IntroductiontoInformationSecurityAsofJanuary2008,theinternetconnectedanestimated541.7millioncomputersinmorethan250countriesoneverycontinent,evenAntarctica(Source:InternetSoftwareConsortium’sInternetDomainSurvey;www.isc.org/index.pl).Theinternetisnotasinglenetwork,butaworldwidecollectionoflooselyconnectednetworksthatareaccessiblebyindividualcomputerhosts,inavarietyofways,toanyonewithacomputerandanetworkconnection.Thus,individualsandorganizationscanreachanypointontheinternetwithoutregardtonationalorgeographicboundariesortimeofday.However,alongwiththeconvenienceandeasyaccesstoinformationcomerisks.Amongthemaretherisksthatvaluableinformationwillbelost,stolen,changed,ormisused.Ifinformationisrecordedelectronicallyandisavailableonnetworkedcomputers,itismorevulnerablethanifthesameinformationisprintedonpaperandlockedinafilecabinet.Intrudersdonotneedtoenteranofficeorhome;theymaynotevenbeinthesamecountry.Theycanstealortamperwithinformationwithouttouchingapieceofpaperoraphotocopier.Theycanalsocreatenewelectronicfiles,runtheirownprograms,andhideevidenceoftheirunauthorizedactivity.BasicSecurityConceptsThreebasicsecurityconceptsimportanttoinformationontheinternetareconfidentiality,integrity,andavailability.Conceptsrelatingtothepeoplewhousethatinformationareauthentication,authorization,andnonrepudiation.Wheninformationisreadorcopiedbysomeonenotauthorizedtodoso,theresultisknownaslossofconfidentiality.Forsometypesofinformation,confidentialityisaveryimportantattribute.Examplesincluderesearchdata,medicalandinsurancerecords,newproductspecifications,andcorporateinvestmentstrategies.Insomelocations,theremaybealegalobligationtoprotecttheprivacyofindividuals.Thisisparticularlytrueforbanksandloancompanies;debtcollectors;businessesthatextendcredittotheircustomersorissuecreditcards;hospitals,doctors’offices,andmedicaltestinglaboratories;individualsoragenciesthatofferservicessuchaspsychologicalcounselingordrugtreatment;andagenciesthatcollecttaxes.Informationcanbecorruptedwhenitisavailableonaninsecurenetwork.Wheninformationismodifiedinunexpectedways,theresultisknownaslossofintegrity.Thismeansthatunauthorizedchangesaremadetoinformation,whetherbyhumanerrororintentionaltampering.Integrityisparticularlyimportantforcriticalsafetyandfinancialdatausedforactivitiessuchaselectronicfundstransfers,airtrafficcontrol,andfinancialaccounting.Informationcanbeerasedorbecomeinaccessible,resultinginlossofavailability.Thismeansthatpeoplewhoareauthorizedtogetinformationcannotgetwhattheyneed.Availabilityisoftenthemostimportantattributeinservice-orientedbusinessesthatdependoninformation(forexample,airlineschedulesandonlineinventorysystems).1Availabilityofthenetworkitselfisimportanttoanyonewhosebusinessoreducationreliesonanetworkconnection.Whenuserscannotaccessthenetworkorspecificservicesprovidedonthenetwork,theyexperienceadenialofservice.Tomakeinformationavailabletothosewhoneeditandwhocanbetrustedwithit,organizationsuseauthenticationandauthorization.Authenticationisprovingthatauseristhepersonheorsheclaimstobe.Thatproofmayinvolvesomethingtheuserknows(suchasapassword),somethingtheuserhas(suchasa“smartcard”),orsomethingabouttheuserthatprovestheperson’sidentity(suchasafingerprint).Authorizationistheactofdeterminingwhetheraparticularuser(orcomputersystem)hastherighttocarryoutacertainactivity,suchasreadingafileorrunningapr...
优质VIP
