Chapter 1.

Security Overview

Because of the increased reliance on powerful, networked computers to help run businesses and keep

track of our personal information, industries have been formed around the practice of network and

computer security. Enterprises have solicited the knowledge and skills of security experts to prop 

erly audit systems and tailor solutions to fit the operating requirements of the organization. Because

most organizations are dynamic in nature, with workers accessing company IT resources locally and

remotely, the need for secure computing environments has become more pronounced.

Unfortunately, most organizations (as well as individual users) regard security as an afterthought, a

process that is overlooked in favor of increased power, productivity, and budgetary concerns. Proper

security implementation is often enacted "postmortem"   after an unauthorized intrusion has already

occurred. Security experts agree that the right measures taken prior to connecting a site to an untrusted

network such as the Internet is an effective means of thwarting most attempts at intrusion.

1.1. What is Computer Security?

Computer security is a general term that covers a wide area of computing and information processing.

Industries that depend on computer systems and networks to conduct daily business transactions and

access crucial information regard their data as an important part of their overall assets. Several terms

and metrics have entered our daily business lives, such as total cost of ownership (TCO) and quality of

service (QoS). In those metrics, industries calculate aspects such as data integrity and high availability

as part of their planning and process management costs. In some industries, such as electronic com 

merce, the availability and trustworthiness of data can be the difference between success and failure.

1.1.1. How did Computer Security Come about?

Many readers may recall the movie "Wargames", starring Matthew Broderick in his portrayal of a

high school student that breaks into the United States Department of Defense (DOD) supercomputer

and inadvertently causes a nuclear war threat. In this movie, Broderick uses his modem to dial into the

DOD computer (called WOPR) and plays games with the artificially intelligent software controlling

all of the nuclear missile silos. The movie was released during the "cold war" between the former

Soviet Union and the United States, and was considered a success in its theatrical release in 1983.

The popularity of the movie inspired many individuals and groups to begin implementing some of the

methods that the young protagonist used to crack restricted systems, including what is known as war

dialing   a method of searching phone numbers for analog modem connections in an defined area

code and phone prefix combination.

More than 10 years later, after a four year, multi jurisdictional pursuit involving the Federal Bureau

of Investigation (FBI) and the aid of computer professionals across the country, infamous computer

cracker Kevin Mitnick was arrested and charged with 25 counts of computer and access device fraud

that resulted in an estimated US$80 Million in losses of intellectual property and source code from

Nokia, NEC, Sun Microsystems, Novell, Fujitsu, and Motorola. At the time, the FBI considered it the

largest single computer related criminal offense in U.S. history. He was convicted and sentenced to

a combined 68 months in prison for his crimes, of which he served 60 months before his parole on

January 21, 2000. He has been further barred from using computers or doing any computer related

consulting until 2003. Investigators say that Mitnick was an expert in social engineering   using

human beings to gain access to passwords and systems using falsified credentials.

Information security has evolved over the years due to the increasing reliance on public networks to

disclose personal, financial, and other restricted information. There are numerous instances such as

the Mitnick and the Vladamir Levin case that prompted organizations across all industries to rethink