In computer security a
countermeasure is an action, device, procedure, or technique that reduces a threat,
a vulnerability, or an attack by eliminating or preventing it, by minimizing
the harm it can cause, or by discovering and reporting it so that corrective
action can be taken.
Some common countermeasures
are listed in the following sections:
Security
by design
Main
article: Secure by design
Security by design, or
alternately secure by design, means that the software has been designed from
the ground up to be secure. In this case, security is considered as a main
feature.
Some of the techniques in
this approach include:
- The principle of least
privilege, where each part of the system has only the privileges that are
needed for its function. That way even if an attacker gains access to that
part, they have only limited access to the whole system.
- Automated theorem proving to
prove the correctness of crucial software subsystems.
- Code reviews and unit testing,
approaches to make modules more secure where formal correctness proofs are
not possible.
- Defense in depth, where the
design is such that more than one subsystem needs to be violated to compromise
the integrity of the system and the information it holds.
- Default secure settings, and
design to "fail secure" rather than "fail insecure"
(see fail-safe for the equivalent in safety engineering). Ideally, a
secure system should require a deliberate, conscious, knowledgeable and
free decision on the part of legitimate authorities in order to make it
insecure.
- Audit trails tracking system
activity, so that when a security breach occurs, the mechanism and extent
of the breach can be determined. Storing audit trails remotely, where they
can only be appended to, can keep intruders from covering their tracks.
- Full disclosure of all
vulnerabilities, to ensure that the "window of vulnerability" is
kept as short as possible when bugs are discovered.
Security
architecture
The Open Security
Architecture organization defines IT security architecture as "the design artifacts
that describe how the security controls (security countermeasures) are
positioned, and how they relate to the overall information technology
architecture. These controls serve the purpose to maintain the system's quality
attributes: confidentiality, integrity, availability, accountability and assurance
services".
Techopedia defines security
architecture as "a unified security design that addresses the necessities
and potential risks involved in a certain scenario or environment. It also
specifies when and where to apply security controls. The design process is
generally reproducible." The key attributes of security architecture are:
- the relationship of different
components and how they depend on each other.
- the determination of controls
based on risk assessment, good practice, finances, and legal matters.
- the
standardization of controls.
Security measures
A state of computer
"security" is the conceptual ideal, attained by the use of the three
processes: threat prevention, detection, and response. These processes are
based on various policies and system components, which include the following:
- User account access controls
and cryptography can protect systems files and data, respectively.
- Firewalls are by far the most
common prevention systems from a network security perspective as they can
(if properly configured) shield access to internal network services, and
block certain kinds of attacks through packet filtering. Firewalls
can be both hardware- or software-based.
- Intrusion Detection System
(IDS) products are designed to detect network attacks in-progress and
assist in post-attack forensics, while audit trails and logs serve a
similar function for individual systems.
- "Response" is
necessarily defined by the assessed security requirements of an individual
system and may cover the range from simple upgrade of protections to
notification of legal authorities, counter-attacks, and the like. In some
special cases, a complete destruction of the compromised system is
favored, as it may happen that not all the compromised resources are
detected.
Today, computer security
comprises mainly "preventive" measures, like firewalls or an exit
procedure. A firewall can be defined as a way of filtering network data between
a host or a network and another network, such as the Internet, and can be
implemented as software running on the machine, hooking into the network stack
(or, in the case of most UNIX-based operating systems such as Linux, built into
the operating system kernel) to provide real time filtering and blocking.
Another implementation is a so-called "physical firewall", which
consists of a separate machine filtering network traffic. Firewalls are common
amongst machines that are permanently connected to the Internet.
Some organizations are
turning to big data platforms, such as Apache Hadoop, to extend data
accessibility and machine learning to detect advanced persistent threats.
However, relatively few
organisations maintain computer systems with effective detection systems, and
fewer still have organised response mechanisms in place. As result, as Reuters
points out: "Companies for the first time report they are losing more
through electronic theft of data than physical stealing of assets".[81]
The primary obstacle to effective eradication of cyber crime could be traced to
excessive reliance on firewalls and other automated "detection"
systems. Yet it is basic evidence gathering by using packet capture appliances
that puts criminals behind bars.[citation needed]
Vulnerability
management
Main
article: Vulnerability management
Vulnerability management is
the cycle of identifying, and remediating or mitigating vulnerabilities",
especially in software and firmware. Vulnerability management is integral to
computer security and network security.
Vulnerabilities can be
discovered with a vulnerability scanner, which analyzes a computer system in
search of known vulnerabilities,such as open ports, insecure software
configuration, and susceptibility to malware
Beyond vulnerability
scanning, many organisations contract outside security auditors to run regular penetration
tests against their systems to identify vulnerabilities. In some sectors this
is a contractual requirement.
Reducing
vulnerabilities
While formal verification
of the correctness of computer systems is possible it is not yet common.
Operating systems formally verified include seL4,and SYSGO's PikeOS – but these
make up a very small percentage of the market.
Cryptography properly
implemented is now virtually impossible to directly break. Breaking them
requires some non-cryptographic input, such as a stolen key, stolen plaintext
(at either end of the transmission), or some other extra cryptanalytic
information.
Two factor authentication
is a method for mitigating unauthorized access to a system or sensitive
information. It requires "something you know"; a password or PIN, and
"something you have"; a card, dongle, cellphone, or other piece of
hardware. This increases security as an unauthorized person needs both of these
to gain access.
Social engineering and
direct computer access (physical) attacks can only be prevented by non-computer
means, which can be difficult to enforce, relative to the sensitivity of the
information. Training is often involved to help mitigate this risk, but even in
a highly disciplined environments (e.g. military organizations), social
engineering attacks can still be difficult to foresee and prevent.
It is possible to reduce an
attacker's chances by keeping systems up to date with security patches and
updates, using a security scanner or/and hiring competent people responsible
for security. The effects of data loss/damage can be reduced by careful backing
up and insurance.
Hardware
protection mechanisms
See also: Computer
security compromised by hardware failure
While hardware may be a
source of insecurity, such as with microchip vulnerabilities maliciously
introduced during the manufacturing process, hardware-based or assisted
computer security also offers an alternative to software-only computer
security. Using devices and methods such as dongles, trusted platform modules,
intrusion-aware cases, drive locks, disabling USB ports, and mobile-enabled
access may be considered more secure due to the physical access (or
sophisticated backdoor access) required in order to be compromised. Each
of these is covered in more detail below.
- USB dongles are typically used
in software licensing schemes to unlock software capabilities, but they
can also be seen as a way to prevent unauthorized access to a computer or
other device's software. The dongle, or key, essentially creates a secure
encrypted tunnel between the software application and the key. The
principle is that an encryption scheme on the dongle, such as Advanced
Encryption Standard (AES) provides a stronger measure of security, since
it is harder to hack and replicate the dongle than to simply copy the
native software to another machine and use it. Another security
application for dongles is to use them for accessing web-based content
such as cloud software or Virtual Private Networks (VPNs).In addition, a
USB dongle can be configured to lock or unlock a computer.
- Trusted platform modules (TPMs)
secure devices by integrating cryptographic capabilities onto access
devices, through the use of microprocessors, or so-called
computers-on-a-chip. TPMs used in conjunction with server-side software
offer a way to detect and authenticate hardware devices, preventing
unauthorized network and data access.
- Computer case intrusion
detection refers to a push-button switch which is triggered when a
computer case is opened. The firmware or BIOS is programmed to show an
alert to the operator when the computer is booted up the next time.
- Drive locks are essentially
software tools to encrypt hard drives, making them inaccessible to
thieves.Tools exist specifically for encrypting external drives as well.
- Disabling USB ports is a
security option for preventing unauthorized and malicious access to an
otherwise secure computer. Infected USB dongles connected to a network
from a computer inside the firewall are considered by the magazine Network
World as the most common hardware threat facing computer networks.
- Mobile-enabled access devices
are growing in popularity due to the ubiquitous nature of cell phones.
Built-in capabilities such as Bluetooth, the newer Bluetooth low energy
(LE), Near field communication (NFC) on non-iOS devices and biometric
validation such as thumb print readers, as well as QR code reader software
designed for mobile devices, offer new, secure ways for mobile phones to
connect to access control systems. These control systems provide computer
security and can also be used for controlling access to secure buildings.
Secure
operating systems
Main
article: Security-evaluated operating system
One use of the term
"computer security" refers to technology that is used to implement
secure operating systems. In the 1980s the United States Department of Defense
(DoD) used the "Orange Book" standards, but the current international
standard ISO/IEC 15408, "Common Criteria" defines a number of
progressively more stringent Evaluation Assurance Levels. Many common operating
systems meet the EAL4 standard of being "Methodically Designed, Tested and
Reviewed", but the formal verification required for the highest levels
means that they are uncommon. An example of an EAL6 ("Semiformally
Verified Design and Tested") system is Integrity-178B, which is used in
the Airbus A380 and several military jets.
Secure
coding
Main
article: Secure coding
In software engineering, secure
coding aims to guard against the accidental introduction of security
vulnerabilities. It is also possible to create software designed from the
ground up to be secure. Such systems are "secure by design". Beyond
this, formal verification aims to prove the correctness of the algorithms
underlying a system; important for cryptographic protocols for example.
Capabilities
and access control lists
Main
articles: Access control list and Capability (computers)
Within computer systems,
two of many security models capable of enforcing privilege separation are access
control lists (ACLs) and capability-based security. Using ACLs to confine
programs has been proven to be insecure in many situations, such as if the host
computer can be tricked into indirectly allowing restricted file access, an
issue known as the confused deputy problem. It has also been shown that the
promise of ACLs of giving access to an object to only one person can never be
guaranteed in practice. Both of these problems are resolved by capabilities.
This does not mean practical flaws exist in all ACL-based systems, but only
that the designers of certain utilities must take responsibility to ensure that
they do not introduce flaws.[citation needed]
Capabilities have been
mostly restricted to research operating systems, while commercial OSs still use
ACLs. Capabilities can, however, also be implemented at the language level,
leading to a style of programming that is essentially a refinement of standard
object-oriented design. An open source project in the area is the E language.
The most secure computers
are those not connected to the Internet and shielded from any interference. In
the real world, the most secure systems are operating systems where security is
not an add-on.
Response
to breaches
Responding forcefully to
attempted security breaches (in the manner that one would for attempted
physical security breaches) is often very difficult for a variety of reasons:
- Identifying attackers is
difficult, as they are often in a different jurisdiction to the systems
they attempt to breach, and operate through proxies, temporary anonymous
dial-up accounts, wireless connections, and other anonymising procedures
which make backtracing difficult and are often located in yet another
jurisdiction. If they successfully breach security, they are often able to
delete logs to cover their tracks.
- The sheer number of attempted
attacks is so large that organisations cannot spend time pursuing each
attacker (a typical home user with a permanent (e.g., cable modem) connection
will be attacked at least several times per day, so more attractive
targets could be presumed to see many more). Note however, that most of
the sheer bulk of these attacks are made by automated vulnerability
scanners and computer worms.
- Law enforcement officers are
often unfamiliar with information technology, and so lack the skills and
interest in pursuing attackers. There are also budgetary constraints. It
has been argued that the high cost of technology, such as DNA testing, and
improved forensics mean less money for other kinds of law enforcement, so
the overall rate of criminals not getting dealt with goes up as the cost
of the technology increases. In addition, the identification of attackers
across a network may require logs from various points in the network and
in many countries, the release of these records to law enforcement (with
the exception of being voluntarily surrendered by a network administrator
or a system administrator) requires a search warrant and, depending on the
circumstances, the legal proceedings required can be drawn out to the
point where the records are either regularly destroyed, or the information
is no longer relevant.
