|
Security threats are a fact of life in today's information-based economy. Protecting confidential data and restricting access to critical technology platforms is imperative to corporate survival.
The Internet is a door connecting you and your customers. When that door is left unguarded, however, others can find their way in. Worms like Code Red, Ramen, and Nimda exploit known software security flaws, often with disruptive and costly results. The reality: as long as networks are connected to the outside world, security threats won't go away. Your best defense: knowledge and frequent system updates.
There are four kinds of threats to the security of a computing system: interruprion, interception, modification and fabrication.
In an interruption an asset of the system becomes lost, unavailable, or unusable. An example is malicious destruction of a hardware device, erasure of a program or data file, or malfunction of an operating system file manager so that it cannot find a particular disk file.
An interception means that some unauthorized party has gained access to an asset. The outside party can be a person, a program, or a computing system. Examples of this type of failure are illicit copying of program or data files, or wiretapping to obtain data in a network. Although a loss may be discovered fairly quickly, a silent interceptior may leave no traces by which the interception can be readily detected.
If an unauthorized party not only accesses but tampers with an asset, the threat is a modification. For example, someone might change the values in a data base, alter a program so that it performs an additional computation, or modify data being transmitted electronically. It is even possible to modify hardware. Some cases of modification can be detected with simple measures, but other, more subtle changes may be almost impossible to detect.
Finally, an unauthorized party might fabricate counterfeit objects on a computing system. The intruder may insert spurious transactions to a network communication system, or add records to an existing data base. Sometimes these additions can be detected as forgeries, but if skillfully done, they are virtually indistinguishable from the real thing.
|
|
Gibson ResearchDenial of service
DoS - The Internett
CIS Charter
ZoneLabs - firewallSygate corp.
eEye Digital Security
CERT Coordiantion
Fight Spam
Network Abuse
Sam Spade.org (tools)
Atlas of Cyberspaces
Google searchHiAA homepage
Homepage IKT
Caplex encyclopaediaBritannica
|
