All language subtitles for 3. Course preview 15 min. long demo lecture. The whole training is 27 hours long11.

Welcome to the module focusing on the security of data in this module.

We'd like to think about why ensuring and maintaining confidentiality integrity and authenticity of

data should be the main purpose and role of computer security policies.

Let's start by reaching back to the essence of this problem.

Why does computer security usually fail against attacks.

The reason is that system users are often unaware of the threats they're facing and if they're unaware

they can't counteract the threats.

The second aspect of data security that relates both to users and administrators is a failure to clearly

identify the resources that require protection.

There's a common thinking pattern that pictures a safe computer network separated from the big bad internet

with a firewall.

This has been outdated for some time now.

You can't base your security policy on this type of assumption.

One problem that relates only to computer systems administrators is their unchecked belief in technology.

We tend to think subconsciously that since we've paid a lot of money for security solutions provided

by a popular brand they'll be completely reliable and efficient.

If you don't know the mechanisms behind a solution or technology or don't even know attack vectors running

a piece of software or a tool won't make you secure users and administrators need to keep track of new

developments and utilities in the system security field and deal with threats differently than it's

shown in the slide.

Why is this all so hard.

The main reason for this difficulty is a new growing trend known as the consumerization of I.T..

The tables have turned since the development of high tech software and devices in the past.

New technologies were enterprise led and only after time emerged on the consumer market devices were

customized for the needs and goals of businesses.

Today there's no recognizable boundary between consumer and corporate technology appliances and software

being designed with users in mind.

What are the effects of this reversal.

It's harder to say whether the Smartphone you're holding is a company device or a private device.

The same technology can be used at work and for play.

It wasn't quite this way a while back and this shift seems to have blurred the lines between business

computer systems and home systems.

New developments mean that more and more people can work from home and we use our own devices a laptop

or a smartphone for work.

System administrators have limited control over these devices.

If there's any control at all administrators can't force us to stop using our own devices because our

productivity would be lowered.

We can do some tasks remotely while travelling or on holidays.

Companies can't ban sending emails from outside their offices.

While this would improve security it just simply isn't feasible given this new emerging reality.

I.T. security staff have to reformulate their strategies and actions.

A good solution for this problem was introducing a new term.

It's ridiculous to say that our security measures are ineffective because script kids lunch exploits

remotely advanced persistent threat has a different ring to it though saying that we can be susceptible

to threats that are advanced and persistent is not equivalent to an admission of guilt.

APT was coined and defined in 2006 by the U.S. Army when the military began to realize that existing

computer security models were ineffective funds on fighting launched attacks were irrationally high

compared to the results.

Something had to be changed.

Originally app referred to persistent threats or those threats that were a long term risk.

A good example of persistent activity is the slew of attacks on American high tech companies that were

detected by Google and occurred from 2006 to 2007.

In this attack email boxes of the company's staff had been monitored for over a year.

Today advanced persistent threats are understood as attacks that successfully launch malicious software

on targeted computers malicious software is a broad term.

We'll show you why launching a program can cause an attacker to take over a system.

Local attacks and large scale attacks that exploit vulnerabilities in security systems.

We'll talk about this factor in the following modules.

By and large advanced persistent threats include internal attacks for the most part internal attacks

render any technological protection measures useless.

The last category of threats classed as apps are the attacks that target trusted communications channels.

The amount of information exchange between computer systems is huge intrusion detection systems implemented

in banks and insurance institutions often react only the active suspicious user actions.

Attackers exploit a tendency of specialist ideas tools to react to unauthorized claims payments but

ignore information extraction in protecting data is crucial to set up goals that you want to achieve.

Our first objective should be the confidentiality of data.

Confidentiality means that data is safeguarded against unauthorized access.

Information should be categorized according to its sensitivity.

It doesn't make sense to take measures for protecting information that's published online on a company's

Web site.

Any company will understandably be happy that there are visitors on the Web site internal information

it's the second class of information.

This category of data is available to a broad group of selected people for example for all the employees

in a company.

We wouldn't want unauthorized persons to access this type of information but it doesn't spell the end

of the world if a breach occurs.

The next category of information includes personal information personally identifiable information is

defined as information that can be used to easily and specifically identify a person to whom the information

relates national identification numbers like Social Security numbers are an obvious example of personal

information.

There's also sensitive data.

This class of data if disclosed to the public brings direct losses to a specific person.

The last data confidentiality category includes classified information.

This is the type of data that should only be accessed by trusted people.

Disclosing classified information deals a grievous blow to a company assigning a level of sensitivity

to data stored on a system fast tracked the implementation of a data security policy in a company.

If a company fails to introduce this policy this could end in the sort of situations you've seen in

previous modules where you can view classified sensitive and confidential information on the Internet

next to people's personal information.

Confidentiality of data has to be protected in some way.

In the past obtaining or extracting confidential data was a difficult feat.

The next time you see a person go through the garbage bins of your company.

Remember that the person does not have to be a beggar in search of food in the US the trash that's located

in a company's site belongs to that company.

Trespassing and stealing things from trash bins is illegal.

The contents of the bins only later become public property.

It's increasingly easy to find confidential information on the Internet.

Let's see how this can be done to do this we'll use a hacking technique that most of you know very well.

Google hacking.

We'll see if Google can be used to find some information on people who interest us.

We'll also find out if it's true that once a piece of information is put on the web it will exist there

forever.

Finally we'll also use specialist programs like focus to automate the process of finding information.

Let's start with a question Is it possible to completely erase a piece of information that has been

published online to find an answer we'll use a site called archive dot org.

There is a time machine called the wayback machine available on the site Let's type in any address you're

interested in.

For example Microsoft dot com and click on take me back after the search ends you'll be able to view

the archived versions of the page.

Let's start with 1996.

There are only a few copies of the page from that year.

Let's see how the Web site looked on October twenty ninth 1996 we have a chance to take a peek into

the past and see how the page looked in 1996.

All things on the page are related to one another and are still active.

You can read press information about Microsoft from 1996.

What's been put on the Internet stays on the internet forever.

Let's check now off a popular search engine like Google will enable us to find confidential information

on the Internet.

I have a few predefined queries which you've already seen on a slide.

We'll start with exploring whether there are any results for company Excel spreadsheets.

In other words Excel spreadsheets that relate to user accounts.

It take a lot of time and persistence to browse through all of these spreadsheets but I'll try to give

you a more interesting example and show another type of search.

This time we'll search for PDA files on military Web sites that contain the phrase top secret.

It doesn't seem likely that anyone would put these documents on the web does it.

But here you are.

If this picks your interest and you're not planning on visiting any of the countries that put up these

files go ahead and click on the links to find out what types of classified information can easily be

found on the web.

The crawling methods I've shown you are manual that can be automated though.

For example by using a tool like gulag scanner the application contains a simple set of Google queries

that fall into several categories.

There are for example video files containing juicy info like passwords Loggins and the like or software

errors messages that display sensitive information on a system.

Another category includes files containing usernames clicking on open in the browser will cause a search

engine with selected file types to be displayed instead of clicking on each file type.

You can select a whole category type in a page name that interests you.

For example example dot com and click on scan.

Notice that you don't connect to the site directly.

We don't search for information on the servers of a given company.

The query is not only sent to the Google search engine.

We're exploring what has already been indexed.

We'll be able to send bulk queries until search engines like Google block them.

As you can see in the slide 15 results have been returned all queries have been processed successfully

which means there are no files that contain user names in the results.

A small application called FOCA is a rather curious example of a search engine that crawls the web for

publicly available information.

It enables users to not only analyze selected Web sites but also the metadata that saved in the Web

site files will create a project by entering a Web site name.

For example Microsoft dot com using search engines like Google or Bing.

We can try to extract information on the network infrastructure the servers versions and so on.

We can try to ascertain whether or not there are any vulnerabilities or susceptibilities to a given

type of threat we can also read the metadata or the various documents opening the documents will extract

information on their creators to download an analyzed file right click on the document and select download.

Once you've downloaded the files that can be analyzed.

Click on extract metadata we'll extract all the metadata available for the document files from both

categories will be analyzed in sequence we have records for 10 users.

They're the creators of PDL documents or doc files.

We can view the information on when and in how many documents they use Open Office in Microsoft Office

and also see the versions of the operating systems that were used to create the documents.

All this metadata is contained in the files that we edit and save on a daily basis.

When you publish your files on the Internet you have to realize that the metadata will also be published

and be accessible.

Metadata discloses not only the information on a configuration of the system but also contains your

personal information.

FOCA is a great tool for extracting information of this type.

Thus far we've talked about data confidentiality.

This is the most relevant aspect and the first thing that springs to mind when data protection is concerned.

But this doesn't always have to be the case.

Sometimes the integrity of data is equally important data integrity refers to a situation when a given

message has not been modified by an unauthorized person did it integrity can be maintained by adding

specific check sums to the data.

This method also helps protecting the integrity of operating system files.

If a document you open has a different checksum than that of a document saved by a trusted user.

This points to a data integrity corruption.

Why is integrity so important.

Let's use online orders as an example.

If someone has spied that we've ordered five books.

This usually doesn't bother us.

But if that person modifies the order value from five to five hundred books we would be less than happy.

Integrity is a vital feature of information data.

Authenticity is another key aspect to data security.

Authenticity is a bit broader in scope than integrity.

Authenticity is a feature of information that ensures that the center of the data stream is legitimate

and that the data has not been modified after it was sent by a trusted sender.

This feature can be verified through the use of digital signatures.

We'll cover this in coming modules as we've stressed before.

You should not put too much faith in technology.

You can see an example of why limited trust is the best option.

It's a certificate for signing crucial information contained in system files or EMC files.

It was stolen and used to sign malicious software.

Authenticity is verified through digital signatures on files that are usually generated from certificates.

A certificate has an assigned level of trust.

A user can give the last feature of information is its availability.

Data availability is specified in an SLA service level agreement I.T. departments and business customers

are bound with the terms and conditions of an SLA.

The specifications of this contract define the maximum tolerable length of service unavailability and

determine the amounts of information that can be lost after a disaster.

You can find lots of information on SLA is on the Internet.

The key elements of the agreement are recovery time objective R O which is the duration of time in which

a service can be unavailable most often calculated and a percentage the closer to 100 percent the longer

the information needs to be available.

Recovery point objective RPO which is the amount of data that can be lost in the event of a failure

to recovery time objective forms the foundation of all SLA lays the measures the non-negotiable duration

of time within which information or services can be unavailable.

It is usually expressed as a number of nines if a given service is to be provided 365 days a year 24

hours a day seven days a week.

This means that an RTI value that has five nines ninety nine point nine nine nine percent can only be

shut down for whatever reason maintenance attacks threats for five minutes in a year agreeing on a five

nines RTL means that a given service or information has to be protected in a special way.

It's impossible to provide Nasedo this high if data is stored in one system only hosting companies usually

agreed to a four digit R2 yo under the same assumptions three nines mean that a service can shut down

for eight hours per year maximum.

You can't expect your only computer to be set up for the whole year without interruption and eight hours

will probably be too little to successfully deal with an attack or to restore a system after a failure.

Another part of an SLA which is defined in all contracts of this type is a recovery point objective

which is the measure that determines the amount of data that can be lost after an attack.

It's easier to ensure a recovery point objective of 0 percent.

It's a matter of replicating data and creating backups than to ensure ensuring Arto equaling ninety

nine point nine nine nine percent.

In the case of the auto high availability comes with the need for investing in expensive equipment.

Sellers are becoming increasingly popular and it's quite possible that you'll often be asked to sign

an SLA that determines the RPO as a 0 percent.

Businesses need the guarantee that whatever happens no data will be lost from the system.

We have few technologies that can ensure implementing good values of RTA and RPO will mention them later

on in the next modules of this course.

High availability of services usually require the use of specialist technologies.

There will also be covered in the next part of this course.

Thank you.