Software and hardware level of protection. Basic concepts of the software and hardware level of information security

Facebook

Software and hardware measures, that is, measures aimed at controlling computer entities - hardware, programs and / or data, form the last and most important frontier information security. Recall that damage is caused mainly by the actions of legal users, in relation to which procedural regulators are ineffective. The main enemies are incompetence and inaccuracy in the performance of official duties, and only software and hardware measures are able to resist them.

Computers have helped automate many areas of human activity. It seems quite natural to want to entrust them with ensuring their own security. Even physical protection is increasingly entrusted not to security guards, but to integrated computer systems, which allows you to simultaneously track the movements of employees both in the organization and in the information space.

However, it should be noted that the rapid development information technologies not only provides the defenders with new opportunities, but also objectively makes it difficult to provide reliable protection, if you rely solely on measures of the software and hardware level. There are several reasons for this:

increasing the speed of microcircuits, the development of architectures with a high degree parallelism allows using brute force to overcome barriers (primarily cryptographic), which previously seemed impregnable;

the development of networks and network technologies, the increase in the number of links between information systems, the growth of channel bandwidth expand the circle of intruders who have technical capability organize attacks;

the emergence of new information services leads to the formation of new vulnerabilities both “inside” services and at their junctions;

competition among software manufacturers forces to reduce development time, which leads to a decrease in the quality of testing and the release of products with security defects;

The paradigm imposed on consumers by constantly increasing hardware and software capacity does not allow for a long time within reliable, proven configurations and, in addition, conflicts with budgetary constraints, which reduces the share of allocations for security.

The above considerations once again emphasize the importance of an integrated approach to information security, as well as the need for a flexible position in the selection and maintenance of software and hardware controllers.

Central to the software and hardware level is the concept of a security service.

Following the object-oriented approach, when considering an information system with a single level of detail, we will see a set of information services provided by it. Let's call them basic. In order for them to function and have the required properties, several levels of additional (auxiliary) services are needed - from the DBMS and transaction monitors to the operating system kernel and hardware.

Ancillary services include security services (we have already encountered them when considering standards and specifications in the field of information security); among them, we will be primarily interested in universal, high-level, allowing the use of various main and auxiliary services. Next, we will look at the following services:

identification and authentication;

access control;

logging and auditing;

encryption;

integrity control;

shielding;

security analysis;

ensuring fault tolerance;

security safe recovery;

tunneling;

Literature

Basic concepts of the software and hardware level of information security

Identification and authentication

10. Authentication

checksum

11. Authorization

12. Authorization

account

13. Identification and authentication

14. Password authentication

correct use

15. Password authentication

16. One Time Passwords

17. Kerberos authentication server

18. Identification/authentication using biometric data

19. Identification/authentication using biometric data

20. Identification/authentication using biometric data

21. 22. Purposes and scope

23. Purposes and scope

24. Terms used

25. General description

26. General description

logic control

27. General description

28. General description

29. General description

30. Access control models

31. Selective access control

32. Selective access control

33. Selective access control

34. Selective access control

35. Authorized access control

computer processes

system devices

36. Authorized access control

37. Authorized access control

current level

38. Authorized access control

simple condition

39. Authorized access control

40. Role-based access control

41. Role-based access control

42. Role-based access control

real life

43. Role-based access control

44. Role-based access control

45. Model Bell - Lapadula

46. Model Bell - Lapadula

secret documents

47. Harrison-Ruzzo-Ullman Model

48. Harrison-Ruzz-Ullman Model

49. Hordston's five-dimensional safety space model

50. Hordston's Five-Dimensional Safety Space Model

51. Call Security Monitor

52. Call Security Monitor

53. Integrity Models

54. Clark-Wilson Model

55. Clark-Wilson Model

56. Clark-Wilson Model

57. Clark-Wilson Model

58. 59. Beebe Model

60. Beebe Model

61. Beebe Model

Software and hardware measures aimed at control computer equipment, programs and stored data, form the last but not least frontier of information security. At this level, not only positive but also Negative consequences rapid progress in information technology. First of all, additional features appear not only among information security specialists, but also among attackers. Secondly, information systems are constantly being upgraded, rebuilt, insufficiently tested components (primarily software ones) are added to them, which makes it difficult to comply with the security regime.

Central to the software and hardware level is the concept of a security service. These services for institutions and public sector companies include:

identification and authentication;
access control;
logging and auditing;
encryption;
integrity control;
shielding;
security analysis;
ensuring fault tolerance;
ensuring safe recovery;
tunneling;
control.

At present, increasing the level of information security of state-owned enterprises can be achieved by introducing modern technologies protection, characterized by increasing functionality, versatility and the ability to port to any platform. In area technical protection information resources, there are three main areas in which Russian state-owned enterprises operate:

protection internal network;
protection of access to the Internet and international information exchange;
protection of interaction with remote divisions.

At the same time, we remember that state structures and state organizations use only information security tools certified by the FSTEC or the FSB of the Russian Federation. To protect internal resources, most federal and regional government authorities use authentication and authorization mechanisms built into operating systems for users. Some departments have special certified systems of protection against unauthorized access and electronic locks, such as "Labyrinth-M", "Accord", SecretNet. As a means of encryption, as a rule, secret keys for protecting information "CryptoPro" or long known and still popular systems family "Verba".

To protect workstations and servers of the internal network from malicious programs (viruses, worms, Trojan horses), the vast majority of government organizations use anti-virus software. software. Most often, these are the Russian Kaspersky Anti-Virus or Dr.Web. However, there are also solutions from Trend Micro, Symantec, McAfee, Eset.

The division of the network into segments with different information security requirements is carried out using MAC and IP address filtering mechanisms on the active network equipment and VLAN mechanisms. Very rarely, security policy monitoring systems are used that compare the current settings of protective mechanisms and subsystems with reference values (Cisco, "Uryadnik").

In order to protect the perimeter of the network, government agencies usually use various certified firewalls. These are mainly Cisco, Aladdin and Check Point solutions. But there are also products from other manufacturers, in particular, Novell Border Manager, Microsoft ISA Server, SSPT-1 and SSPT-1M from TsNII RTK, Zastava from Elvis Plus.

Attack detection and prevention systems (so-called HIPS) have so far been implemented in very few government organizations. Usually there are solutions from Symantec, S.N. Safe'n'Software and Cisco. In federal government agencies, protection against spam and abuse on the Internet is provided by various monitoring systems Email and web traffic such as eSafe Gateway, MAILsweeper, WEBsweeper and Websense.

In communication channels with remote subdivisions, only Russian systems cryptographic information protection and VPN - Zastava, VipNet or Continent.

11. Regulatory framework for organizational protection. Sources of law in the field of information security. Types normative documents. Examples of domestic and foreign legislative documents.

AT Russian Federation regulatory legal acts in the field of information security include:

Acts of federal legislation:

· International treaties of the Russian Federation;

the Constitution of the Russian Federation;

· The laws federal level(including federal constitutional laws, codes);

Decrees of the President of the Russian Federation;

· Decrees of the Government of the Russian Federation;

· Normative legal acts of federal ministries and departments;

Regulatory legal acts of the constituent entities of the Russian Federation, local governments, etc.

Regulatory and methodological documents include

1. Methodological documents government agencies Russia:

· Doctrine of information security of the Russian Federation;

· Guiding documents of FSTEC (State Technical Commission of Russia);

FSB orders;

2. Information security standards, which include:

· International standards;

State (national) standards of the Russian Federation;

· Guidelines.

Types of regulatory documents:

Normative legal acts: Laws of the Russian Federation (On security), federal laws(On Personal Data, On Information and Information Technologies, On Electronic Digital Signatures), Decree of the President of the Russian Federation (On Approval of the List of Confidential Information), Government Decree (On Certification of Information Security Tools, On Licensing);

· Normative-methodical and methodological documents: Doctrine, Orders of the FSTEC, Regulations on the certification of protective equipment according to safety requirements, Regulations on the certification of objects, Model provisions, Guiding documents, Methods (security assessments), Regulatory and methodological document;

· Standards: GOST, RD, SanPin (Hygienic requirements for video display terminals), SNiP (noise protection).

Example of foreign legislative documents:

USA

As of today, the United States is a jurisdiction with the largest number documents in the System (more than 12,000 documents).

The database includes documents from two major American federal legal sources: the US Code (USC) and the Code of Federal Regulations (CFR). The first is a systematized set of federal statutory legislation and consists of 52 sections devoted to the regulation of certain legal branches or institutions.

The System includes three sections of the US Code: Section 26 - US Internal Revenue Code, Section 12 - Banks and Banking and Section 15 - Commerce and Trade, which includes legislative acts regulating activities in the securities market. The Code of Laws is reissued by Congress every 6 years and published by the US Code Service. Unlike most publicly available sources, the WBL system provides not only the text of these documents, but also the history of all amendments made to them, as well as notes and the most significant judicial precedents in this area.

The System also includes by-laws issued by the federal executive branch and included in the Code of Federal Regulations. They are published by the Federal Register, an agency of the National Archives Administration.

12. Development of a security policy. Basic provisions of information security. Application area. Goals and objectives of information security. Distribution of roles and responsibilities. General responsibilities.

Development.

First, it is necessary to audit the company's information processes, to identify critical important information that needs to be protected. The audit of information processes should end with the definition of a list of confidential information of the enterprise, areas where this information is accessed, persons admitted to it, as well as the consequences of the loss (distortion) of this information. After the implementation of this stage, it becomes clear what to protect, where to protect and from whom: after all, in the vast majority of incidents, the employees of the company themselves will act as violators - voluntarily or unwittingly. And nothing can be done about it: you have to take it for granted. Various security threats can be assigned a probability value for their occurrence. Multiplying the probability of a threat realization by the damage caused by this realization, we get the threat risk. After that, you should start developing a security policy.

Security policy - a document of the "top" level, which must contain:

persons responsible for the safety of the company;

powers and responsibilities of departments and services in relation to security;

Organization of admission of new employees and their dismissal;

Rules for restricting employee access to information resources;

organization access control, registration of employees and visitors;

the use of software and hardware means of protection;

other general requirements.

The cost of ensuring the security of information should be no more than the amount of potential damage from its loss. Risk analysis carried out at the audit stage makes it possible to rank them by magnitude and protect, first of all, not only the most vulnerable, but also the areas that process the most valuable information. ISO 17799 lets you quantify integrated security:

The development of a security policy involves a number of preliminary steps:

assessment of the personal (subjective) attitude to the risks of the enterprise of its owners and managers responsible for the functioning and performance of the enterprise as a whole or certain areas of its activity;

analysis of potentially vulnerable information objects;

identification of threats to significant information objects (information, information systems, information processing processes) and assessment of the corresponding risks.

When developing security policies at all levels, you must adhere to the following basic rules:

· Security policies for more low levels must fully comply with the relevant policy top level, as well as current legislation and requirements of state authorities.

· The text of the security policy should contain only clear and unambiguous wording that does not allow for double interpretation.

· The text of the security policy must be understandable for those employees to whom it is addressed.

General life cycle information security policy includes a number of basic steps.

· Conducting a preliminary study of the state of information security.

· Development of a security policy.

· Implementation of developed security policies.

Analysis of compliance with the requirements of the implemented security policy and formulation of requirements for its further improvement (return to the first stage, new cycle improvement).

Organization security policy(English) organizational security policies) - a set of guidelines, rules, procedures and practices in the field of security that govern the management, protection and distribution of valuable information.

In the general case, such a set of rules is a certain functional software product, which is necessary for its use in a particular organization. If we approach the security policy more formally, then it is a set of certain requirements for the functionality of the protection system, enshrined in departmental documents.

The security policy depends on:

from a specific information processing technology;
from the technical and software tools;
from the location of the organization;

The protection of a large information system cannot be solved without well-designed information security documentation - Security Policy helps

make sure that nothing important is overlooked;

Establish clear safety rules.

Only a comprehensive and cost-effective protection system will be effective, and the information system itself in this case will be protected.

The security policy document should describe the goals and objectives of information security, as well as valuable company assets that need to be protected. The goals of ensuring information security, as a rule, is to ensure the confidentiality, integrity and availability of information assets, as well as ensuring the continuity of the company's business.

The tasks of ensuring information security are all the actions that must be taken to achieve the goals. In particular, it is necessary to solve such problems as analysis and management information risks, investigation of information security incidents, development and implementation of business continuity plans, advanced training of company employees in the field of information security, etc.

3) Requirement of object reuse security contradicts:
encapsulation +
inheritance
polymorphism

4) Assume that the semantics of programs are taken into account when delimiting access. In that case, on game program The following restrictions may apply:
ban on reading any files other than configuration files
ban on changing any files, except for configuration files +
denial of network connections

5) The need for an object-oriented approach to information security is a consequence of the fact that:
it's an easy way to give information security a scientific look
object-oriented approach - a universal means of dealing with the complexity of modern information systems +
in information security from the very beginning the concepts of object and subject appear

6) The number of facets that allow structuring the means of achieving information security include:
integrity measures
administrative measures +
administrative measures

2Containers in component object environments provide:
general context of interaction with other components and with the environment +
means for preserving components
component transport mechanisms

Duplicate messages are a threat:
accessibility
privacy
integrity +

Melissa attacks accessibility:
e-commerce systems
geoinformation systems
email systems +

Select malware, which opened a new stage in the development of this area:
Melissa +
bubble boy
I LOVE YOU

The most dangerous sources of internal threats are:
incompetent leaders +
offended employees
curious administrators

5. Among the following, select main reason the existence of numerous threats to information security:
miscalculations in the administration of information systems
the need for constant modification of information systems
complexity of modern information systems +

Aggressive Resource Consumption Is a Threat: Availability Confidentiality Integrity

Melissa is:
bomb
virus +
worm

For the introduction of bombs, errors of the type are most often used:
no return code checks
buffer overflow +
violation of the integrity of transactions

The danger window appears when:
becomes aware of the means of exploitation of the vulnerability
it becomes possible to exploit the vulnerability +
new P is installed

Select Trojans from the following:
I LOVE YOU
Back Orifice +
netbus +

1. The Criminal Code of the Russian Federation does not provide for punishment for:
creation, use and distribution of malware
maintaining personal correspondence at the production technical base +
violation of the rules for the operation of a computer, computer system or their network

In the Information Security Improvement Bill (USA, 2001) Special attention drawn to: easing restrictions on the export of cryptocurrencies
development of electronic authentication tools +
building a public key infrastructure

4. The definition of means of protecting information given in the Law "On State Secrets" includes:
means of detecting malicious activity
fault tolerance tools
means of monitoring the effectiveness of information protection +

1. Security level B, according to the Orange Book, is characterized by:
forced access control +
verifiable security

3. The Common Criteria security assurance requirement classes include:
development +
protection profile assessment +
certification

4. According to the Orange Book, the security policy includes the following elements:
security perimeter
security labels +
security certificates

1. Security level A, according to the Orange Book, is characterized by:
random access control
forced access control
verified security +

decision to form or revise comprehensive program security +

ensuring the confidentiality of mail messages

4. The goals of the top-level security program include:
risk management +
determination of those responsible for information services
defining penalties for security policy violations

5. As part of the lower-level security program, the following are carried out:
strategic planning
day to day administration +
tracking weaknesses protection +

"1. The security policy is built on the basis of:
general ideas about the organization's IP
studying the policies of related organizations
risk analysis +

2. The goals of the top-level security policy include:
formulation of administrative decisions on the most important aspects of the implementation of the security program +
choice of user authentication methods
providing a framework for compliance with laws and regulations +

1. Risk is a function of:

1. Risk is a function of: the amount of possible damage the number of vulnerabilities in the organization's authorized capital system

3. The stages of risk management include: identification of assets + liquidation of liabilities selection of analyzed objects +

4. The first step in threat analysis is: threat identification + threat authentication threat elimination

Identification of those responsible for risk analysis Measurement of risks Selection of effective protective equipment

5. Risk management includes the following activities: identification of those responsible for risk analysis - risk measurement - selection of effective protective equipment

6. Risk assessment allows you to answer the following questions: what is the risk of the organization using the information system? What are the risks for information system users? What are the risks for system administrators?

1. Classes of measures of the procedural level include: maintenance of working capacity + maintenance of physical fitness physical protection +

2. The principles of personnel management include: minimizing privileges + minimizing salary maximizing salary

3. The stages of the recovery planning process include: identifying the critical functions of the organization + determining the list of possible accidents + conducting test accidents

5. The daily activities at the procedural level include: situational management configuration management optimal management-

1. Logging and auditing can be used to: prevent IS violations + detect violations + restore IS mode

2. Indicate the most significant features of modern Russian IS from the point of view of security: low throughput most communication channels complexity of administration user computers lack of a sufficient set of cryptographic hardware and software products

Application of the most advanced technical solutions application of simple, proven solutions + a combination of simple and complex protective equipment

Development and implementation of a unified security policy + unification of hardware and software platforms minimization of the number of applications used

1. Screening can be used to: prevent IS violations detect violations localize the consequences of violations

3. The main principles of architectural safety include: adherence to recognized standards application non-standard solutions, not known to attackers - a variety of protective equipment

3. The main principles of architectural security include: strengthening the weakest link + strengthening the most likely object of attack defense separation +

5. To ensure information security network configurations you should be guided by the following principles: use your own communication lines ensure confidentiality and integrity in network interactions + complete analysis of network traffic

Access control + management of information systems and their components media management

To ensure the information security of network configurations, one should be guided by the following principles: encryption of all information separation of static and dynamic data formation of composite services according to the content principle +

1. Integrity control can be used to: prevent IS violations detect violations + localize the consequences of violations

4. The number of universal security services includes: tools for building virtual local networks shielding + logging and auditing +

Cardiogram of the subject + pension insurance card number the result of the one-time password generator operation +

2. Authentication based on an encrypted password transmitted over the network is bad because it does not provide protection against: replay interception+ accessibility attacks+

Role + role executor role user

4. When using the version of the Kerberos authentication server described in the course: encryption is not applied - is applied symmetric encryption asymmetric+ encryption is applied

5. When using the approach to access control in the object environment described in the course, inheritance: always taken into account taken into account sometimes not taken into account+

1. The following can be used as an authenticator in a network environment: year of birth of the subject last name of the subject secret cryptographic key+

3. Role-based access control uses the following object-oriented approach: encapsulation inheritance + polymorphism

4. Kerberos authentication server: does not protect against availability attacks + partially protects against availability attacks - fully protects against availability attacks

5. When using the approach to access control in the object environment described in the course, access control rules are specified in the form: subjects/objects matrices - predicates over objects access lists to object methods

3. The basic concepts of role-based access control include: object + subject method

5. When using the approach to access control described in the course in the object environment, access is limited to: object interfaces object methods (taking into account the values of the actual call parameters) object classes

5. When using the approach to access control described in the course in the object environment, access is limited to: object interfaces + object methods (taking into account the values of the actual call parameters) + object classes

Logging and auditing, encryption, integrity control:

Signature attack detection is good because it: Raises few false alarms+ Capable of detecting unknown attacks Easy to set up and operate+

3. The digital certificate contains: the user's public key+ The secret key username+

4. The implementation of logging and auditing has the following main goals: detection of attempts to violate information security + prevention of attempts to violate information security prevention of attacks on availability

2. The threshold method for detecting attacks is good because it: raises few false alarms is able to detect unknown attacks - easy to set up and operate +

4. The implementation of logging and auditing has the following main goals: ensuring accountability of administrators to users ensuring accountability of users and administrators + providing information for identifying and analyzing problems

2. The statistical method of detecting attacks is good because it: Raises few false alarms Can detect unknown attacks + Easy to set up and operate -

4. The implementation of logging and auditing has the following main goals: holding administrators accountable to users holding users and administrators accountable + providing information for identifying and analyzing problems +

5. Cryptography is necessary for the implementation of the following security services: security control integrity control + access control

4. The implementation of logging and auditing has the following main goals: ensuring the ability to reproduce the sequence of events ensuring the possibility of reconstructing the sequence of events + preventing attempts to reproduce the sequence of events

1. Logging alone cannot provide non-repudiation, because: registration information is usually low-level in nature, and non-repudiation refers to actions application layer registration information has a specific format, incomprehensible to man registration information is too large

5. Cryptography is required to implement the following security services: identification shielding authentication+

1. Logging alone cannot provide non-repudiation because: registration information can be dispersed across different services and different components Distributed IS+ integrity of registration information can be violated, confidentiality of registration information must be respected, and non-repudiation check will violate confidentiality

Identification and authentication, access control

1. The following can be used as an authenticator in a network environment:
subject's cardiogram+
pension insurance card number
the result of the one-time password generator+

2. Authentication based on an encrypted password transmitted over the network is bad because it does not provide protection against:
interception
playback+
accessibility attacks+

3. The basic concepts of role-based access control include:
role+
role performer
role user

4. When using the version of the Kerberos authentication server described in the course:
no encryption applied
symmetric encryption is used
asymmetric encryption is used

5. When using the approach to access control in the object environment described in the course, inheritance: is always taken into account
taken into account sometimes
not taken into account +

1. The following can be used as an authenticator in a network environment:
subject's year of birth
subject's last name
secret cryptographic key+

3. Role-based access control uses the following object-oriented approach:
encapsulation
inheritance+
polymorphism

4. Kerberos authentication server:
does not protect against accessibility attacks+
partially protects against accessibility attacks
fully protects against accessibility attacks

3. The basic concepts of role-based access control include:
object+
subject
method

5. When using the approach to access control described in the course in the object environment, access is limited to:
object interfaces +
object methods (taking into account the values of the actual call parameters) +
object classes

Main software and hardware measures:

2. Indicate the most significant security features of modern Russian IS:
low bandwidth of most communication channels +
complexity of administering user computers
lack of a sufficient set of cryptographic hardware and software products+

3. The main principles of architectural safety include:
application of the most advanced technical solutions
application of simple, proven solutions +
combination of simple and complex protective equipment

5. To ensure the information security of network configurations, the following principles should be followed:
development and implementation of a unified security policy+
unification of hardware and software platforms
minimizing the number of applications used

3. The main principles of architectural safety include:
adherence to recognized standards +
application of non-standard solutions not known to intruders -
variety of protective equipment+

5. To ensure the information security of network configurations, one should be guided by the following principles: encryption of all information - separation of static and dynamic data; formation of composite services according to the content principle +

3. The main principles of architectural safety include:
strengthening the weakest link+
strengthening the most likely object of attack
defense layering+

5. To ensure the information security of network configurations, the following principles should be followed:
use of own communication lines
ensuring confidentiality and integrity in network interactions + n
complete analysis of network traffic

4. Universal security services include:
access control+
management of information systems and their components
media management

To ensure the information security of network configurations, the following principles should be followed:
encryption of all information
separation of static and dynamic data
formation of composite services according to the content principle +

4. Universal security services include:
tools for building virtual local networks
shielding + logging and auditing +

Procedural level of information security

1. The classes of measures of the procedural level include:
maintenance +
keeping fit
physical protection+

2. The principles of personnel management include:
privilege minimization + salary minimization
salary maximization

3. The steps in the recovery planning process include:
identifying critical organizational functions+
determination of the list of possible accidents + test accidents

4. The areas of physical protection include:
physical protection of users -
supporting infrastructure protection+
data interception protection+

5. Day-to-day activities at the procedural level include:
situational management
configuration management
optimal control -

Management of risks

1. Risk is a function of:
amount of possible damage +
number of vulnerabilities in the system
authorized capital of the organization

3. The stages of risk management include:
asset identification+
liquidation of liabilities
choice of analyzed objects+

4. The first step in threat analysis is:
threat identification+
threat authentication
elimination of threats

5. Risk management includes the following activities:
identification of those responsible for risk analysis
measurement of risks selection of effective protective equipment

5. Risk management includes the following activities:
determination of those responsible for risk analysis -
risk measurement +
choice of effective protective equipment+

6. Risk assessment allows you to answer the following questions:
What is the risk of an organization using an information system? +
What are the risks for information system users? +
What are the risks for system administrators?

Ensuring information security is a very difficult task, which has several levels.

Software and technical level.

From a modern point of view, the following security mechanisms should be available to information systems:

access control,
shielding,
user authentication and identification,
logging and auditing,
providing high availability,
cryptography.

procedural level.

It includes measures implemented by people. The experience gained in domestic organizations on the implementation of procedural measures came from the pre-computer past and needs to be substantially revised.
There are the following groups of organizational (procedural) measures:

For each group there should be rules that determine the actions of personnel. They must be established in each specific organization and worked out in practice.

Administrative level.

The security policy adopted by the management of the organization is the basis of the administrative level measures. This is a set of documented management decisions that are aimed at protecting information, as well as the resources associated with it. The security policy is based on an analysis of the real risks that threaten information system one organization or another. After the analysis, a protection strategy is developed. This is a program for which money is allocated, responsible persons are appointed, the procedure for monitoring its implementation, etc. is established.
Since each organization has its own specifics, it is pointless to transfer the practice of state-controlled enterprises to commercial structures, personal computer systems or educational establishments. It is more appropriate to use the basic principles of security policy development or ready-made templates for major types of organizations.

Legislative level.

This is the most important level of information security. It includes a set of measures aimed at creating and maintaining a negative attitude in society towards violators and violations in this area. It is necessary to create a mechanism that would allow coordinating the development of laws with the constant improvement of information technologies. The state should play a coordinating and guiding role in this matter. Russian information technology and information security standards should correspond to the international level. This will facilitate interaction with foreign companies and foreign affiliates of domestic companies. Now this problem is solved by one-time permits, often bypassing the current legislation.

Only the interaction of all levels of information security will make it as effective as possible.

Software and hardware level of protection. Basic concepts of the software and hardware level of information security

Literature

Basic concepts of the software and hardware level of information security

Basic concepts of the software and hardware level of information security

Basic concepts of the software and hardware level of information security

Basic concepts of the software and hardware level of information security

Identification and authentication

Identification and authentication

10. Authentication

11. Authorization

12. Authorization

13. Identification and authentication

14. Password authentication

15. Password authentication

16. One Time Passwords

17. Kerberos authentication server

18. Identification/authentication using biometric data

19. Identification/authentication using biometric data

20. Identification/authentication using biometric data

21.

22. Purposes and scope

23. Purposes and scope

24. Terms used

25. General description

26. General description

27. General description

28. General description

29. General description

30. Access control models

31. Selective access control

32. Selective access control

33. Selective access control

34. Selective access control

35. Authorized access control

36. Authorized access control

37. Authorized access control

38. Authorized access control

39. Authorized access control

40. Role-based access control

41. Role-based access control

42. Role-based access control

43. Role-based access control

44. Role-based access control

45. Model Bell - Lapadula

46. ​​Model Bell - Lapadula

47. Harrison-Ruzzo-Ullman Model

48. Harrison-Ruzz-Ullman Model

49. Hordston's five-dimensional safety space model

50. Hordston's Five-Dimensional Safety Space Model

51. Call Security Monitor

52. Call Security Monitor

53. Integrity Models

54. Clark-Wilson Model

55. Clark-Wilson Model

56. Clark-Wilson Model

57. Clark-Wilson Model

58.

59. Beebe Model

60. Beebe Model

61. Beebe Model

1. Risk is a function of:

Identification and authentication, access control

Main software and hardware measures:

Procedural level of information security

Management of risks

Software and technical level.

procedural level.

Administrative level.

Legislative level.

Popular Articles

Latest Articles

Sections

Pages

Special projects

Contacts

46. Model Bell - Lapadula