| Information security is the process of protecting data from unauthorized access. It is commonly misused as computer security, but there are some differences between them. With the help of computing platforms, some restrictions can be created in order to give access to a type of information only to some users.
In some occasions, computer security refers to implementing a secure operating system. This technology has been developed in the 1980s and since then it is evolving rapidly. Now the advancements are not noticeable because computer security is hard to understand and develop. Ordinary operating systems don't have features that give the maximum level of security. The best computer security systems are used by the military and protect military secretes and national security information. These are the most powerful systems and they have been classified at the highest level of security (Orange Book A-1). The Common Criteria refers to security capability and assurance levels. Security is unique in each situation and it is based on logic. There are many computer security techniques. The principle or the least privilege means that an entity has only the privileges need for it to function. In this case, even if an attacker breaks a part of the security, it is very difficult for him to access the rest. If the system is made out of many components, the complexity of each component is reduced. If the design is done properly, more then one component needs to be breached in order to compromise the information. But breaching one part of the security must not provide a platform to get to another. Each part must be independent. The cascading principle states that if you have a number of poor systems and use them all, you will not get high security.
Security breaches are inevitable. But if the computer security experts know where they have the weak points, they know what to expect in case of an attack. Sometimes the attacker can even be led to a dead end. The first computer security system was Multics. It was the first system built for security reasons, but it was broken in numerous occasions with a strategy called "penetrate and test". This gave people a reason to work more on computer security and to start the modern security engineering techniques. The most vulnerability's are present due to code defects. Some languages are vulnerable to these defects (C or C++) but languages like Java are immune to the effects but have other software defects that can led to system vulnerability. There are two means of enforcing privilege separation: access control lists (ACL) and capabilities. Access control lists are insecure but most of the systems use this method of computer security. Capabilities are used for research systems and they are much safer then ACL's. The CAP computer has proven that capabilities are better back in the 1970s. The most secure computers don't have a connection to the Internet or any other interface. Good computer security is found on operating systems like OS/400 from IBM. These systems have incorporated security, unlike most computers that have add-on methods of security. This system and EROS are considered the most secure systems.
Back To Articles... |
