Copyright © Philip M. Parker, INSEAD. Terms of Use.

Security

Specialty Definition: Security

Top     

Specialty Definition: Computer insecurity

(From Wikipedia, the free Encyclopedia)

Many current computer systems have a very poor level of computer security. This computer insecurity article describes the current battlefield of computer security exploits and defenses. Please see the secure computing article for an alternative approach, based on security engineering principles.

Most current real-world computer security effort focuses on external threats, and generally treats the computer system itself as a trusted system.

Many knowledgeable observers consider this a disastrous mistake, and point out that this distinction is the cause of much of the insecurity of current computer systems -- once an attacker has subverted one part of a system without fine-grained security, he or she usually has access to most or all of the features of that system. Because computer systems are very complex, and cannot be guaranteed to be free of defects, this security stance tends to produce insecure systems.

In particular, this approach has been predominant in the design of many Microsoft software products, due to the long-standing Microsoft policy of emphazing functionality and 'ease of use' over security. Microsoft claims that this is the result of consumer choice. Since Microsoft products currently dominate the desktop and home computing markets, this has led to unfortunate effects. However, the problems described here derive from the security stance taken by software and hardware vendors generally, rather than any technical or moral failing of a single vendor. Microsoft is not out of line in this respect, just more prominent, and its mistakes more pervasive.

Severe financial damage has been caused by computer security breaches, but estimating reliable costs is quite difficult. Figures in the billions of dollars have been quoted in relation to the damage caused by computer worms like Code Red, but such estimates are likely exaggerated. However, other losses, such as those caused by the compromise of credit card information, can be more easily determined, and they have been substantial.

There are many similarities (yet many fundamental differences) between computer and physical security.

Just like real-world security, the motivations for breaches of computer security vary between attackers, sometimes called hackers or crackerss. Some are teenage thrill-seekers or vandals (the kind often responsible for defacing web sites); similarly, some web site defacements are done to make political statements. However, some attackers are highly skilled and motivated with the goal of compromising computers for financial gain or espionage. An example of the latter is Markus Hess who spied for the KGB and was ultimately caught because of the efforts of Clifford Stoll, who wrote an amusing and accurate book, The Cuckoo's Egg about his experiences. For those seeking to prevent security breaches, the first step is usually to attempt to identify what might motivate an attack on the system, how much the continued operation and information security of the system are worth, and who might be motivated to breach it. The precautions required for a home PC are very different for those of banks' Internet banking system, and different again for a classified military network. Other computer security writers suggest that, since an attacker using a network need know nothing about you or what you have on your computer, attacker motivation is inherently impossible to determine beyod guessing. If true, blocking all possible attacks is the only plausible action to take.

To understand something about techniques for securing a computer system, it is important to first understand the various types of "attacks" that can be made against it. These threats can typically be classified into a number of categories:

• Code exploits: Software flaws are often exploited to gain control of a computer, or to cause it to operate in an unexpected manner. Many development methodologies rely on testing to ensure the quality of any code released; this process often fails to discover extremely unusual potential exploits.

• Eavesdropping: Any data that is transmitted over a network is at some risk of being intercepted, or even modified by a malicious person. Even machines that operate as a closed system (ie, with no contact to the outside world) can be eavesdropped upon via monitoring the faint electro-magnetic transmissions generated by the hardware, such as TEMPEST.

• Social engineering and human error: A computer systems is no more secure than the human systems responsible for its operation. Malicious individuals have regularly penetrated well-designed, secure computer systems by taking advantage of the carelessness of trusted individuals, or by deliberately deceiving them.

• Denial of service attacks: Denial of service attacks differ slightly from those listed above, in that they are not primarily a means to gain unauthorized access or control of a system. They are instead designed to overload the capabilities of a machine or network, and thereby render it unusable. This type of attack is, in practice, very hard to prevent, because the behavior of whole networks needs to be analyzed, not only of small pieces of code.

• Indirect attacks: are those in which one or more of the attack types above are launched from a third party computer which has been taken over remotely. The term usually used is 'zombified'. By using someone else's computer to launch an attack, it becomes far more difficult to track down the actual attacker.

• Backdoors: are methods of bypassing normal authentication or giving remote access to a computer to somebody who knows about the backdoor, while intended to remain hidden to casual inspection. The backdoor may take the form of an installed program (e.g., Back Orifice) or could be a modification to a legitimate program.

Computer code is regarded by some as just a form of mathematics. It is theoretically possible to prove the correctness of computer programs (within very limited circumstances) though the likelihood of actually achieving this in large-scale practical systems is regarded as unlikely in the extreme by most with practical experience in the industry -- see Bruce Schneier et al.

It's also possible to protect messages in transit (ie, communications) by means of cryptography. One method of encryption -- the one-time pad -- has been proven to be unbreakable when correctly used. Unfortunately it's very difficult to use properly, and highly inconvenient as well. Other methods of encryption, while breakable in theory, are often virtually impossible to directly break by any means publicly known today. Breaking them requires some non-cryptographic input, such as a stolen key, stolen plaintext (at either end of the transmission), or some other extra cryptanalytic information.

Social engineering and physical attacks can only be prevented by non-computer means, which are very difficult to enforce. Even in a highly disciplined environment, such as in military organizations, social engineering attacks are still difficult to prevent.

In practice, only a small fraction of computer program code is mathematically proven, or even goes through extensive security audits, so it's usually possible for a determined cracker to read, copy, alter or destroy data in well secured computers. You can reduce a cracker's chances by keeping your systems up to date, using a security scanner or/and hiring competent people responsible for security. The effects of data loss/damage can be reduced by careful backing up and insurance.

Computer security may be generally accomplished by three distinct processes: 1) Prevention, 2) Detection, and 3) Response. Firewalls are by far the most common prevention systems from a network security perspective as they can (if properly configured) block packet types and in so doing prevent some attacks. Access controls and cryptography can protect systems and data, respectively. Intrusion Detection Systems (IDS) are designed to detect network attacks in progress and/or assist in post-attack forensics, while audit trails and logs serve a similar function for individual systems. "Response" is necessarily defined by the security requirements of an individual system and may cover the range from complete destruction of the system to notification of legal authorities, counter-attacks, and the like.

Today, computer security comprises mainly "preventive" measures, like firewalls or an Exit Procedure. We could liken a firewall to the building of a good fence around your warehouse. Firewalls are common amongst meachines that are permanently connected to the Internet (though not universal, as demonstrated by the large numbers of machines "cracked" by worms like Code Red which would have been protected by a properly-configured firewall). However, fewer organisations maintaining computer systems operate effective detection systems, and fewer still have organised response mechanisms in place.

Responding forcefully to attempted security breaches (in the manner that one would for attempted physical security breaches) is often very difficult for a variety of reasons:

• Identifying attackers is difficult, as they are often in a different jurisdiction to the systems they attempt to breach, and operate through proxies, temporary anonymous dial-up accounts, and other anonymising procedures which make backtracing difficult and are often located in yet another jurisdiction. If they successfully breach security, they are often able to delete logs to cover their tracks.

• The sheer number of attempted attacks is so large that organisations cannot spend time pursuing each attacker (a typical home user with a permanent (eg, cable modem) connection will be attacked at least several times per day, so more attractive targets could be presumed to see many more).

• Law enforcement officers are often unfamiliar with information technology, and so lack the skills and interest in pursuing attackers.

Further reading

Computer security is a highly complex field, and is relatively immature. The ever-greater amounts of money dependent on electronic information make protecting it a growing industry and an active research topic.

There is an extensive culture associated with electronic security; see electronic underground community.

See also

• computing

• cryptology
• cryptography
• defensive programming
• full disclosure
• hacking
• physical security
• security engineering

References

• Ross J. Anderson, Security Engineering: A Guide to Building Dependable Distributed Systems, ISBN 0471389226
• Bruce Schneier, Secrets & Lies: Digital Security in a Networked World, ISBN 0471253111
• Anderson, Ross - Why Information Security is Hard - An Economic Perspective

External links

• Participating With Safety, a guide to electronic security threats from the viewpoint of civil liberties organisations. Licensed under the GFDL.

  Source: adapted by the editor from Wikipedia, the free encyclopedia under a copyleft GNU Free Documentation License (GFDL) from the article "Computer insecurity."

Top     

National security

(From Wikipedia, the free Encyclopedia)

National security describes the measures taken by a state to ensure its survival and security.

Measures taken to ensure national security include:

• the maintenance of armed forces
• civil defence measures and emergency preparedness
• attempts to create resilience and redundancy in national infrastructure
• the maintenance of intelligence services to detect threats
• the protection of sensitive information

See also:

• Nuclear deterrence

National Security is also a movie, made in 2003, starring Martin Lawrence. See National Security (movie).

Source: adapted by the editor from Wikipedia, the free encyclopedia under a copyleft GNU Free Documentation License (GFDL) from the article "National security."

Top     

Secure computing

(From Wikipedia, the free Encyclopedia)

A secure computing platform is designed so that those agents who should not be able to perform certain actions cannot do them, while those agents who should be able to perform certain actions can do them. The actions in question can be reduced to operations of access, modification and deletion.

It is important to understand that in a secure system, the legitimate users of that system are still able to do what they should be able to do. In the case of a computer system sequestered in a vault without any means of power or communication, the term 'secure' is applied in a pejorative sense only.

It is also important to distinguish the techniques employed to increase a system's security from the issue of that system's security status. In particular, systems which contain fundamental flaws in their security designs cannot be made secure without compromising their utility. Consequently, most computer systems cannot be made secure even after the application of extensive "computer security" measures.

There are two different cultures of security in computing. One focuses mainly on external threats, and generally treats the computer system itself as a trusted system. See the article computer insecurity for a description of the current state of the art in this approach.

Computer security by design

The other regards the computer system itself as largely an untrusted system, and redesigns it to make it more secure in a number of ways.

This technique enforces privilege separation, where an entity has only the privileges that are needed for its function. That way, even if an attacker has subverted one part of the system, fine-grained security ensures that it is just as difficult for them to subvert the rest.

Futhermore, by breaking the system up into smaller components, the complexity of individual components is reduced, opening up the possibility of using techniques such as automated theorem proving to prove the correctness of crucial software subsystems. Where formal correctness proofs are not possible, rigorous use of code review and unit testing measures can be used to try to make modules as secure as possible.

The design should use "defense in depth", where more than one subsystem needs to be compromised to compromise the security of the system and the information it holds. Subsystems should default to secure settings, and wherever possible should be designed to "fail secure" rather than "fail insecure" (see fail safe for the equivalent in safety engineering). Ideally, a secure system should require a deliberate, conscious, knowledgeable and free decision on the part of legitimate authorities in order to make it insecure.

In addition, security should not be an all-or-nothing issue. The designers and operators of systems should assume that security breaches are inevitable in the long term. Full audit trails should be kept of system activity, so that when a security breach occurs, the mechanism and extent of the breach can be determined. Finally, full disclosure helps to ensure that when bugs are found the "window of vulnerability" is kept as short as possible.

Early history of security by design

The early Multics operating system was notable for its early emphasis on computer security by design, and Multics was possibly the very first operating system to be designed as a secure system from the ground up. In spite of this, Multics security was broken, not once, but repeatedly. This led to further work on computer security that prefigured modern security engineering techniques.

Techniques for creating secure systems

The following techniques can be used in engineering secure systems. Note that these techniques, whilst useful, do not of themselves ensure security -- a security system is no stronger than its weakest link.

Cryptographic techniques can be used to defend data in transit between systems, reducing the probability that data exchanged between systems can be intercepted or modified.

Strong authentication techniques can be used to ensure that communication end-points are who they say they are.

Secure cryptoprocessors can be used to leverage physical security techniques into protecting the security of the computer system.

Chain of trust techniques can be used to attempt to ensure that all software loaded has been certified as authentic by the system's designers.

Mandatory access control can be used to ensure that privileged access is withdrawn when privileges are revoked. For example, deleting a user account should also stop any processes that are running with that user's privileges.

Capability and access control list techniques can be used to ensure privilege separation and mandatory access control. The next sections discuss their use.

Capabilities vs. ACLs

Within computer systems, the two fundamental means of enforcing privilege separation are access control lists (ACLs) and capabilities. The semantics of ACLs have been proven to be insecure in many situations (e.g., Confused Deputy Problem). It has also been shown that ACL's promise of giving access to an object to only one person can never be guaranteed in practice. Both of these problems are resolved by capabilities.

Unfortunately, for various historical reasons, capabilities have been restricted to research operating systems and commercial OSes still use ACLs.

The Cambridge CAP computer demonstrated the use of capabilities, both in hardware and software, in the 1970s, so this technology is hardly new. A reason for the lack of adoption of capabilities may be that ACLs appeared to offer a 'quick fix' for security without pervasive redesign of the operating system and hardware.

A good example of a current secure system is Eros.

Further reading

Computer security is a highly complex field, and it is relatively immature. The ever-greater amounts of money dependent on electronic information make protecting it a growing industry and an active research topic.

See also: security engineering, authentication, cryptology, cryptography, physical security, hacking, cracking, shellcodes, electronic underground community, Defensive programming, full disclosure, INFOSEC, COMSEC

References:

• Ross J. Anderson, Security Engineering: A Guide to Building Dependable Distributed Systems, ISBN 0471389226
• Bruce Schneier, Secrets & Lies: Digital Security in a Networked World, ISBN 0471253111
• David A. Wheeler, Secure Programming for Linux and Unix HOWTO (GFDL License)
• Paul A. Karger, Roger R. Schell. Thirty Years Later: Lessons from the Multics Security Evaluation. IBM white paper.

• Computer Security Fact Forum Framework
• Intro to Caps
• ACLs vs. Caps
• Intro to Cap Security
• Why aren't Caps and ACLs equivalent?
• Open Source Distributed Capabilities
• REST and capability-based security
• The Cambridge CAP capability-based computer architecture
• Online book: "Capability-Based Computer Systems" by Henry M. Levy
• Henry M. Levy - Capability-Based Computer Systems. Digital Press, Bedford, Massachusetts, 1984, ISBN 0932376223 (out of print -- text available online on author's website)

  Source: adapted by the editor from Wikipedia, the free encyclopedia under a copyleft GNU Free Documentation License (GFDL) from the article "Secure computing."

Top     

Security

(From Wikipedia, the free Encyclopedia)

Security or safety is being free from danger, i.e. it is impossible that something very bad will happen. In absolute sense this is hardly possible, it is a relative matter. The term can be used with reference to crime, accidents of all kinds, etc.

In finance, a security is an instrument traded in the financial markets. See Securities.

In private security, security is the result of services provided to prevent, deter, detect and/or document crime, fire, disorder or violations of company rules. These services may be provided by a security guard or by alarms, security cameras, or as a routine part of the performance of every employee's duties (especially in smaller companies).

Compare with: National security

In telecommunication, the term security has the following meanings:

• A condition that results from the establishment and maintenance of protective measures that ensure a state of inviolability from hostile acts or influences.
• With respect to classified matter, the condition that prevents unauthorized persons from having access to official information that is safeguarded in the interests of national security.
• Measures taken by a military unit, an activity or installation to protect itself against all acts designed to, or which may, impair its effectiveness.

Sources: from Federal Standard 1037C and adapted from the Department of Defense Dictionary of Military and Associated Terms and from the Department of Defense Dictionary of Military and Associated Terms

Proposed alternative definition:

• When our expectations are met, we can say that quality has been met. When our expectations are met once and again, despite of errors, catastrophes and attacks which in principle could prevent our expectations to be met, we can say that security has been met. Security is not falsable (Popper). We can prove than there has been a security failure, but we can´t prove that there hasn't. Security measures improve the likeliness of expectations to be met, and therefore improve security. With respect to classified matter there is an expectation of the classified matter to remain secret for as long as we wish. A control access system is the security measure that helps this expectation to be accomplished.

In American football, a safety is the act by which one team gains two points when an opponent possessing the ball is tackled in his own end zone, or runs out of bounds in his own end zone.

See also classified information, insecurity, information security, computer security, hacking, cracking, phreaking.

Source: adapted by the editor from Wikipedia, the free encyclopedia under a copyleft GNU Free Documentation License (GFDL) from the article "Security."

Top     

Security (finance)

(From Wikipedia, the free Encyclopedia)

Securities are tradeable interests representing financial value. They are often represented by a certificate. They include shares of corporate stock or mutual funds, bondss issued by corporations or governmental agencies, stock options and other derivative securities, limited partnership units, and various other formal "investment instruments."

Securities are generally considered able to be traded on an exchange, and therefore registered with the SEC, though some may never trade on an exchange and some are exempt from registration.

Due to the difficulty of creating a general definition that covers all securities, the United States SEC attempts to define "securities" exhaustively (and not very prcisely) as: "any note, stock, treasury stock, security future, bond, debenture, certificate of interest or participation in any profit-sharing agreement or in any oil, gas, or other mineral royalty or lease, any collateral-trust certificate, preorganization certificate or subscription, transferable share, investment contract, voting-trust certificate, certificate of deposit for a security, any put, call, straddle, option, or privilege on any security, certificate of deposit, or group or index of securities (including any interest therein or based on the value thereof), or any put, call, straddle, option, or privilege entered into on a national securities exchange relating to foreign currency, or in general, any instrument commonly known as a "security"; or any certificate of interest or participation in, temporary or interim certificate for, receipt for, or warrant or right to subscribe to or purchase, any of the foregoing; but shall not include currency or any note, draft, bill of exchange, or banker's acceptance which has a maturity at the time of issuance of not exceeding nine months, exclusive of days of grace, or any renewal thereof the maturity of which is likewise limited." --Section 3a item 10 of the 1934 Act.

Banknotes, checks, and some bills of exchange do not fall into this category. Securities that have already been issued may also be traded; this trading is called the aftermarket.

In the U.S., dealing in securities is heavily regulated by both the federal authorities (chiefly the S.E.C) and state authorities.

See also: Financial markets, Financial supervision, Finance

Source: adapted by the editor from Wikipedia, the free encyclopedia under a copyleft GNU Free Documentation License (GFDL) from the article "Security (finance)."

Top     

Security guard

(From Wikipedia, the free Encyclopedia)

A security guard is a private person who is employed to protect property and people. Usually security guards are uniformed and act to protect property by observing (either directly, through patrols, or by watching alarm systems or video cameras) for signs of crime, fire or disorder; then reporting any incidents to their client, employer and emergency services as appropriate. Security guards also perform access control at building entrances and vehicle gates by ensuring that employees and visitors display proper passes or identification before entering the facility. Security guards are often called upon to respond to minor emergencies (lost persons, lockouts, dead vehicle batteries, etc.) and to assist in serious emergencies by guiding emergency responders to the scene of the incident and documenting what happened on an incident report.

The security guard motto is to "observe and report." Contrary to popular belief, security guards are not normally expected to make arrests or otherwise act as police officers. However, security guards do enforce company rules and can act (as would any other person) if necessary to protect lives or property. Security guards are often trained to operate emergency equipment, perform first aid, take accurate notes and write effective reports, and perform other tasks as required by the property they are protecting.

Security guards are either "in-house" (i.e. employed by the same company they protect) or "contract," working for a private security company which protects many locations. Some large private security companies in the USA include Pinkerton, Burns, Wackenhut, Allied, and Guardsmark.

One major economic justification for security guards is that insurance companies (particularly fire insurance carriers) will give substantial rate discounts to sites which have a 24-hour presence. This is because having a security guard on site increases the odds that any fire will be reported to the local fire department before a total loss occurs. Also, the presence of security guards (particularly in combination with effective security procedures) tends to diminish "shrinkage," theft, employee misconduct and safety rule violations, or even sabotage.

Most U.S. states and countries require a license to work as a security guard. This license may include a criminal background check and/or training requirements. Most security guards do not carry weapons and have only the same powers of arrest as a private citizen, a "private person" arrest or "citizen's arrest." If weapons are carried, additional permits and training are usually required. Normally armed security guards are used (in the USA) to protect sensitive sites such as government and military installations, banks or other financial institutions, and nuclear power plants. Armed private security is much more rare in Europe and other developed countries. In developing countries (with host country permission) armed security composed mostly of ex-military personnel is often used to protect corporate assets, particularly in war-torn regions.

Some jurisdictions do commission or deputize security guards and give them limited additional powers, particularly when employed in protecting public property such as mass transit stations. Some security guards, particularly in hazardous jobs such as bodyguard work and bouncers outside nightclubs, are off-duty police officers. Except in these special cases, a security guard who misrepresents themselves as police is committing a felony crime.

Industry terms for security guards include: guards, agents, watchmen, officers, safety patrol. Other job titles in the security industry include dispatcher, receptionist, driver, supervisor, alarm responder, armed security officer, and manager.

It was a security guard, Frank Willis, who detected the Watergate burglars, ultimately leading to the resignation of Richard M. Nixon as President of the United States.

Derogatory terms for security guards include rent-a-cops and imitation bacon. Some people do not like security guards because their duties include enforcing rules and serving as a symbol of authority. Others believe that security guards are "wanna-be" or would-be police officers, or have had bad experiences with security guards in the past.

See also: private investigator bodyguard bounty hunter protective services police

References: http://www.dca.ca.gov/bsis/ California. Department of Consumer Affairs, Bureau of Security and Investigative Services Website.

Source: adapted by the editor from Wikipedia, the free encyclopedia under a copyleft GNU Free Documentation License (GFDL) from the article "Security guard."

Top     

Abbreviations & Acronyms: Security

Top     

Top     

Synonyms within Context: Security

Top     

Top     

Modern Usage: Security

Top     

Commercial Usage: Security

Top     

Image Slideshow: Security

Photos: Security More pictures...

Computer Images: Security More pictures...

Top     

Photo Album: Security

Thumbnail	Description & Credit	Thumbnail	Description & Credit
	A security fence is installed at an on campus nursery in a St. Petersburg school to prevent vandalism and to reduce the threat of unintentional impacts to the plants in the nursery. Credit: NOAA Restoration Center.		Security forces airman.
	Airman Daren Percy, 31st Security Forces Squadron at Aviano Air Base, Italy.		Play to Win at Health Pursuit : NIH Health, Safety and Security Expo / Division of Safety [NIH]. Credit: National Library of Medicine.
	SOCIAL SECURITY. Credit: National Library of Medicine.		Mineman Second Class Franklin Marshall, a Navy Explosive Ordnance Disposal Team member, conducts a search for mines, especially those attached to ship's hulls, circa April 1966. The E.O.D. Team is responsible for harbor security. Several merchant ships are in the distance. Photographed by Ernie Filtz. Credit: NAVY.
	Underway during a Neutrality Patrol, 29 June 1941. Photographed from USS Wasp (CV-7). Note her unusual paint scheme: overall No. 5 Navy Gray on vertical surfaces, with all identifying markings painted out. This was done as a security measure prior to her transiting the Panama Canal earlier in the Spring. Credit: NAVY.		Now, children, you must sign as our future security!. Credit: Library of Congress.
	"Loyalty tests? Essential to security. Movie censorship? Of course! Should left-wingers be jailed? Naturally. What's that. Should food be rationed? Ridiculous! Who wants to live in a police state?". Credit: Library of Congress.		Security Storage warehouse, 1140 15th St., N.W., Washington, D.C. Credit: Library of Congress.
Source: pictures compiled by the editor from various references; see picture credits.

Top     

Digital Photo Gallery: Security
 

"Motorbike security" by Simon Cataudo Commentary: "Chain and padlock around Neil's bike wheel."	"Computer & chain 1" by Jen Dixon Commentary: "I took these photos for a project that I was working on about intellectual property security. I'm not sure that these illustrate that, but hopefully someone can use them for something. ."
Source: photographs selected by the editor, with permission from the photographers.

Top     

Sounds Captioned with "Security".

Play	Caption	Play	Caption
	Burglar; breaking and entering; thief; alarm; police; security; .		Safety; security; electronics; automobile; car; lock; alarm; key; key chain; beep beep; secure; securing; locking.
Source: compiled by the editor from various references; see credits.

Top     

Familiar Quotations: Security

Top     

Historic Usage: Security

Top     

Use in Literature: Security

Top     

Non-Fiction Usage: Security

Top     

Spoken Usage: Security