Traditional Security Issues

Август 8, 2022

Главная
Информатика
Traditional Security Issues

Содержание

2. Security in the Real World Professionals must address: Specification/Policy Requirements, analysis, planning,… Implementation/mechanisms Algorithms, protocols, components,
3. Terms for Activities Related to E-Commerce Security Authentication Identification of a user for access Authorization Defining
4. Briefly: Security Policy You should define a security policy document for your site or application A
5. What’s Coming in this Unit?
6. Authentication Proving a user is who they say they are Methods? Passwords Digital signatures, digital certificates
7. Authorization We won’t say much about this Approaches include: Access control lists Capabilities Multi-level security systems
8. Non-Repudiation Non-repudiation of origin proves that data has been sent Non-repudiation of delivery proves it has
9. Digital Certificates “On the Internet, no one knows you’re a dog.” Or do they? For commerce,
10. SSL: Secure Socket Layer A network protocol layer between TCP and the application. Provides: Secure connection
12. Скачать презентацию

Слайд 2

Security in the Real World
Professionals must address:
Specification/Policy
Requirements, analysis, planning,…
Implementation/mechanisms
Algorithms, protocols, components,

etc.
Correctness/assurance
Proof, testing, verification, attacks, etc.
The Human Factor
Protecting against “bad” users and clever attackers
All critical: CS453 focuses on the 2nd item

Слайд 3

Terms for Activities Related to E-Commerce Security
Authentication
Identification of a user for

access
Authorization
Defining and enforcing rules or levels of access
Repudiation
A party later denying a transaction has occurred
Goal: insuring non-repudiation

Слайд 4

Briefly: Security Policy
You should define a security policy document for your

site or application
A form of non-functional requirements
Might include:
General philosophy toward security (high-level goals etc.)
Items to be protected
Who’s responsible for protecting them
Standards and measures to be used: how to measure to say you’ve built a secure system

Слайд 5

What’s Coming in this Unit?

Слайд 6

Authentication
Proving a user is who they say they are
Methods?
Passwords
Digital signatures, digital

certificates
Biometrics (fingerprint readers etc.)
Smart cards and other HW
We’ll discuss
Cryptography
Mechanisms: algorithms, web servers, biometrics, SSL

Слайд 7

Authorization
We won’t say much about this
Approaches include:
Access control lists
Capabilities
Multi-level security systems

Слайд 8

Non-Repudiation
Non-repudiation of origin
proves that data has been sent
Non-repudiation of delivery
proves it

has been received
Digital signatures
And more crypto

Слайд 9

Digital Certificates
“On the Internet, no one knows you’re a dog.”
Or do

they?
For commerce, we can’t always allow anonymity
How does UVa’s NetBadge work?
http://www.itc.virginia.edu/netbadge/
Public Key Infrastructure (PKI)
Certifying Authorities in the commercial world
E.g. VeriSign

Слайд 10

SSL: Secure Socket Layer
A network protocol layer between TCP and the

application. Provides:
Secure connection – client/server transmissions are encrypted, plus tamper detection
Authentication mechanisms
From both client’s point of view and also server’s
Is the other side trusted, who they say they are? Using certificates
Is the Certificate Authority trusted?

Traditional Security Issues

Содержание

Security in the Real WorldProfessionals must address:Specification/PolicyRequirements, analysis, planning,…Implementation/mechanismsAlgorithms, protocols, components,

Terms for Activities Related to E-Commerce SecurityAuthenticationIdentification of a user for

Briefly: Security PolicyYou should define a security policy document for your

What’s Coming in this Unit?

AuthenticationProving a user is who they say they areMethods?PasswordsDigital signatures, digital

AuthorizationWe won’t say much about thisApproaches include:Access control listsCapabilitiesMulti-level security systems

Non-RepudiationNon-repudiation of originproves that data has been sentNon-repudiation of deliveryproves it

Digital Certificates“On the Internet, no one knows you’re a dog.”Or do

SSL: Secure Socket LayerA network protocol layer between TCP and the

Похожие презентации