Lecture 8 Flashcards
objectives of cyber ware are
1) cripple infrastructure
2) disrupt and confuse institutions and population
3) embarrass and punish agencies, firms and people
4) gather information to be used later
what is cybersecurity
Cybersecurity is the body of technoligies, processes and practices designed to protect networks, computers, programs and data from attack, damage or unauthorized access
Main purpose is the preservation of confidentiality, integrity and available information
Dimensions of cyber security
Integrity
nonrepudiation
Authenticity
Confidenciality
privary
Availability
Integrity (Dimensions of cyber security)
Has information transmitted or received been altered
Nonrepudiation (Dimensions of cyber security)
Can a party to an action with me later deny taking the action
Authenticity (Dimensions of cyber security)
Who am I dealing with? How can I be assured that the person or entity is who they claim to be
Confidentiality (Dimensions of cyber security)
Can someone other than the intended recipient read my messages
Privacy (Dimensions of cyber security)
Can I control the use of information about myself transmitted to an e-commerce merchant
Availability (Dimensions of cyber security)
Can I get access to the site?
Tension between security and other values
Security versus ease of use
erasing all private regulations versus clicking accept all cookies and trusting that others will do and signal you if not ok
Ministry of internal affairs
Internet must be safe and secure for everyone
Ministry of justice
Internet and messaging and dark web must be open for legal investigation
Good e-commerce security is based on three types of measures
1) technology solution
2) organizational policies (NIST)
3) Laws and industry standards
Most common security threats in the E-commerce environment
Malicious code (virus, trojans etc)
Potentially unwanted programs
Phishing (Deceptive online attempt to obtain information) (scams)
Hacking
Data breach
Credit card fraud
Identity fraud
Spoofing (misrepresenting in email)
Sniffing (man in the middle atacks)
Denial of service attack (DDoS)
ETC
What can firms do to prevent cyber attacks
Firewall
Encryption
network security
Virtual privat networks
Authentication procedures
Proxy servers
Anti-virus software
Automated software updates
Intrusion detection/preventions
Technology solution 1: public key cryptography
1) sender creates a digital message
2) sender obtains the recipients pulbic key
3) Application of the recipeints key is used to produce and encrypt messages
4) Encrypted message is sent over the internet using the TCP ip protocols
5) the recipient softwware uses recipients private key to decipher the message
Technology solution 2: public key cryptography: with signatures
1) sender creates a digital message
2) Sender applies a hash function producing a 128 bit hash result
3) sender obtains the recipients public key
4) recipients key is used to produce and ecnrypted message from the message and the hash result (double)
5) encrypted message is sent over the internet (using the TCP.IP protocols described in chapter 3)
6) Receiver uses the public key of the sender to decipher the message
7) The recipient (software) uses a private key to decipher the message and the hash function
8) The recipient (software) checks to ensure that the message and the hash math
Digital envelope
A technique that uses symmetric encryption
Digital certificate
A digital document (issued by a certification authority) that contains a variety of identifying information
The certificat ensures you to know that the other party is the one he says he is
Certificat authority
A trusted third party that issues digital certificates
Public key infrastructure
Certification authorities and digital certificates that are accepted by all parties
secure negotiated session using SSL and TLS (transaction layer security) You can use such sessions to buy and pay for stuff online
1) session ID and methods of encrypted negotiation
2) Certificates exchanged. identify both parties established
3) Client generates session key and uses server public key to create digital envelope. Sends to server. Server decrypts using private key
4) Encryped transmission using client generated session key begins
Virtual private networks
Allows remote users to securely access internal networks
Firewalls
Hardware or software that filters communication packets based on a security policy)
Proxy servers
A security server that handles all communication from and to the internet
