Notes for January 6, 1997

1. Hello
   1. Pass out, go through class information handout
   2. Puzzle of the day: something to think about for the class. May or may not be a right or wrong answer.
   3. Project: more on this on Friday; can work as teams of 3 or less, or as individuals
2. Puzzle of the day
   1. Have class comment, etc.
   2. Point is the security policy completely defines "security"
3. Amplifcation
   1. Student breaks in, reports break in. What happens?
   2. In real incident: account suspended. Should have asked first.
   3. No longer true that breaking in gets you a job.
4. What is security?
   1. Defined strictly by a "security policy"; axiomatic
   2. 3 components: confidentiality, integrity, availability
5. Confidentiality
   1. Hiding things; cryptography, access control
   2. May need to hide fact that anything is hidden; steganography, capabilities (if it can't be named, it can't be accessed)
   3. Discuss "security through obscurity" here
6. Integrity
   1. Making sure contents aren't tampered with
   2. Data integrity: what you sent is what arrives (cryptographic checksums, access controls)
   3. Origin integrity: identity of originator is associated with message (authenticator, digital signature)
7. Availability
   1. Being sure access is possible ("denial of service")
   2. May be an issue of access permissions, cryptographic keys
   3. May be related to other, non-security problems
8. Trust and Systems
   1. What can you trust?
   2. What do you trust - OS, compilers, libraries, etc.
   3. Concept of a TCB