This article introduces the basic concepts of information security: threat, risk, vulnerability. It gives a first outline of the whole field, of its human, technical and organizational aspects, without providing a technical description of it.
Threats, risks and vulnerabilities
Information systems security (ISS) is a discipline of the first importance, because the information system (IS) is for any company an absolutely vital component.
Since the IS is vital, anything that threatens it is potentially fatal: this seems self-evident, and yet far too many employees can testify to the difficulties they have experienced in trying to convince their employers to devote some effort to the security of their IS. Warding off threats against the IS has become imperative, and the lines that follow are a brief description of what must be done to achieve this.
Threats against the information system fall into one of the following categories:
- harm to the availability of systems and data
- destruction, corruption or falsification of data
- theft of, or spying on, data
- unlawful use of a system or of a network
- use of a compromised system to attack other targets
Threats give rise to human and financial risks and costs: loss of confidentiality of sensitive data, unavailability of the infrastructure, damage to intellectual assets and to reputation. The risks can materialize if the threatened systems present vulnerabilities.
It is possible to estimate the notion of risk by describing it as the product of a harm by a probability of occurrence:
risk = harm x probability of occurrence
This formula expresses that an event whose probability of occurring is fairly high, for example the failure of a hard drive, but whose potential harm can be prevented through regular backups, will represent an acceptable risk.
The question of information systems security has been radically upended by the rapid development of the Internet, and it cannot be reduced to that. It is a vast problem of which the technical aspects are only one part. The legal, social, ergonomic, psychological and organizational aspects matter just as much, not forgetting the aspects relating to buildings, but we will begin with the technical aspects relating to computing.
Technical aspects of information security
Today's technical information security problems can, at least provisionally, be sorted into two broad categories:
- those concerning the security of the computer itself, server or workstation, of its operating system and of the data it holds.
- those arising directly or indirectly from the growth of networks, which multiplies the number and the seriousness of the threats.
While the problems of the first category mentioned here have existed since the birth of computing, it is clear that the growth of networks, and then of the Internet, has multiplied their potential impact by allowing them to be combined with those of the second category.
Reducing vulnerabilities rests on a number of principles and methods that we are going to examine.
Defining risks and the objects to be protected
Setting a perimeter and drawing up a security policy
There is no point in worrying about security without having defined what was to be protected: in other words, any organization wishing to protect its systems and its networks must determine its security perimeter.The security perimeter, within the physical world, marks the boundary between inside and outside, but its definition must encompass (or not) the intangible entities that populate computers and networks: essentially software, and in particular operating systems.
Once this perimeter has been set, a security policy must also be drawn up, that is to say a decision must be made about what is allowed and what is forbidden. To this are added, in principle, the laws and regulations in force, which apply to everyone. French law prohibits putting certain information online, but other countries have more permissive legislation; and who can prevent a foreign national from setting up an illegal download site in such a country, and attracting French Internet users to it?
Once your security policy has been established, you will be able to put in place the technical solutions appropriate to defending the perimeter according to the chosen policy. Technical measures will certainly not be able to solve every security problem. The very notion of a security perimeter is today undermined by phenomena such as the proliferation of laptops and other networked mobile computing objects which, by definition, move from the inside to the outside and back again. To this is added the extraterritorial nature of activities on the Internet.
Perimeters and borders
The notion of a security perimeter, as the previous paragraph already pointed out, becomes ever more fragile as the borders between the outside and the inside of the company, and between countries, become blurrier and more porous. Topographical considerations come into play here: laptops enter and leave the premises and the internal networks to go and be contaminated outside; but also logical considerations: which laws and which rules can apply to a server hosted in the United States, which belongs to a French company and which serves Argentinian and Mexican customers?
The French courts and the French Internet service providers (ISPs) have experienced this first-hand.
Public resources, private resources
Systems and networks contain data and programs that we consider to be resources. Some resources are publicly accessible, such as certain web servers; others are private to one person, such as an electronic mailbox; others still are private to a group of people, such as a company's internal telephone directory. This more or less public character of a resource must be expressed in the system in the form of access rights.
Identifying and authenticating
The people who access a non-public resource must be identified; their identity must be authenticated; their access rights must bechecked against the authorizations that have been granted to them. These three actions correspond to a first field of security techniques: the methods of authentication, signature, verification of the integrity of data and of the granting of rights.
Authorization
An authorization granted to a user and recorded in a suitable database is a list of access rights and powers formulated in such a way that a computer system can check them automatically.
The security of network access to a protected resource is not sufficiently guaranteed by the mere identification of those who perform it. On a local network of the Ethernet or Wi-Fi type, where data circulates according to the model of a radio broadcast that everyone is supposed to be able to pick up, it is possible for a third party to divert that circulation. If the transmission takes place across the Internet, the data travels in a way similar to a postcard, meaning that at least the postal worker and the caretaker have access to it. As soon as the data has to be protected, the techniques of another field of information security must be called upon: encryption.
Authentication and encryption are inseparable: encrypting without authenticating does not protect against identity spoofing (such as, for example, the interposition attack, called in English a man in the middle (MITM) attack), while authenticating without encrypting leaves the door open to data theft.
Preventing intrusions
These two security methods are not enough; protection must also be put in place against intrusions intended to destroy or corrupt data, or to make access to it impossible. The classic techniques against this risk are the use offirewalls (pare-feu in French) and the filtering of network communications, which make it possible to protect the private part of a network whose stations will be able to communicate with the Internet without being "visible" from it; the term visible expresses here that no system connected to the Internet can reach the machines of the local network on its own initiative (only the latter can start a dialogue), and that the filter blocks certain types of dialogue or of service, or certain correspondents (known to be dangerous).
Most companies set up computers that they wish to make accessible to outside visitors, such as their web server and their mail relay. Between the private network and the Internet, these public machines will be placed on a network segment open to access coming from outside, but relatively isolated from the internal network, so that a visitor from outside the company cannot reach the machines used strictly privately. Such a network segment is called a demilitarized zone (DMZ), in memory of the zone of the same name that was established between the belligerents at the end of the Korean War. The machines in the DMZ, exposed to the fire of the Internet, will be called bastions.
Some consider that these security techniques based on ramparts, drawbridges and watchtowers belong to the Middle Ages of computing; they prefer intrusion detection systems (IDS), which are more subtle. This innovation prompted a further step, proclaiming that if an intrusion has been detected, it may as well be stopped, and IDS thus became IPS (intrusion prevention systems). And we will see further on that IPS are criticized by the supporters of application proxies, which are more subtle still. That said, in a computing landscape where microcomputers and other communicating objects proliferate, it is hardly realistic to check the configuration of each one; filtering and the firewall therefore remain irreplaceable.
Article to be continued...