Computer Systems Security

Lec1 - Introduction

CIA

1. Confidentiality： Preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information. 保护用户隐私
2. Integrity： Guarding against improper information modification or destruction, including ensuring information nonrepudiation and authenticity. 确保信息的可依赖性和真实性
3. Availability： Ensuring timely and reliable access to and use of information. 及时可靠地获取信息。

Terminology

System Resource (Asset)：

What assets do we need to protect?

Hardware， Software， Data， Communication facilities and networks

Security Policy 安全策略： 一组规则和实践，指定或规范系统或组织如何提供安全服务来保护敏感和关键的系统资源。比如：“Only authorized user may access this file.”
Vulnerability 弱点： 系统设计、实现或操作和管理中的缺陷或弱点，可被利用来违反系统的安全策略。比如：A weakness in a firewall that can lead to malicious hackers getting into a computer network
Exploit： Term also refers to the code or methodology used to take advantage of a vulnerability.
Threat： A potential for violation of security, which exists when there is a circumstance, capability, action, or event, that could breach security and cause harm.

vulnerability和threat比较：

1. Vulnerabilities are not introduced to a system; rather they are there from the beginning
2. Threats are introduced to a system like a virus download or a social engineering attack
3. a threat is a possible danger that might exploit a vulnerability.

Attack： ·