proof that the message was sent by the specified party. Proof of Delivery: Proof that the message was received by the specified party.
- 20. A reversible encipherment mechanism is simply an encryption algorithm that allows data to be encrypted and subsequently decrypted. Irreversible encipherment mechanisms include hash algorithms and message authentication codes, which are used in digital signature and message authentication applications.
- 22. A model for Network Security
- 23. A security-related transformation on the information to be sent. Examples include the encryption of the message, which scrambles the message so that it is unreadable by the opponent, and the addition of a code based on the contents of the message, which can be used to verify the identity of the sender. Some secret information shared by the two principals and, it is hoped, unknown to the opponent. An example is an encryption key used in conjunction with the transformation to scramble the message before transmission and unscramble it on reception
- 25. A trusted third party may be needed to achieve secure transmission. For example, a third party may be responsible for distributing the secret information to the two principals while keeping it from any opponent. This general model shows that there are four basic tasks in designing a particular security service: 1. Design an algorithm for performing the security-related transformation.The algorithm should be such that an opponent cannot defeat its purpose. 2. Generate the secret information to be used with the algorithm. 3. Develop methods for the distribution and sharing of the secret information. 4. Specify a protocol to be used by the two principals that makes use of the security algorithm and the secret information to achieve a particular security service.
- 26. Another type of unwanted access is the placement in a computer system of logic that exploits vulnerabilities in the system and that can affect application pro-grams as well as utility programs, such as editors and compilers. Programs can pre-sent two kinds of threats: Information access threats: Intercept or modify data on behalf of users who should not have access to that data. Service threats: Exploit service flaws in computers to inhibit use by legitimate users.