Chapter 3 security principals
- 1. INFORMATION SYSTEM SECURITY Jupriyadi, S.Kom. M.T. jupriyadi@teknokrat.ac.id Bandarlampung, Juli 2021 Chapter 3
- 2. Security Principals Authentication Authorization or Access Control Privacy / Confidentiality Integrity Availability Non-repudiation Auditing
- 3. Authentication Stating that the data or information used or provided by the user is the person's original Countermeasure: Using Digital signature
- 4. Authentication Authentication is used by a server when the server needs to know exactly who is accessing their information or site. Authentication is used by a client when the client needs to know that the server is system it claims to be. In authentication, the user or computer has to prove its identity to the server or client. Usually, authentication by a server entails the use of a user name and password. Other ways to authenticate can be through cards, retina scans, voice recognition, and fingerprints. Authentication by a client usually involves the server giving a certificate to the client in which a trusted third party. Authentication does not determine what tasks the individual can do or what files the individual can see. Authentication merely identifies and verifies who the person or system is.
- 5. Three Schemes Authentication • Password Something you know • ID Card Something you have • Finger Prints Something you are
- 6. Authorization or Access Control Setting who can do what, or from where to where. Can use the mechanisms of user / password or other mechanism Example: ACL on Proxy Server
- 7. Authorization or Access Control Authorization is a process by which a server determines if the client has permission to use a resource or access a file. Authorization is usually coupled with authentication so that the server has some concept of who the client is that is requesting access. The type of authentication required for authorization may vary; passwords may be required in some cases but not in others. In some cases, there is no authorization; any user may be use a resource or access a file simply by asking for it. Most of the web pages on the Internet require no authentication or authorization.
- 8. Privacy/Confidentiality Security of personal data, messages or other sensitive information Countermeasure: Using encryption
- 9. Integrity Information or messages that are kept unchanged or changed.
- 10. Availability The availability of information security services. Countermeasure : Firewall and router filtering, backup and redundancy, IDS and IPS
- 11. Non-repudiation Keeping that if it is done online transactions or activities, it can not be disclaimed
- 12. Auditing The existence of the file records data communications that occur on the network for auditing purposes such as identifying attacks on the network or server Implementation : Using System Logging
- 13. Basic Terminology Threats natural threats unintentional threats intentional threats Vulnerabilities weakness in the design Configuration implementation Risk Attacks
- 14. What's Next ?