Fundamental Security Design Principles and Mechanisms in Information Security, Lecture notes of Information Systems

Download Fundamental Security Design Principles and Mechanisms in Information Security and more Lecture notes Information Systems in PDF only on Docsity!

Information Security

Lecture3,

PROF: ZAHEER DAR

Outline

What we studied:  We will discuss the fundamental security design principles.  Also discuss the security mechanisms

Cont…

 Authentication – two entities exchange same massages to prove their identity to each other e.g. use password, fingerprint.  Routing Control – increase filter malicious traffic.  Access Control – specify access rights based on the user id, role/group to specific transactions.  Data Confidentiality – encrypt information using a specific algorithm

Security Design Principles

The security design principles are considered while designing any security mechanism for a system. These principles are review to develop a secure system which prevents the security flaws and also prevents unwanted access to the system.

Cont…

 Complete Mediation  It states that every access to every resource must be validated for authorization.  Open Design  Concept that the security of a system and its algorithms should not be dependent on secrecy of its design or implementation.

Cont…

 Separation Privilege  It requires that all resource approved resource access attempts be granted based on more than a single condition.  Least Privilege  It requires a minimalistic approach to granting user access rights to specific information and tools.

Cont…

 Defense in Depth  A concept of layering resource access authorization verification in a system reduces the chance of a successful attack. This layered approach to resource authorization requires unauthorized users to circumvent each authorization attempt to gain access to a resource.