Network Security Philosphy & Introduction Dr. Enis Karaarslan - PowerPoint PPT Presentation

Network Security Philosphy & Introduction Dr. Enis Karaarslan Muğla University Computer Engineering Department 4/30/15 Dr. Enis Karaarslan 1

4/30/15 Ar. Gör. Enis Karaaslan 2

SECURITY PHILOSPHY 4/30/15 Ar. Gör. Enis Karaaslan 3

 Computer & Network Security has similarities with the security in normal life. 4/30/15 Ar. Gör. Enis Karaaslan 4

There is no such thing as %100 Security 4/30/15 Ar. Gör. Enis Karaaslan 5

Security at the gates only, is not enough 4/30/15 Ar. Gör. Enis Karaaslan 6

A chain is only as strong as its weakest link 4/30/15 Ar. Gör. Enis Karaaslan 7

As there is no %100 security … So give up? A possible solution: Use more than one chain 4/30/15 Ar. Gör. Enis Karaaslan 8

MULTI LAYER SECURITY 4/30/15 Ar. Gör. Enis Karaaslan 9

4/30/15 Ar. Gör. Enis Karaaslan 10

Security x Usability 4/30/15 Ar. Gör. Enis Karaaslan 11

 Keep in mind that  When Security measures increase,  Usability decrease 4/30/15 Ar. Gör. Enis Karaaslan 12

Value of Assets and Expenditures ● What is the VALUE of your asset (data, prestige …)? ● Keep in mind that ● Security expenditures should not be greater than the value of the assets 4/30/15 Ar. Gör. Enis Karaaslan 13

Risk ... Smoking in the oil station … %99 percent nothing happens … %1 ... 4/30/15 Ar. Gör. Enis Karaaslan 14

Risk ...

It's discipline anyway … :)

Mitigate (azaltmak) Risk

Risk Analysis ● Risk analysis is essential ● If the risk is too low, that/some precaution(s) can be cancelled … 4/30/15 Ar. Gör. Enis Karaaslan 19

False Sense of Security  A “false sense of security” is worse than “a true sense of insecurity”.  Solution: Never think your system is secure. 4/30/15 Ar. Gör. Enis Karaaslan 20

No Template Which Suits All  There is no templates which suits all.  There is a different solution for different organizations • Different needs • Different assets 4/30/15 Ar. Gör. Enis Karaaslan 21

To win a war, one must know the way Sun Tzu The Art of War 4/30/15 Ar. Gör. Enis Karaaslan 22

Security is a process, not a product. Bruce Schneier 4/30/15 Ar. Gör. Enis Karaaslan 23

MONITOR  The system should be monitored for intrusions  And immediate action should be taken at attacks 4/30/15 Ar. Gör. Enis Karaaslan 24

Warn The Attacker 4/30/15 Ar. Gör. Enis Karaaslan 25

Network Awareness  Know your enemy (?)  Know yourself, • know your assets • know what to protect  Know your systems more than the attacker 4/30/15 Ar. Gör. Enis Karaaslan 26

Eğer bu kadar kötü yazılım güvenliğine sahip olmasaydık, Bu kadar çok ağ güvenliğine ihtiyacımız olmayacaktı Bruce Schneier

(Web) Application Security ● Security by Design ● Secure coding ● And others ...

FUNDAMENTALS 4/30/15 Ar. Gör. Enis Karaaslan 29

Information System and Security ATTACK SECURITY ATTACKER MEASURES VULNERABILITY USERS INFORMATION SYSTEM

Vulnerable Systems  The systems are vulnerable • Mainly because of bad coding • Must be patched (but can not be done rapidly as they should) • False sense of security 4/30/15 Ar. Gör. Enis Karaaslan 31

A vulnerability timeline …

The Attacker/Intruder  The attacker can be called as: Lamer, intruder, attacker … (wrongly used as hacker also)  Also secret organizations?  Also companies (serious antivirus/defence economy) 4/30/15 Ar. Gör. Enis Karaaslan 33

Hacker /Lamer /Attacker … Hacker is used as attacker/lamer, in the meaning: The intruder, who gets in your system and intends to use for his/her own aims. 4/30/15 Ar. Gör. Enis Karaaslan 34

The Attacker  The attackers strength is Dedication • Will not stop until he/she gets in • Can use the computer for days long sleepless • Knows the vulnerabilities of systems 4/30/15 Ar. Gör. Enis Karaaslan 35

4/30/15 Ar. Gör. Enis Karaaslan 36

Network Security Assets  Network Security Overall • Network Awareness • Firewall, Intrusion Detection Systems … etc • More …  Host (Computer/Server/NW Device) Security • Physical Security • OS and Application Security • User Management  Encryption 4/30/15 Ar. Gör. Enis Karaaslan 37

Firewall 4/30/15 Ar. Gör. Enis Karaaslan 38

Firewall Basics  Rule based access control between networks.  Software/hardware based  Architecture • Static Packet Filtering • Dynamic Packet Filtering (Statefull inspection) • Application Level Protection  Logging and alert capabilities 4/30/15 Ar. Gör. Enis Karaaslan 39

Encryption  Encryption is the conversion of data into a form, called a ciphertext, that cannot be easily understood by unauthorized people. (Encryption x Decryption) 4/30/15 Ar. Gör. Enis Karaaslan 40

Encryption  Two different methods (according to key use) • Conventional– Two keys are the same • Asymetric – ( Public Key Encryption ) – Key pair (public, private) 4/30/15 Ar. Gör. Enis Karaaslan 41

Encryption  To decyrpt an encrypted data • How much time? • How much Processing (Computing power)?  The science which deals with encryption is Cryptology 4/30/15 Ar. Gör. Enis Karaaslan 42

END OF THE SESSION Dr. Enis Karaaslan enis.karaarslan@mu.edu.tr 4/30/15 Ar. Gör. Enis Karaaslan 43