LAB 2 - The goals of information technology security

During this lab, we need to do 4 tasks which is:

Task 1-Using NTFS to Secure Local Resources
Task 2- Data Confidentiality
Task 3- Data Availibility
Task 4- Data Integrity

Basically, in this lab we learn how to determine if the partition is NTFS or FAT32. Besides that, we also learn how to implement confidentiality, availability and integrity in Windows Server 2003.

TASK 1- Using NTFS to Secure Local Resources.

1. Open your winserv03 virtual machine
2. Log on to the Windows 2003 server as Administrator.
3. Click [Start].
4. Click [Run].
5. Type cmd to invoke the command line. (The FAT partition in
this lab will be designated as drive letter D.)
6. At the command line type chkntfs d: to verify that the drive
is not using NTFS. You will see the m7. To convert a FAT disk to NTFS you need to type at the
command line convert d: /fs:ntfs
7. If the drive has a volume label, enter it when prompted.
Windows will then convert the drive to NTFS. Note: If you
convert the system partition you will have to reboot for the
conversion to take place.
8. At the command line type chkntfs d: to verify that the drive
is now NTFS.essage, “D: is not
9. Close all Windows and log off.

TASK 2::Data Confidentiality.

Once a secure file system is installed, you can begin to think about
data confidentiality. Data confidentiality refers to making sure that
only those intended to have access to certain data actually have
that access. With the FAT file system, this is not possible at the
local level, but with NTFS you can lock down both folders and files
locally. NTFS can be used to protect data from intruders who may
have physical access to the computer containing the data. In this
lab, you will create a folder and files, assign NTFS permissions,
then verify whether or not the data is confidential.

Creating user account
1. Two user-level accounts: User1 and User2
a. To create user account go to [Start] |
[Administrative Tools] | [Computer Management].
b. Choose [Local User and Groups] and double click
on the [user] folder.
c. To create new user right click on the pane and from
the pop-up menu choose [New User] and fill up the
necessary information such as username and
password (use easy to remember password e.g.
abc123)



LAB 1- Introduction to Virtualization and VMware

During lab 1 session, we are introducing to VMware workstation and need to install VMware.But, of course the first thing that we must understand is the meaning of the VIRTUALIZATION. What is virtualization?Virtualization mean the creation of the a virtual of something, such as an operating system, a server, a storage devices or network resources. (http://searchservervirtualization.techtarget.com)

Virtual Machine can be defined as an efficient and isolated duplicate of real machine. This environment is created by using Virtual Machine Monitor which provide a second layer on a machine for another operating system which it run on.


VMware Workstation make it possible for PC user to use Multiple Operating System Concurrently on the same PC. User can create and run multiple virtual machine on desktop or laptop computer. It also let us create virtual machine and installed any different type of operating system.

VMware Workstation installation

This is simple step by step on how to install VMware Workstation:

1.Download VMware Workstation from http://www.vmware.com/download/ws/. Then, double click the VMware launcher to start the installation wizards.

2. Click NEXT and choose Typical setup type

3. Choose the location for VMware Workstation installation. Then, click NEXT

4. Configure the shortcuts for the VMware Workstation and click NEXT

5. Click INSTALL. This will take several minutes to finish

6. Enter the serial number for the VMware Workstation.

7. Click FINISH and restart the computer.

LECTURE 2 : Basic Cryptograpy

This lecture will cover about the cryptography concept, cryptography algorithms, Monoalphabetic, Polyalpabetic and Transposition

CRYPTOGRAPHY CONCEPT

Basically, cryptography concept is about the idea of a cipher system which is to distinguish information in such a way that its meaning is unintelligible to an unauthorized person..or in Malay..satu system yg digunakan untuk membezakan maklumat yg ingin disampaikan supaya maklumat tersebut tidak boleh dibaca oleh orang yg tidak berkenaan..(lebih kurang cam 2 ler mksudnye..=))

The concept of cryptography or we can say the art of secret writing can be divided into 2 types which are

  • Steganography
- hiding messages
- Message does not changed
- Does not involve key
  • Cryptography
- scrambling messages
- messages changes
- does involve key


SECURITY TOOLS

The earliest information is encrypt using scytale
On the World War II a machine call enigma machine is used as a mechanical crypto machine.

CRYPTOGRAPHY TERMINOLOGY

  • plaintext- original message
  • cipher text - coded message
  • cipher - algorithm for transforming plaintext to ciphertext
  • key - info used in cipherknown only to sender/receiver
  • encipher - converting plaintext to ciphertext
  • decipher - recovering ciphertext from plaintext
  • cryptography - study of encryption principle/method
  • cryptanalysis - study of principles/method of deciphering ciphertext without knowing key
  • cryptology - field of cryptography + cryptanalysis

CRYPTOGRAPHY ALGORITHMS

Three independent dimension:

  • The number of key used
- symmetric or asymmetric??

  • The type of operations used for transforming plaintext to ciphertext
- substitution?? or transposition?? or product..

  • The way in which the plaintext is processed
- block or stream??





LECTURE 1 : Introduction to Information Security

Before we go further, lets check out what is the meaning of SECURITY!!!!!

SECURITY = Quality or state of being secure that is to be free from danger & to be protected from adversaries

3 SECURITY AREA which are D.P.R:

D- Detection. Example tool is scanner
P- Prevention. Example tools are Firewall, proxy
R- Recovery. Example tool is cryptography



SECURITY ARCHITECTURE


- Defined by ITU-T Recommendation X.800 that called OSI security Architecture.

- Useful to manager as a way of organizing the task of providing security.
- It was developed as an international standard, computer and communication vendors have developed security features for their products and services that relate to the structured definition of services and mechanisms.
- Focus on security attacks, security mechanisms and security services.




3 SECURITY PRINCIPLES which are C.I.A:

C- Confidentiality
I- Integrity
A- Availability

SECURITY POLICY = Set of rules to apply to security relevant activities in a security domain. There are THREE level of security which are Objectives, Organizational and System.


2 type of SECURITY ATTACKS:

Passive Attack - Monitoring the transmission

Category : Release of message content and traffic analysis


Active Attack - involved modification of the data

Category : masquerade, replay, Denial of Services (DoS)


METHODS OF DEFENSE:

Prevent - by block or close the attack
Deter - making the attack harder
Deflect - making another target more effective
Recover - from effects

Methods of defense in control are including encryption, software control,hardware control, policies and physical control. The definition of encrytion of ENCRYPTION is the formal name for scrambling data so that interpretation is meaningless without the intruder’s knowing how the scrambling was done.Furthermore, encryption is the basis of protocols that enable us to provide security while accomplishing an important system or network task. It clearly addresses the need for confidentiality data and can be used to ensure integrity.

Software Controls can be divided into Internal Program Control, OS and Network Sytem Control, Independent Control and Development Control.

Hardware Controls are the hardware devices used in providing the computer security. For examples smart card implementations of encryption, lock or cable limiting access, Firewall, Intrusion detection systems and many more...:-)

Besides software and hardware control, Policies and Procedure Controls are very important to support the importance of security policy and ensure their proper use.

"Controls must be used and used properly to be effective". Basically, there are several aspect that need to be considered when enhance the effectiveness of controls such as awareness of the problems, probability of use overlapping controls and periodic review.


SECURITY SERVICES



Here are some definition of the security services that are defined from X.800 and also RFC 2828

X.800: A security service as a service provided by a protocol layer of communicating open systems which ensure adequate security of the systems or of data transfers.
Service that is provided by a system to give a specific kind of protection to system resources where security services implement security policies and are implemented by security mechanisms.


Authentication

Access Control

Data Confidentiality

Data Integrity

Non-repudiation



Authentication


Authentication is an assurance that the communicating entity is the one claimed. It has 2 specific services which are peer entity authentication and data origin authentication.


Access Control


Access control is the prevention of the unauthorized use of a resource. It specific service is to prevent and authorized use of a resource.


Data Confidentiality

Data confidentiality is the protection of data from unauthorized disclosure. It specific service are connection confidentiality, connectionless confidentility, selective-field confidentiality and traffic flow confidentiality.



Data Integrity

Data integrity is assurance that data received is as sent by an authorized entity. It have 5 specific services which are Connection Integrity with Recovery, Connection Integrity without Recovery,Selective-field Connection Integrity, Connectionless Integrity and Selective-field Connectionless Integrity.


Non-Repudiation

Non-repudiation is a protection against denial by one of the parties in a communication.There are 2 specific services which are Nonrepudiation, Origin and Nonrepudiation, Destination.


SECURITY MECHANISMS

Security mechanisms is any process that is designed to detect, prevent or recover from security attack. It is defined by X.800 to provide and support security services.

This mechanisms can be divided into 2 classes which are:

1. Specific Security Mechanisms


  • Authentication exchange
  • Data integrity
  • Encipherment
  • Traffic padding
  • Access control
  • Digital signature
  • Natarization
  • Routing Control


2. Pervasive Security Mechanisms


  • Trusted functionality
  • Security recovery
  • Security label
  • Security audit trait
  • Event detection

 

©2009 W0rLD of CoMputer ScieNce | by TNB