Outline for April 1, 2004
: Chapters 1, 13
A student discovers a flaw in the department's computer system. To
ensure that the flaw really exists, she exploits it to gain extra
privileges on the system. These privileges allow her to read any
file on the system, whereas without the privileges, there are files
that the student cannot read.
- Given that there were files she was not supposed to be able to
read, did the student act ethically in exploiting the flaw?
- The computer system did not provide sufficient mechanisms to
prevent the student from obtaining the additional privileges. Did
she "break in" (that is, breach security) or was her
action not a violation of security?
- The student reports the problem to the department chairperson,
who promptly files charges against the student for breaking in.
Assuming that what the student did was a violation of security, did
the chairperson act ethically?
Outline for the Day
- Basic components of computer security
- Classes of threats
- Policy vs. mechanism
- Goals of security
- Trust and Assumptions
- Types of mechanisms: secure, precise, broad
- Maintenance and operation
- Operational Issues
- Cost-benefit analysis
- Risk analysis
- Laws and customs
- Human issues
- Organizational problems
- People problems
Here is a PDF version of this document.