Computer Systems Security - Essay Example

Computer Systems Security Introduction The world today has been reduced to a global network. In this connected electronic world, information seems to sprawl every nook and corner. Due to the distributed character of enterprises today, data can be accessed from a number of locations. More importantly, data that was assumed to be stored safely in an organization seems to be migrating out of it, raising privacy concerns and questioning the security of digital storage and distant, scattered workforce. The Chief Information Security Officer for eBay Marketplaces, Dave Cullinane, refers to this as the “de-perimeterization of security” where it has become difficult to demarcate the line between a firm and its clients, suppliers and partners (PGP Corporation, 2007). Enforcing effective security standards is a challenge in this complex milieu. There are many reasons as to why information is on longer safe and there is a need for data protection and security. The notion that sensitive information is within the walls of the organization and so is safe is no longer justified. With the advancement in technology and the new computing form factors, information can be accessed by malicious insiders. The people who are responsible for administrating the systems can also present a risk to the bypass of sensitive information. It is not easy to define who has access to what information. This also necessitates that an effective security protocol must be present to ensure that sensitive data is not leaked out. Data protection is also necessary to build a bond of trust with the customers. When a customer approaches an organization, the organization is bound to protect his or her privacy. Not doing so can bring bad repute to the organization and cause it to lose its customers. Risk Assessment A comprehensive data security system encompasses an assessment of the associated risks and threats to data security. A strategy that includes a thorough assessment of these risks enables the organization to understand the value of the data that is at risk and the consequences of any loss. Data could be lost by many ways. One can be due to malicious infections. System crashes and natural happenings such as floods can also cause the loss of significant amount of sensitive data. When considering data protection, the organization needs to review who has access to what type of data, who used the Internet, who should be given limited access, what type of firewalls and anti-malware solutions need to be in place, the usage and maintenance of passwords and the training being given to staff (Spam laws, 2009). Only after analyzing these aspects is the organization able to prioritize the data according to the level of security needed. Securing Data Securing data includes two main components. One is the securing of data by protecting the hardware from external disturbances. Second includes the installation of encryption solutions, software and other options such as firewalls. In order to protect the office from intruders, alarms and monitoring systems can be introduced. The computers that contain high-profile data and their associated devices need to be placed out of the view of people, in offices where only qualified personnel is allowed. Protecting mobile data is also an important aspect of computer systems security. Measures to protect data on the move include never leaving the computer unattended or in the responsibility of an unauthorized person. The laptop or any other device which needs to be transported and contains critical information needs to be covered in protective casing. Also, the device should not be left in the car alone and visible by outsiders. Apart from these measures, there are other technical steps that can be taken to enhance the security of the data; the same are illustrated in the following discussion. User Authentication Authentication is another component of computer systems security that one deals with on a daily basis. Authentication is the process whereby the user proves that he is who he claims to be. Moreover, to authenticate means that the authentication attempt by the user is valid and authorized (Newman, 2009). There are many ways of ensuring that the user is an authorized person. The initial step is network logon. This ensures that only valid users are accessing the network. The second step is to enable user authentication on all servers. The user authentication system requires that the user logs in using a unique user name or number and password. The process of signing in allows the user privileges that are not available of he or she is not signed in. to further enhance the security protocol, the session can be timed to expire if the computer remains idle for a certain period of time. The user will have to enter his or her identification again in order to access the sensitive information. The authentication process can use either a manual entry or a dynamic one. A manual entry allows the user to choose the password that he or she wants. The password stays the same until the user changes it himself or herself. On the other hand if the user uses a dynamic entry, the password changes regularly. A device known as a security card can be utilized in order to put these changes into effect (Newman, 2009). The level of authentication implemented depends on the sensitivity of the data. For some data, a single sign-in process asking for the password would be sufficient. For other highly sensitive data, higher levels of authentication may be required and can include the user provides his or her fingerprint, smart card or a single chance to enter the password. For instance, authorization in Kerberos encompasses the concept of secret-key-based system. In Kerberos, the process of authentication generates the evidence for who the user is. The authenticated user is then issued a token called Ticket Granting Ticket, TGT. This ticket contains digital evidence about the user who has accessed the system. This token can then in turn be used to establish secure communication links with other Kerberos services (Gollman, Meier & Sabelfeld, 2006). Firewalls According to Webster’s New World Dictionary, firewall refers to a fireproof wall that prevents the spread of fire from one room to another (White, Fisch & Pooch, 1996). With the large number of computers that are connected to a network, it has become a challenge for network administrators from protecting computer systems. Although the concept of disconnecting a machine from another or from the network is in contrast to the main purpose of networking, many administrators are forced to consider this option in order to prevent a lapse in system security. An alternative method to protect the network from intruders is the installation of firewalls. Firewalls serve to restrict the access of outsiders to the network; therefore, they play a role in limiting damage. The importance of firewall lies in the fact that it protects the entire network from being infected by malicious information. If an organization places all the computers on a single network, the whole network will experience the brunt if a security lapse occurs. The situation becomes especially acute in access methods such as UNIX .rhosts file. Such files do not require the user to provide a password and allows open access to other systems that are mentioned on the file. The sort of threats that a firewall provides protection against include denying access to an intruder, denying service to an outsider as the outsider may send thousands of emails to fill available disk space or to load the system, and masquerading, which refers to electronic mail that appears to have originated by one person but has actually been forged by another in order to cause discomfort or embarrassment (White, Fisch & Pooch, 1996). Packet filtering, circuit-level gateways and application-level gateways can be used to prevent an outsider from gaining access rights into the system. Backup Solutions Data security would be incomplete if a backup solution has not been devised. Although data may appear to be secure and safe within the confines of the building, there is always a possibility that this data can be lost or tampered with. For example malware infection can impregnate into the network or system might crash. Therefore backup solutions would allow the administrator to build up their networks from scratch. It is also of significance to have backup of customer data since the business would not be compromised greatly if the original working copies of the date are lost. Database Security There are several measures that can be taken to ensure the security of the database. One of the foremost measures is to enable security controls. Nowadays, there is increased recognition of the importance of setting passwords in order to access databases. The patch level configuration of the database needs to be checked to check if there are any security holes in the default settings. Organizations also need to make a complete assessment of the database before storing any data in it. There is also no control of the database after it has been copied and so organization should not seek to make copies of databases. Access to the database should be restricted so that only authorized people have access to the information. When sharing data, subsetting can be applied. This replaces sensitive information with false information and allows new employees or less trustworthy domains to access the database without exposing confidential information (Spam Laws, 2009). Data Encryption Frequently there arises a need to protect information from prying eyes. In the modern electronic world, the very information that could be used to educate people or for other positive things to benefit the community can be used in negative ways if malicious users gain access to it. Also, industrial spying among businesses which are archrivals requires high levels of data protection (Pachghare, 2009). Data encryption is a method that uses mathematical algorithms to scramble information to hide its real meaning. It provides an effective method of transmitting information over large, dispersed networks. The information is protected from being understood by intruders since they are not able to understand the scrambled data (Muller, 2002). According to Dave Cullinane, encryption is the best available solution and the final line of defense for the protection of information that is private and sensitive (PGP Corporation, 2007). With the threats of security leak, the only method of ensuring a secure system is by encryption. The advantage of encryption is that data is protected if firewalls and other security measures have been breached. Whole disk encryption is becoming the first choice in computer systems security. It is especially recommended for laptops since their portability makes them more susceptible to being stolen and accessed by unauthorized personnel. It also serves to highlight the importance of protecting the information of the customers. If private and confidential information about the customer is stored on the laptop, it is necessary to have a strong security system in place that can not be bypassed by unauthorized personnel. Where laptop encryption is important, data encryption is equally pivotal in ensuring that the stored information is not accessible by outsiders to the organization and unauthorized insiders. The name of the customer and other information, if kept circulating in the network, can raise legal problems for the organization as the customer entrusted the organization to keep it private. Everyday, extensive information is shared via electronic mail. It has been observed that a lot of information regarding the customers is being exchanged via the email, and held at different points. Moreover, in other businesses, a lot of conversation between the organization and the client takes place via the email due to the reliability and quick communication that it offers. Therefore, emails need to be encrypted as any fissure or weakness during the communication process outside the organization can be exploited by opportunist malicious users and cause leakage of sensitive data. If the encrypted data is implemented along with error detection, it becomes even more effective at protecting the sensitive data from intruders. Not only is this effective, but is a low-cost way to secure a communications link. For instance, file encryption along with decryption at the user workstation enhances the security of both the file server and the transmission medium (Muller, 2002). Muller (2002) observes that encryption also offers the advantage of keeping the data secure from illicit taps and interception of spurious electromagnetic radiation. If the organization goes for online encryption, it needs to place encryption and decryption units at both ends of the communication link. Encryption can be done by either the hardware or the software. However it should be noted that hardware-based encryption is less time-consuming and offers greater security than software-based encryption. This is based on the assumption that an intruder who is competent at programming will have little know-how of hardware and would not be able to bypass the encryption hardware (Muller, 2002). The combination of full-disk hardware encryption along with certain parts of software is called end-based or end-point full disk encryption. Implementing an effective data encryption program It is assumed by companies that when they implement an encryption program, they are delivered from the responsibility of ensuring security of information. Simply implementing a data encryption program is not sufficient. The management and design of the encryption program is essential to the effective implementation of security measures. Also, companies need to be able to manage the key effectively. Decryption key refers to the string of characters that only the user is aware of and it allows the user to keep the data secure from access from unauthorized domains. Encryption keys also contain string of characters but these are used along with an algorithm to decode the scrambled data. This means that the intruder needs to know the encryption ke, after he has broken through the server, in order to decode information. Various encryption solutions encompass placing the key adjacent to the data they were encrypting. The risk behind such a measure is that if someone breaks into the server, he would have no difficulty in locating the key and subsequently decrypting the data. Cullinane observes that a secure and effective encryption solution should be able to equip the organizations with the ability to securely make, distribute, store, maintain, update and destroy keys so that they do not have to build these capabilities themselves (PGP Corporation, 2007). Moreover, effective implementation of the encryption program can only be possible when the organization has designed an encryption strategy. This includes that the organization makes an analysis of its requirements and identify the areas where sensitive information is stored as well as the purposes for which encryption is needed. In order to make the task of a secure protocol in place in all aspects, companies are installing and implementing enterprise encryption solutions. The advantage of such solutions is that the company does not need to buy a separate solution for database, laptop and email encryption but rather a single solution that can cover all aspects. Conclusion For a system administrator, the security of the organization system is of paramount importance (Kizza, 2009). There are many security measures that can be taken to ensure computer systems security. Measures such as keeping the system away from public view and protective casing keeps it secure from external influences. On the other hand, firewalls, database security measures, data encryption, backup solutions, user authentication etc. can be used to enhance the security of the computer system. Computer security spreads over a wide territory like locking the server and protecting login accounts. Therefore, computer security has long term benefits in preventing leakage of sensitive data and unauthorized access (Lehtinen, Russell & Russell, 2006). Reference List Gollman, D., Meier, J. & Sabelfeld, A., 2006. Computer security--ESORICS 2006: 11th European Symposium on Research in Computer Security, Hamburg, Germany, September 18-20, 2006 : proceedings. Springer. Kizza, J. M., 2009. A Guide to Computer Network Security. 2nd ed. Springer. Lehtinen, R., Russell. D. & Russell, G. T., 2006. Computer security basics. 2nd ed. OReilly Media, Inc. Muller, M. J., 2002. Network managers handbook. New York (NY): McGraw-Hill Professional. Newman, R. C., 2009. Computer Security: Protecting Digital Resources. Jones & Bartlett Learning. Pachghare, V. K., 2009. Cryptography and Information Security. New Delhi: PHI Learning Pvt. Ltd. PGP Corporation, 2007. PGP Webcast Summary-The Role of Encryption in Data Protection. [Online] Available from: http://download.pgp.com/pdfs/whitepapers/PGP-Cullinane-Webcast_WP_070205_F.pdf [Accessed 7 August 2010]. Spam Laws, 2009a. Database Security: Tips for Securing a Database for Small Business. [Online] Available from: http://www.spamlaws.com/database-security.html [Accessed 7 August 2010]. Spam Laws, 2009b. Why Data Security is of Paramount Importance. [Online] Available from: http://www.spamlaws.com/data-security-importance.html [Accessed 7 August 2010]. White, G. B., Fisch, E. A. & Pooch, U. W., 1996. Computer system and network security. Florida: CRC Press. Read More