Network Security Philosphy & Introduction Dr. Enis Karaarslan Muğla University Computer Engineering Department 4/30/15 Dr. Enis Karaarslan 1
4/30/15 Ar. Gör. Enis Karaaslan 2
SECURITY PHILOSPHY 4/30/15 Ar. Gör. Enis Karaaslan 3
Computer & Network Security has similarities with the security in normal life. 4/30/15 Ar. Gör. Enis Karaaslan 4
There is no such thing as %100 Security 4/30/15 Ar. Gör. Enis Karaaslan 5
Security at the gates only, is not enough 4/30/15 Ar. Gör. Enis Karaaslan 6
A chain is only as strong as its weakest link 4/30/15 Ar. Gör. Enis Karaaslan 7
As there is no %100 security … So give up? A possible solution: Use more than one chain 4/30/15 Ar. Gör. Enis Karaaslan 8
MULTI LAYER SECURITY 4/30/15 Ar. Gör. Enis Karaaslan 9
4/30/15 Ar. Gör. Enis Karaaslan 10
Security x Usability 4/30/15 Ar. Gör. Enis Karaaslan 11
Keep in mind that When Security measures increase, Usability decrease 4/30/15 Ar. Gör. Enis Karaaslan 12
Value of Assets and Expenditures ● What is the VALUE of your asset (data, prestige …)? ● Keep in mind that ● Security expenditures should not be greater than the value of the assets 4/30/15 Ar. Gör. Enis Karaaslan 13
Risk ... Smoking in the oil station … %99 percent nothing happens … %1 ... 4/30/15 Ar. Gör. Enis Karaaslan 14
Risk ...
It's discipline anyway … :)
Mitigate (azaltmak) Risk
Risk Analysis ● Risk analysis is essential ● If the risk is too low, that/some precaution(s) can be cancelled … 4/30/15 Ar. Gör. Enis Karaaslan 19
False Sense of Security A “false sense of security” is worse than “a true sense of insecurity”. Solution: Never think your system is secure. 4/30/15 Ar. Gör. Enis Karaaslan 20
No Template Which Suits All There is no templates which suits all. There is a different solution for different organizations • Different needs • Different assets 4/30/15 Ar. Gör. Enis Karaaslan 21
To win a war, one must know the way Sun Tzu The Art of War 4/30/15 Ar. Gör. Enis Karaaslan 22
Security is a process, not a product. Bruce Schneier 4/30/15 Ar. Gör. Enis Karaaslan 23
MONITOR The system should be monitored for intrusions And immediate action should be taken at attacks 4/30/15 Ar. Gör. Enis Karaaslan 24
Warn The Attacker 4/30/15 Ar. Gör. Enis Karaaslan 25
Network Awareness Know your enemy (?) Know yourself, • know your assets • know what to protect Know your systems more than the attacker 4/30/15 Ar. Gör. Enis Karaaslan 26
Eğer bu kadar kötü yazılım güvenliğine sahip olmasaydık, Bu kadar çok ağ güvenliğine ihtiyacımız olmayacaktı Bruce Schneier
(Web) Application Security ● Security by Design ● Secure coding ● And others ...
FUNDAMENTALS 4/30/15 Ar. Gör. Enis Karaaslan 29
Information System and Security ATTACK SECURITY ATTACKER MEASURES VULNERABILITY USERS INFORMATION SYSTEM
Vulnerable Systems The systems are vulnerable • Mainly because of bad coding • Must be patched (but can not be done rapidly as they should) • False sense of security 4/30/15 Ar. Gör. Enis Karaaslan 31
A vulnerability timeline …
The Attacker/Intruder The attacker can be called as: Lamer, intruder, attacker … (wrongly used as hacker also) Also secret organizations? Also companies (serious antivirus/defence economy) 4/30/15 Ar. Gör. Enis Karaaslan 33
Hacker /Lamer /Attacker … Hacker is used as attacker/lamer, in the meaning: The intruder, who gets in your system and intends to use for his/her own aims. 4/30/15 Ar. Gör. Enis Karaaslan 34
The Attacker The attackers strength is Dedication • Will not stop until he/she gets in • Can use the computer for days long sleepless • Knows the vulnerabilities of systems 4/30/15 Ar. Gör. Enis Karaaslan 35
4/30/15 Ar. Gör. Enis Karaaslan 36
Network Security Assets Network Security Overall • Network Awareness • Firewall, Intrusion Detection Systems … etc • More … Host (Computer/Server/NW Device) Security • Physical Security • OS and Application Security • User Management Encryption 4/30/15 Ar. Gör. Enis Karaaslan 37
Firewall 4/30/15 Ar. Gör. Enis Karaaslan 38
Firewall Basics Rule based access control between networks. Software/hardware based Architecture • Static Packet Filtering • Dynamic Packet Filtering (Statefull inspection) • Application Level Protection Logging and alert capabilities 4/30/15 Ar. Gör. Enis Karaaslan 39
Encryption Encryption is the conversion of data into a form, called a ciphertext, that cannot be easily understood by unauthorized people. (Encryption x Decryption) 4/30/15 Ar. Gör. Enis Karaaslan 40
Encryption Two different methods (according to key use) • Conventional– Two keys are the same • Asymetric – ( Public Key Encryption ) – Key pair (public, private) 4/30/15 Ar. Gör. Enis Karaaslan 41
Encryption To decyrpt an encrypted data • How much time? • How much Processing (Computing power)? The science which deals with encryption is Cryptology 4/30/15 Ar. Gör. Enis Karaaslan 42
END OF THE SESSION Dr. Enis Karaaslan enis.karaarslan@mu.edu.tr 4/30/15 Ar. Gör. Enis Karaaslan 43
Recommend
More recommend
