Information Security
Transcript: With Firewall connected scenario: Principles of Information Security , Michael E. Whitman and Herbert J. Mattord, 2012. Book 4th edition Information Security Protecting the Global Enterprise, Donald L. Pipkin, Book, 2000 www.consumers.ofcom.org.uk www.searchsecurity.techtarget.com www.en.wikipedia.org www.sans.org Fig 12 the configuration of VPN Tunnel Fig 16 Average client HTTP Traffic Received (bytes/sec)) for Sales B department Fig 13 Average client DB traffic Received (bytes/sec)) for Sales A department Experiment Fig 6 shows Statistics of Sales people A node and B node with Clients DB Maintenance and change Problem Definition Overview Analysis The E- government system is based on information technology and sharing of a large amount of sensitive information, resources, and assets. However the E – government systems are connected to the internet which allows an attackers to attack from anywhere over the world, the attackers they are an interested to find one vulnerability to take advantage of it. That means for installing malicious code that exploits that vulnerabilities, therefore the information security problem appears to be a challenge of the implementation or design of E- government. Whitman, and Mattord (pp12-13) provide the following description of the potential problems of information technology are defined below: Confidentiality: Information has confidentiality when it is protected from disclosure or exposure to unauthorised individuals or systems. Confidentiality ensures that only those with the rights and privileges to access information are able to do so. When unauthorised individuals or systems can view information, confidentiality is breached. Integrity: Information has integrity when it is whole, complete, and uncorrupted. The integrity of information is threatened when the information is exposed to corruption, damage, destruction, or other disruption of its authentic state. Corruption can occur while information is being stored or transmitted. Investigation The Committee on National Security Systems (CNSS) defines information security as the protection of information and its critical elements, including the systems and hardware that use, store and transmit that information. Figure 1 shows that information security includes the broad areas of information security management, computer and data security , and network security . The CNSS model of information security evolved from a concept developed by the computer security industry called the C.I.A. Triangle. The C.I.A. Triangle has been the industry standard for computer security since the development of the information. It is based on the three characteristics of information that give it value to organisations: confidentiality, integrity, and availability. Authenticity: Authenticity of information is the quality or state o f being genuine or original, rather than a reproduction or fabrication. Information is authentic when it is in the same state in which it was created, placed, stored, or transferred. Accuracy: Information has accuracy when it is free from mistakes or errors and it has value that the end user expects. In information has been intentionally or unintentionally modified, it is no longer accurate. Consider, for example, a checking account. You assume that the information contained in your checking account is an accurate representation of your finances. Incorrect information in your checking account can result from external or internal errors. If a bank teller, for instance, mistakenly adds or subtracts too much from your account, the value of the information is changed. Or, you may accidentally enter an incorrect amount into your account register. Availability: Availability enables authorised users, persons or computer systems to access information without interference or obstruction and to receive it in the required format Implementation As we viewing of our results in (Fig 5 ) the time average of DB with Traffic Received (sec) and HTTP with page Response Time (sec) In this case we are going to configure the firewall does not allow the database related traffic to pass through the firewall. This procedure we can be viewed in (Fig 9). After we did configure our firewall to block the database access the graph we are captured in Fig 10 indicated that we just blocked the database traffic to pass through the firewall, but still the salespeople using the Web browse. The firewall does filter for the packets according to its rules which are pre-programmed to reject the database’s packets out and allow to another application such as Web browser packets to pass through the firewall. But we have in this case, which are we want to allow the particular users who are working such as sales department to have access to our database in the server. The solution for that problem is the VPN (Virtual Private Network) or a virtual tunnel connection to send database requests to the server, in next scenario we called it the firewall with Virtual
Prezi Present
Prezi Video
Prezi Design
