Unit I: Overview of Computer Security [4 Hours]
This unit lays the foundation for everything in computer security. It defines core concepts, distinguishes the three security domains, maps out what attackers target and how, and establishes the principles every secure system is designed around. Expect definitions, CIA triad questions, attack classifications, and design principles to appear in both short-answer and long-answer sections.
1.1 Computer Security Concepts
Core Definition
Computer security is the protection of computer systems and the information they store, process, and transmit from unauthorized access, disclosure, alteration, disruption, or destruction, while ensuring that authorized users can access resources without interference.
Think of it as locking your digital house: you want to keep strangers out, make sure no one quietly changes your furniture, and make sure you can still get in whenever you need to.
Detailed Explanation
Computer security addresses three fundamental goals, known as the CIA Triad:
- Confidentiality — Information is only accessible to those who are authorized. Examples: encrypted files, access-controlled databases.
- Integrity — Information remains accurate and unmodified unless changed by an authorized process. Examples: checksums, digital signatures.
- Availability — Systems and data are accessible to authorized users when needed. Examples: uptime guarantees, DDoS protection.
Beyond the triad, two additional concepts appear frequently:
- Authenticity — Verifying that a user, message, or resource is genuine. Achieved through passwords, certificates, and biometrics.
- Accountability (Non-repudiation) — Ensuring that actions or transactions can be traced to a responsible party, so no one can later deny what they did.
Several foundational terms are used throughout the subject:
- Vulnerability — A weakness in a system that can be exploited.
- Threat — A potential event or actor that could exploit a vulnerability to cause harm.
- Attack — An actual attempt to exploit a vulnerability.
- Countermeasure (Control) — A safeguard put in place to reduce a vulnerability or block a threat.
- Risk — The likelihood and potential impact of a threat exploiting a vulnerability.
Let's Break It Down
Picture a bank. The vault is the asset. A weak lock is a vulnerability. A robber is a threat. An actual robbery attempt is an attack. The security guard and alarm system are countermeasures. The probability that the robbery succeeds and how much cash is lost is the risk. Computer security maps perfectly onto this scenario — just swap the vault for a database.
Summary
- Computer security protects systems and data from unauthorized access, modification, or disruption.
- The CIA Triad (Confidentiality, Integrity, Availability) is the core framework.
- Authenticity and non-repudiation extend CIA for identity and accountability.
- Key vocabulary: vulnerability → threat → attack → countermeasure → risk.
One-Liner Revision
Computer security protects systems using the CIA Triad: keep data confidential, keep it intact, and keep it available to the right people.
1.2 Computer Security, Information Security, and Network Security
Core Definition
Computer security focuses on protecting computing hardware and software systems from threats. Information security is the broader discipline of protecting information in any form (digital or physical) from unauthorized access, use, disclosure, modification, or destruction. Network security is a subset concerned specifically with protecting data as it travels across or is accessed through computer networks.
Information security is the umbrella. Computer security and network security are two specialized departments under it — one guards the machines, the other guards the connections.
Detailed Explanation
Computer Security deals with the hardware and software environment of a single system or a collection of systems. It covers:
- OS security (access controls, permissions)
- Application security (secure code, patching)
- Physical security of devices
- Malware protection
Information Security (InfoSec) is broader. Information does not have to be digital: a printed document, a verbal communication, or a written memo all fall within InfoSec scope. Its three pillars are still CIA, but applied across all media and all organizational processes. InfoSec encompasses policies, human behavior, legal compliance, and risk management in addition to technology.
Network Security focuses on the communication infrastructure: routers, switches, firewalls, VPNs, and protocols. It protects data in transit, prevents unauthorized access to network resources, and detects or blocks attacks like packet sniffing, man-in-the-middle, and denial-of-service.
| Dimension | Computer Security | Information Security | Network Security |
|---|
| Scope | Individual systems (hardware + software) | All information, any medium | Data in transit, network infrastructure |
| Focus | OS, applications, physical devices | Data, policies, people, processes | Protocols, firewalls, traffic |
| Form of data | Stored or processed data | Any form (digital, physical, verbal) | Transmitted data |
| Examples | Antivirus, OS patching, disk encryption | Security policies, ISO 27001, risk assessments | Firewalls, VPNs, IDS/IPS |
| Relationship | Subset of InfoSec | Parent domain | Subset of InfoSec |
Common Mistake
Students often treat these three terms as synonyms. They are not. Information security is the widest category. Computer security and network security are both subsets of it, each with a distinct technical scope. A policy memo locked in a filing cabinet is an InfoSec concern — it is neither a computer security nor a network security problem.
Test Yourself
- A company's printed employee records are stolen from a filing cabinet. Which security domain covers this incident?
- What is the primary concern of network security that is not shared by computer security?
- Place the three domains in a containment hierarchy from broadest to narrowest.
Answers:
1) Information security — the data was not digital, so it falls outside computer or network security.
2) Protecting data while it is in transit across communication links (routers, cables, wireless channels).
3) Information Security ⊃ Computer Security; Information Security ⊃ Network Security. Computer and Network Security are at the same level, both subsets of InfoSec.
Summary
- Information security is the broadest domain — it covers all information in any form.
- Computer security protects hardware and software systems.
- Network security protects data traveling over communication channels.
- All three use the CIA Triad but apply it to different scopes and media.
One-Liner Revision
Information security is the umbrella; computer security protects machines; network security protects connections.
1.3 Threats, Attacks and Assets
Core Definition
An asset is any resource — hardware, software, data, or people — that has value to an organization and must be protected. A threat is any circumstance or event with the potential to adversely impact organizational operations through unauthorized access, destruction, disclosure, modification, or denial of service. An attack is a deliberate action by a threat agent to exploit a vulnerability and cause harm to an asset.
Assets are what you want to protect. Threats are the dangers that might harm them. Attacks are when those dangers actually strike.
Detailed Explanation
Assets in a computer system fall into five categories:
- Hardware — Physical devices: CPUs, storage drives, servers, networking equipment. Threatened by theft, physical damage, or environmental hazards.
- Software — Operating systems, applications, utilities. Threatened by deletion, malware infection, or unauthorized modification.
- Data — The most valuable asset in most organizations: files, databases, configuration files, credentials. Threatened by unauthorized read, modification, or destruction.
- Communication Facilities — Network links, cables, wireless channels. Threatened by eavesdropping, jamming, or disruption.
- People — System administrators, users, security staff. Threatened by social engineering, insider attacks, or coercion.
Threats can be categorized by source:
- Human threats — Intentional (hackers, insiders, criminals) or unintentional (accidental deletion, misconfiguration).
- Natural threats — Floods, earthquakes, fires, lightning strikes.
- Environmental threats — Power outages, temperature extremes, hardware aging.
Attacks are classified along two axes:
Axis 1 — Nature of the attack:
- Active attack — The attacker modifies, disrupts, or fabricates data. The target is affected. Examples: message modification, denial-of-service, replay attack, masquerade.
- Passive attack — The attacker observes or copies data without altering it. The target is unaware. Examples: eavesdropping, traffic analysis.
Axis 2 — Position of the attacker:
- Insider attack — Carried out by someone already inside the organization (employee, contractor). More dangerous because they already have access and knowledge.
- Outsider attack — Carried out by someone external to the organization, needing to penetrate defenses first.
| Attack Type | Modifies Data? | Detectable? | Examples |
|---|
| Active | Yes | Easier (causes visible disruption) | DoS, message modification, masquerade, replay |
| Passive | No | Harder (leaves no obvious trace) | Eavesdropping, traffic analysis |
Common attack types to know:
- Eavesdropping — Passively intercepting network traffic to read communications.
- Masquerade — Pretending to be an authorized user or system.
- Replay attack — Capturing a valid transmission and retransmitting it later to fool the receiver.
- Modification of messages — Altering the content of a legitimate message in transit.
- Denial of Service (DoS) — Flooding a system with requests until it cannot serve legitimate users.
- Traffic analysis — Even if messages are encrypted, analyzing communication patterns (frequency, volume, timing) to extract information.
Let's Break It Down
Active vs passive attacks work like a spy scenario. A passive spy sits outside your window and listens to your conversation — they learn things but change nothing. An active spy breaks in, rearranges your files, or sends fake letters in your name. Passive attacks are hard to detect because nothing is visibly broken. Active attacks cause damage but at least leave evidence. Prevention is the best defense against passive attacks; detection and recovery matter more for active ones.
Test Yourself
- An attacker monitors encrypted traffic to determine that two executives are communicating frequently before a product launch. Is this a passive or active attack? Explain.
- List the five categories of assets. Which one is generally considered most valuable in modern organizations?
- What is the key difference between a replay attack and a modification attack?
Answers:
1) Passive attack (traffic analysis). No data is modified — the attacker only observes patterns, not content.
2) Hardware, Software, Data, Communication Facilities, People. Data is generally most valuable because it is hardest to recover and most directly exploitable.
3) Replay reuses an original valid message without changing it. Modification alters the content of the message in transit.
Summary
- Assets include hardware, software, data, communication facilities, and people.
- Threats can be human (intentional/unintentional), natural, or environmental.
- Active attacks modify or disrupt data; passive attacks only observe it.
- Insider attacks are typically more dangerous than outsider attacks due to existing access.
- Key attack types: eavesdropping, masquerade, replay, modification, DoS, traffic analysis.
One-Liner Revision
Assets are what you protect; threats are potential dangers; attacks are active exploits — classified as passive (observe only) or active (modify/disrupt).
1.4 Security Requirements
Core Definition
Security requirements are the formal set of properties a system must satisfy to be considered secure. They are most commonly expressed through the CIA Triad — Confidentiality, Integrity, and Availability — and extended with Authenticity and Non-repudiation for more comprehensive coverage.
Security requirements answer the question: "What exactly must a system guarantee to be safe?" CIA tells you the three main guarantees; the extensions fill gaps around identity and accountability.
Detailed Explanation
1. Confidentiality
Information is accessible only to those authorized to see it. Two sub-concepts:
- Data confidentiality — Private information is not disclosed to unauthorized individuals.
- Privacy — Individuals have control over what personal data is collected about them and how it is used.
Mechanisms: encryption, access controls, classification policies. Threat it counters: unauthorized disclosure.
2. Integrity
Data and systems are modified only through authorized means and processes. Two sub-concepts:
- Data integrity — Information and programs are changed only in specified, authorized ways.
- System integrity — The system performs its intended function in an unimpaired manner, free from unauthorized manipulation.
Mechanisms: checksums, hash functions, digital signatures, version control. Threat it counters: unauthorized modification.
3. Availability
Systems and data are accessible and usable upon demand by an authorized user. Covers both timely access and reliable performance.
Mechanisms: redundancy, failover, backups, DDoS mitigation. Threat it counters: disruption or denial of service.
4. Authenticity
The property of being genuine and verifiable. A system must be able to verify that a user, message, or resource is what it claims to be.
Mechanisms: passwords, certificates, biometrics, multi-factor authentication (MFA).
5. Non-repudiation (Accountability)
Actions or transactions cannot be denied after the fact. If a user sends a message or performs a transaction, there must be undeniable proof that they did so.
Mechanisms: digital signatures, audit logs, timestamps. Critical for legal and financial systems.
| Requirement | Threat It Addresses | Key Mechanisms |
|---|
| Confidentiality | Unauthorized disclosure | Encryption, access controls |
| Integrity | Unauthorized modification | Hash functions, digital signatures |
| Availability | Disruption / DoS | Redundancy, backups, failover |
| Authenticity | Spoofing / impersonation | Passwords, biometrics, MFA |
| Non-repudiation | Denial of actions | Digital signatures, audit logs |
The inverse of CIA is sometimes called the DAD Triad: Disclosure (threatens Confidentiality), Alteration (threatens Integrity), and Destruction/Denial (threatens Availability). This framing is useful when analyzing what a given attack does to your system.
Memory Hook
CIA-AN — Confidentiality, Integrity, Availability, Authenticity, Non-repudiation. The first three (CIA) are the core triad asked in almost every exam. AN adds identity and accountability. DAD is the threat side of CIA: Disclosure, Alteration, Denial.
Test Yourself
- A ransomware attack encrypts all files on a server so no one can access them. Which CIA property is violated?
- An attacker modifies a bank transaction from NPR 1,000 to NPR 100,000 in transit. Which property is violated?
- Explain the difference between data integrity and system integrity.
Answers:
1) Availability — legitimate users cannot access their files.
2) Integrity — the data was modified without authorization during transmission.
3) Data integrity ensures information is accurate and unaltered. System integrity ensures the system itself functions as intended, without unauthorized manipulation of its logic or behavior.
Summary
- The CIA Triad is the foundation of all security requirements.
- Confidentiality prevents unauthorized disclosure; Integrity prevents unauthorized modification; Availability ensures access when needed.
- Authenticity verifies identity; Non-repudiation prevents denial of actions.
- The DAD Triad (Disclosure, Alteration, Denial) maps the threat side directly onto CIA.
One-Liner Revision
Security requires CIA — Confidentiality, Integrity, Availability — plus Authenticity and Non-repudiation for identity and accountability.
1.5 Security Design Principles
Core Definition
Security design principles are fundamental guidelines used by system designers and security engineers to build systems that are resistant to attack, minimize the impact of failures, and remain manageable over time. The most widely cited set was proposed by Saltzer and Schroeder (1975) and remains foundational in modern security engineering.
These are the rules engineers follow so they don't accidentally create a system that looks secure but breaks easily. Think of them as building codes for software.
Detailed Explanation
The eight core principles from Saltzer and Schroeder, with modern additions:
1. Economy of Mechanism (Simplicity)
Keep the security design as simple and small as possible. Complex systems have more potential failure points. If a feature is not needed, do not build it.
2. Fail-Safe Defaults
Access decisions should default to denial. A user should only gain access if explicitly granted permission — not because nothing explicitly denied them. If a system fails or encounters an unknown state, it should default to the secure (deny) position.
Example: A firewall that blocks all traffic by default, allowing only explicitly whitelisted connections.
3. Complete Mediation
Every access to every object must be checked against the access control policy, every single time — not just at login. No request should be allowed through on the assumption that it was checked before.
Example: Checking file permissions each time a file is opened, not just when the application starts.
4. Open Design
The security of a mechanism should not depend on the secrecy of its design. Security through obscurity is not security. The design can be open; only the keys or credentials must be secret.
Example: AES encryption is publicly documented — its security comes from key secrecy, not algorithm secrecy.
5. Separation of Privilege
A system should require multiple conditions to be satisfied before granting access or performing a sensitive action, rather than a single condition.
Example: A bank transfer requires both a password and an OTP — two independent conditions. A nuclear launch requires two separate keys turned simultaneously.
6. Least Privilege
Every process and user should operate with only the minimum privileges necessary to complete the task at hand. Extra privileges not needed right now should not be granted.
Example: A web server process should not run as root — it only needs permission to read web files and open port 80.
7. Least Common Mechanism
Minimize the number of mechanisms shared across users or processes. Shared mechanisms create shared risk — a vulnerability in a shared component affects everyone using it.
Example: Avoid having a single authentication function shared by all applications; use separate instances where possible.
8. Psychological Acceptability
Security mechanisms must be usable. If security is too cumbersome, users will work around it, defeating its purpose. The human interface should be designed so that applying the correct security policy is the natural choice.
Example: A password manager that autofills strong passwords is more likely to be used than manually remembering 20-character random strings.
Additional modern principles:
- Isolation — Separate critical processes, data, or components so a failure in one does not cascade.
- Encapsulation — Hide implementation details; expose only what is necessary.
- Layering (Defense in Depth) — Use multiple independent layers of security so an attacker who bypasses one layer still faces others.
- Modularity — Build systems from independent components so each can be secured and updated separately.
Let's Break It Down
Least privilege is the "need-to-know" rule from spy movies applied to software. A junior analyst does not get the nuclear codes just because they work at the agency. Give each person (or process) only what they need for their specific job, nothing more. The principle of fail-safe defaults is like a security door that stays locked during a power outage rather than swinging open — when in doubt, keep it closed.
Common Mistake
Students confuse Open Design with making a system publicly vulnerable. Open design means the algorithm is public, not the keys. AES is public knowledge — but without your AES key, the algorithm is useless to an attacker. Never confuse "the design is open" with "the credentials are open."
Test Yourself
- A developer argues that their encryption system is secure because no one knows how it works. Which design principle does this violate, and why?
- Explain least privilege with a concrete example from a database system.
- A banking app requires a password, a fingerprint, and an OTP before allowing a transfer. Which principle does this demonstrate?
Answers:
1) Open design. Security must not rely on keeping the algorithm secret. Once the method is discovered, the entire system is broken. The key must be secret, not the design.
2) A database user account for a reporting application should have SELECT (read) permission only — not INSERT, UPDATE, or DELETE — since it only needs to read data, not modify it.
3) Separation of privilege — multiple independent conditions must all be satisfied before the sensitive action is permitted.
Summary
- Security design principles (Saltzer & Schroeder) guide engineers to build systems that are secure by structure.
- Least privilege and fail-safe defaults are the two most frequently applied in practice.
- Open design separates algorithm secrecy from key secrecy — the algorithm should be public.
- Psychological acceptability ensures that users will actually follow security procedures.
- Layering (defense in depth) and isolation add redundancy against attackers who bypass one control.
One-Liner Revision
Saltzer and Schroeder's eight principles — simplicity, fail-safe defaults, complete mediation, open design, separation of privilege, least privilege, least common mechanism, and psychological acceptability — define how to build secure systems.
1.6 Attack Surfaces and Attack Trees
Core Definition
An attack surface is the sum of all the different points (vectors) in a system where an unauthorized user could try to enter or extract data. The larger the attack surface, the greater the exposure. An attack tree is a conceptual diagram that represents attacks against a system in a tree structure, with the root as the attacker's goal and the leaves as the specific methods used to achieve it.
The attack surface is the "how many doors and windows does your house have?" question. Attack trees are the step-by-step plan a burglar might draw up to get inside — and a diagram the security team builds first to find those plans before the burglar does.
Detailed Explanation — Attack Surface
The attack surface includes all reachable and exploitable vulnerabilities. It is divided into three categories:
1. Network Attack Surface
Vulnerabilities exposed through network connections: open ports, accessible services (web servers, databases), network protocols, and firewalls with misconfigured rules. The internet-facing parts of any system are the largest portion of the network attack surface.
2. Software Attack Surface
Vulnerabilities in the code itself: web application bugs (SQL injection, XSS), OS vulnerabilities, poorly configured APIs, or unpatched software. Every line of code that accepts user input is potentially on the software attack surface.
3. Human Attack Surface
Vulnerabilities in people: phishing, social engineering, insider threats. Humans can be manipulated into bypassing technical controls — making the human attack surface often the most dangerous and hardest to patch.
Attack Surface Reduction
The goal is to minimize the attack surface:
- Close unused ports and disable unused services.
- Remove unused software components.
- Apply the principle of least privilege.
- Reduce code complexity.
- Train users to resist social engineering.
Detailed Explanation — Attack Trees
Attack trees, introduced by Bruce Schneier, provide a formal structure to analyze how an attacker might reach their goal. They help security teams enumerate all plausible attack paths, evaluate their likelihood and cost, and prioritize defenses.
Structure of an Attack Tree:
- Root node — The attacker's ultimate goal (e.g., "Gain unauthorized access to bank database").
- Internal nodes — Sub-goals or intermediate steps needed to reach the parent node.
- Leaf nodes — Specific, concrete attack actions (e.g., "Steal password via phishing," "Exploit SQL injection vulnerability").
- AND nodes — All child conditions must be met to satisfy the parent. (Both A and B required.)
- OR nodes — Any one child condition is sufficient to satisfy the parent. (Either A or B works.)
Worked Example — Attack Tree for "Access a bank account without authorization":
Goal: Access bank account without authorization [OR]
├── Steal credentials [OR]
│ ├── Phishing email → harvest username/password [LEAF]
│ ├── Keylogger malware installed on victim's device [LEAF]
│ └── Data breach from third-party site (credential stuffing) [LEAF]
├── Bypass authentication [AND]
│ ├── Find session token in browser storage [LEAF]
│ └── Replay captured session token before expiry [LEAF]
└── Exploit application vulnerability [OR]
├── SQL injection in login form [LEAF]
└── Broken access control (access another user's URL) [LEAF]
Reading this tree: the attacker achieves the goal by any one of the three main branches (OR). The "bypass authentication" branch requires both steps (AND): find the token and then replay it.
Why attack trees are useful:
- Make invisible threats visible and structured.
- Help calculate the cost and probability of each path.
- Allow prioritized, cost-effective defense investment.
- Support communication between technical teams and management.
Let's Break It Down
Attack trees work like a chess strategy map drawn by the opponent. You, as the defender, draw all the possible moves the attacker could make and trace every path to their goal. Once the map is drawn, you can see which paths are cheapest for the attacker and which defenses would block the most paths at once. Blocking a critical AND node (a step the attacker must complete) is extremely effective — it cuts off an entire branch. Blocking only an OR leaf barely matters because the attacker simply uses another route.
Test Yourself
- Define attack surface and explain why reducing it is a valid security strategy.
- In an attack tree, what is the difference between an AND node and an OR node? Why does blocking an AND node provide stronger defense?
- List one example each of a network, software, and human attack surface vulnerability.
Answers:
1) The attack surface is all points where an attacker could try to exploit a system. Reducing it (closing ports, removing features, limiting access) means fewer opportunities for attackers — each eliminated entry point is one fewer risk to manage.
2) AND node: all child conditions must be met. OR node: any one child condition is enough. Blocking an AND node denies the entire parent path because all steps are required. Blocking an OR leaf only removes one option while the attacker has others.
3) Network: open port 3306 (MySQL) exposed to the internet. Software: unpatched SQL injection vulnerability in a login form. Human: a user tricked via phishing into revealing their credentials.
Summary
- The attack surface includes all vectors through which a system can be attacked: network, software, and human.
- Minimizing the attack surface (removing unused services, applying least privilege) directly reduces risk.
- Attack trees model attacker goals hierarchically, with AND/OR logic at internal nodes.
- Leaf nodes are concrete attack actions; the root is the ultimate goal.
- Blocking an AND node eliminates an entire sub-tree of attack paths.
One-Liner Revision
The attack surface is every exploitable entry point in a system; attack trees map attacker goals to specific methods using AND/OR logic to guide prioritized defense.
1.7 Computer Security Strategy
Core Definition
A computer security strategy is the comprehensive, high-level plan an organization adopts to protect its information assets. It integrates policy, technical controls, and operational practices to prevent attacks, detect incidents, and respond to breaches — structured around three phases: Prevention, Detection, and Response.
A security strategy is not a single tool or rule — it's the overall plan. Just as a city has traffic lights, police, and courts working together, a security strategy layers prevention, monitoring, and correction into a unified approach.
Detailed Explanation
A complete security strategy operates across three levels:
Level 1 — Policy
Security policy is the formal statement of rules and practices that govern how an organization manages and protects its resources. It sets the intent and authority. Without a policy, technical controls have no direction or accountability. Example: an acceptable-use policy defines what employees may and may not do on company systems.
Level 2 — Implementation (Controls)
Technical and administrative controls that enforce the policy:
- Preventive controls — Stop attacks before they happen: firewalls, antivirus, encryption, access controls, user training.
- Detective controls — Identify attacks in progress or that have occurred: intrusion detection systems (IDS), audit logs, security monitoring.
- Corrective controls — Restore normal operation after an attack: incident response procedures, backups, disaster recovery.
Level 3 — Assessment (Assurance)
Ongoing verification that the strategy is working as intended: vulnerability assessments, penetration testing, audits, and compliance checks. Security is not a one-time event — it must be continuously evaluated and updated.
The Prevention-Detection-Response Model:
- Prevention — Reduce the probability of an attack succeeding. Harden systems, apply patches, enforce least privilege, train users.
- Detection — Identify attacks that get through prevention. Use IDS, monitor logs, set up alerts. The faster an attack is detected, the less damage it causes.
- Response — Contain the damage, recover operations, and learn from the incident. Includes incident response plans, forensic investigation, and updating defenses.
Defense in Depth
No single control is perfect. Defense in depth layers multiple independent controls so that if one fails, others remain. An attacker who bypasses the firewall still faces access controls; if they compromise a user account, encryption still protects the data. Each layer buys time and reduces the probability of a full breach.
| Strategy Component | Goal | Examples |
|---|
| Prevention | Stop attacks before they succeed | Firewalls, encryption, patching, training |
| Detection | Find attacks that get through | IDS/IPS, audit logs, SIEM, alerts |
| Response | Recover and limit damage | Incident response plan, backups, forensics |
| Policy | Define rules and responsibilities | Acceptable-use policy, password policy |
| Assessment | Verify effectiveness | Pen testing, audits, vulnerability scans |
Test Yourself
- Explain why prevention alone is insufficient as a complete security strategy.
- What is defense in depth? Give an example with three layers.
- Classify each control: (a) antivirus software, (b) IDS, (c) data backup and restore procedure.
Answers:
1) No control is 100% effective. Attackers evolve, vulnerabilities are discovered in previously secure systems, and human error always exists. Without detection and response, a successful attack goes unnoticed and unaddressed indefinitely.
2) Defense in depth uses multiple independent layers. Example: (1) Firewall blocks unauthorized network access → (2) access controls prevent unauthorized logins even if the network is breached → (3) encryption protects data even if an account is compromised.
3) (a) Preventive — blocks malware before it executes. (b) Detective — monitors and alerts on suspicious activity. (c) Corrective — restores data after damage or loss.
Summary
- Security strategy operates at three levels: policy (rules), implementation (controls), and assessment (verification).
- The three phases are Prevention (stop it), Detection (find it), and Response (fix it).
- Defense in depth layers multiple controls so failure in one layer does not mean total compromise.
- Continuous assessment (pen testing, audits) is essential because threats evolve over time.
One-Liner Revision
Computer security strategy combines policy, layered controls, and continuous assessment to prevent attacks, detect intrusions, and recover quickly — no single control is enough.
Whole Chapter Summary
1.1 Computer Security Concepts — Security protects systems using the CIA Triad (Confidentiality, Integrity, Availability). Core vocabulary: asset, vulnerability, threat, attack, countermeasure, risk.
1.2 Computer vs Information vs Network Security — Information security is the broadest domain. Computer security guards machines; network security guards data in transit. All three share CIA as the goal.
1.3 Threats, Attacks, and Assets — Assets include hardware, software, data, communication facilities, and people. Active attacks modify or disrupt; passive attacks only observe. Insider attacks are typically more dangerous than outsider attacks.
1.4 Security Requirements — CIA + Authenticity + Non-repudiation form the full requirement set. Each property addresses a specific category of harm (disclosure, modification, denial, spoofing, repudiation). DAD is the threat-side mirror of CIA.
1.5 Security Design Principles — Saltzer and Schroeder's eight principles guide secure system design. Key: least privilege, fail-safe defaults, complete mediation, open design, and separation of privilege. Psychological acceptability ensures users actually follow security rules.
1.6 Attack Surfaces and Attack Trees — The attack surface covers all exploitable vectors: network, software, human. Attack trees map attacker goals hierarchically with AND/OR logic. Blocking AND nodes is the most effective defense. Reducing attack surface directly reduces risk.
1.7 Computer Security Strategy — Strategy operates at policy, implementation, and assessment levels. The core model: prevent → detect → respond. Defense in depth layers multiple independent controls. Continuous assessment keeps strategy current as threats evolve.
Last-Minute Revision Sheet
| Concept | Trigger Phrase | Recall Cue |
|---|
| CIA Triad | Core security goals | Confidentiality + Integrity + Availability |
| Vulnerability | Weakness in system | Door that can be opened |
| Threat vs Attack | Potential vs actual | Robber outside = threat; breaking in = attack |
| Active vs Passive Attack | Modifies vs observes | Active = DoS, modification; Passive = eavesdrop, traffic analysis |
| InfoSec vs Computer Security vs Network Security | Scope comparison | InfoSec ⊃ Computer + Network Security |
| DAD Triad | Threats to CIA | Disclosure → C; Alteration → I; Denial → A |
| Non-repudiation | Cannot deny action | Digital signature = proof you signed |
| Least Privilege | Minimum needed access | Web server should not run as root |
| Fail-Safe Defaults | Default = deny | Lock stays locked during power outage |
| Open Design | Algorithm public, key secret | AES is public; your key is not |
| Separation of Privilege | Multiple conditions required | Password + OTP for bank transfer |
| Complete Mediation | Check every access, every time | Not just at login — check every request |
| Attack Surface | All exploitable entry points | Network + Software + Human vectors |
| Attack Tree | Goal-to-method hierarchy | Root = goal; leaves = concrete attacks; AND/OR logic |
| AND node (attack tree) | All conditions required | Blocking one child blocks entire branch |
| Defense in Depth | Layered controls | Firewall → access control → encryption |
| Prevent-Detect-Respond | Security strategy phases | Stop it → find it → fix it |
