Chapter 7: Security in pervasive systems Flashcards
What is Information Systems Security?
- Processes and methodologies to protect information and information systems against unauthorized access
- It is essentially risk management
How can you manage the risk of information systems?
Risk = Probability x Impact
Probability: f(threats, vulnerabilities)
Impact: f(assets)
Asset: anything that could be of value
Threat: Potential danger to information life cycle
Vulnerability: Weakness that provides an opportunity for a threat to be exploited
What countermeasures / safeguards are available to mitigate potential risks?
- Administrative, operational or logical measures
Is there a perfect security?
- No because with enough time and resources every security technology is breakable
How can you determine Good Enough Security
- you need to find the minimum cost between cost for security enhancing mechanisms and expected total cost for violations
- At a certain point towards 100 % security, the costs for security mechanisms increase exponentially
What are the components of security
- Security Services
- Security mechanisms
Explain Security Services
A service that enhances the security of the information systems. Uses one or more security mechanisms CIA - Confidentiality - Integrity - Availability - Authentication
Explain Security mechanisms
Mechanism designed to prevent or recover from a security attack
- Encryption
- Hashing
- Digital Signatures
- Passwords
What means confidentiality?
Ensuring that only authorized principals can read the information
Threat: Disclosure
Security Mechanism: Encryption
What is encryption?
A transformation of plain text to cypher text
Decryption is the reverse transformation into plain text
How does the Caesar encryption work?
Encryption + 3 letters shift in the alphabet
Decryption - 3 letters shift in the alphabet
Hallo -> KDOOR
How does a symmetric cryptography work in general?
Message Source P ->
Encryption Algorithm E -> C=E(K,P)
Decryption Algorithm D -> P=D(K,C)
C= Cypher Text P = Plain Text K = Key
Algorithms are public; security due to secrecy of the key, same key for encryption and decryption
What are potential methods to attack encrypted data?
Brute Force: Try all possible decryption key until finding the correct one
Cryptanalysis: Analyze information of the cryptosystem to reduce the space of possible decryption keys
Why do we need (public key) asymmetric cryptography
- Modern encryption algorithms are computationally secure (brute-force is computationally unfeasible)
- Key distribution must be secure
-> Public key (asymmetric) cryptography allows to exchange keys over an insecure channel
How does (public key) asymmetric cryptography work?
Two keys per user:
- Public key can be distributed over insecure channels
- Private key is kept secret
1) Encrypt plain text with receivers public key
2) Transmit cryphertext
3) Receiver decrypts the text using its private key to obtain plain text
