Computer and network security is both fascinating and complex for several reasons:
1. Complexity of Security: Security is not as straightforward as it may seem to the novice. While requirements such as confidentiality, authentication, non-repudiation, and integrity have clear labels, the mechanisms created to meet these requirements are often intricate and may require subtle reasoning to understand.
2. Anticipating Attacks: When developing security mechanisms or algorithms, potential attacks must be anticipated. Often, successful attacks exploit an unexpected weakness by viewing the problem from a completely different perspective.
3. Counterintuitive Procedures: Security mechanisms often use counterintuitive measures. Although the complexity of these mechanisms might not be immediately apparent from the stated requirements, they become necessary when examining the various threats involved.
4. Placement of Security Measures: Once security mechanisms are developed, deciding where to implement them is crucial. This involves both physical placement (such as specific points in a network) and logical placement (such as determining the appropriate layers in an architecture like TCP/IP).
5. Integration with Protocols and Secrets: Security mechanisms require more than just algorithms or protocols; they rely on secret information, like encryption keys, which must be securely created, distributed, and protected. Protocols must also be compatible, which can be challenging if, for instance, message transit times are variable and unpredictable.
6. Battle of Wits: Security is a constant battle between attackers looking for vulnerabilities and designers or administrators tasked with closing these gaps. Attackers need only find one weakness, whereas defenders must identify and address all vulnerabilities to achieve perfect security.
7. Perception of Security Investment: Users and system managers often see little benefit in investing in security until a failure occurs, leading to a lack of proactive security measures.
8. Continuous Monitoring Need: Security requires regular, constant monitoring, which is challenging in today's fast-paced, resource-constrained environments.
9. Security as an Afterthought: Security is frequently considered after the design of a system, rather than being integrated into the design process from the start.
10. Perceived Impediments: Many users and even security administrators see strong security as a hindrance to efficient and user-friendly operation of information systems.
The difficulties outlined above will be encountered in various ways as we explore different security threats and mechanisms throughout this book.
0 Comments