Download Physical Access Controls

Computer Security
Computer Security is defined as:
The protection afforded to an automated
information system in order to:
attain the applicable objectives of preserving the integrity,
availability and confidentiality of
information system resources (includes hardware, software,
firmware, information/data, and
telecommunications).
Integrity
Integrity is defined as :
In daily usage, information has integrity when it is
timely, accurate, complete, and
consistent. However, computers are unable to provide
or protect all of these qualities.
Therefore, in the computer security field, integrity is
often discussed more narrowly as having
two facets: data integrity and system integrity.
Integrity
Data integrity is a requirement that
information and programs are changed only
in a specified and authorized manner.
System integrity is a requirement that a
system performs its intended function in an
effective manner, free from unauthorized
manipulation of the system."
Availability
Availability:
A requirement intended to assure that systems
work promptly and service is not denied to
authorized users.
Confidentiality
Confidentiality:
A requirement that private or confidential
information not be disclosed to
unauthorized individuals.
Network Security
Network security :uses the same basic set of
controls as mainframe security or
PC security.
Example, secure gateways are discussed as a
part of Access Control;
Transmitting authentication data over insecure
networks is discussed as the
Identification and Authentication and the
data communications contracts.
COMMON THREATS
Computer systems are vulnerable to many threats
that can inflict various types of damage resulting in
significant losses. This damage can range from
errors harming database integrity to
fires destroying entire computer centers. Losses can
be, for example, from the actions of
supposedly trusted employees defrauding a system,
from outside hackers, or from careless data entry
clerks.
PHYSICAL AND ENVIRONMENTAL
SECURITY




Physical Access Controls
Fire Safety Factors
Failure of Supporting Utilities
Mobile and Portable Systems
Physical Access Controls
(Theft of Systems or Storage Media)
It restrict the entry and exit of personnel (and
often equipment and media) from an area,
such as an office building, suite, data
center, or a room containing a LAN server.
.
Physical access controls
The controls to the system can include





the electric power service,
the air conditioning and heating
telephone and data lines,
backup media and source documents,
and any other elements required for system's
operation.
Physical access controls
There are many types of physical access controls: including badges,
 memory cards,
 guards,
 keys, fences,and locks.
 Intrusion detectors, such as closed-circuit
 television cameras, motion detectors, and other
devices.
Fire Safety Factors
Building fires are a security threat because
of the destruction of both hardware and data
and the risk to human life.
Fire Safety Factors
Typical Ignition sources are:
 Failures of electric devices and wiring,
 Carelessly discarded cigarettes,
 Improper storage of materials subject to
spontaneous combustion,
 Improper operation of heating devices ..etc.
Fire Safety Factors
Fire resistant buildings
 Put away Fuel Sources.
 Fire Detection devices.
 Fire Extinguishment devices

Failure of Supporting Utilities
This applies to electric power distribution,
Electromagnetic waves or magnetic fields,
water, sewage , humidity, dust, smoke
failures of heating and air-conditioning
systems.
Failure of Supporting Utilities
Operating and security personnel should have
rescue information immediately available for
use in an emergency.
In some cases, it may be possible to relocate
system hardware, particularly distributed LAN
hardware.
Mobile and Portable Systems
Portable and mobile systems share an
increased risk of theft and physical damage.
In addition, portable systems can be
"misplaced" or left unattended by careless
users.
Mobile and Portable Systems
Secure storage of Portable (laptop, backup
media .. etc) computers is often required
when they are not in use.
Depending on the sensitivity of the system and
its application, it may be appropriate to require
signed briefing acknowledgments of users.
Access Control
Access is the ability to do something with a
computer resource. This usually refers to a
technical ability (e.g., read, create, modify, or
delete a file, execute a program, or use an
external connection).

Access Control


Authorization is the permission to use a
computer resource. Permission is granted,
directly or indirectly, by the application or
system owner.
Authentication is proving (to some
reasonable degree) that users are who they
claim to be.
Access Control
Access control often requires that the
system be able to identify and differentiate
among users.
IDENTIFICATION AND AUTHENTICATION
 Identification and authentication (I&A) is the
first line of defense.
 I&A is a technical measure that prevents
unauthorized people (or unauthorized
processes) from entering a computer system.

Access Control
Identification is the means by which a user
provides a claimed identity to the system.


Authentication is the means of establishing
the validity of this claim.
Access Control

There are three means of authenticating a
user's identity which can be used alone or
in combination:
1. Something the individual knows (a secret
e.g., a password, Personal Identification
Number (PIN), or cryptographic key);
Access Control
2. Something the individual possesses (a
token e.g., an ATM card or a smart card);
3. Something the individual is (a biometric
e.g., such characteristics as a voice pattern,
handwriting dynamics, or a fingerprint).
Access Control
Passwords: Benefits of Passwords.
Passwords have been successfully providing
security for computer systems.
 They are integrated into many operating
systems, and users and system
administrators are familiar with them. When
properly managed in a controlled
environment, they can provide effective
security.

Access Control
Problems With Passwords.
1. Guessing or finding passwords.
2. Giving passwords away.
3. Electronic monitoring (When passwords
are transmitted to a computer system).
4. Accessing the password file.

Access Control


Cryptographic Keys
the authentication derived from the
knowledge of a cryptographic key may be
based entirely on something the user knows,
(or have access to) something that can
perform the cryptographic computations,
such as a PC or a smart card.
Access Control



Memory Tokens
Memory tokens store, but do not process,
information. Special reader/writer devices
control the writing and reading of data to and
from the tokens.
The most common type of memory token is a
magnetic striped card.
Access Control


Application of memory tokens for
authentication to computer systems is the
Automatic Teller Machine (ATM) card. This
uses a combination of the user (card) with
the user (PIN).
Memory tokens when used with PINs provide
more security than passwords.
Access Control



Smart Tokens
expands the functionality of a memory token
by incorporating one or more integrated
circuits into the token itself.
A smart token typically requires a user also
to provide something the user knows (i.e., a
PIN or password) in order to "unlock" the
smart token for use.
Access Control
Benefits of Smart Tokens
1.One-time passwords.
2.Reduced risk of forgery.
3.Multi-application.

Access Control

Biometric authentication use the unique
characteristics of an individual to
authenticate that person‘s identity.
These include physiological attributes (such
as fingerprints, hand geometry, or retina
patterns) or behavioral attributes (such as
voice patterns and hand-written signatures).
Access Control


Biometric systems provide an increased
level of security for computer systems.
Imperfections in biometric authentication
devices arise from technical difficulties in
measuring and profiling physical attributes as
well as from the variable nature of physical
attributes.
Access Control

Due to their relatively high cost, biometric
systems are typically used with other
authentication means in environments
requiring high security.