Security Overview; What Is Computer Security - Red Hat ENTERPRISE LINUX 3 - SECURITY GUIDE Manual

Chapter 1.

Security Overview

Because of the increased reliance on powerful, networked computers to help run businesses and keep
track of our personal information, industries have been formed around the practice of network and
computer security. Enterprises have solicited the knowledge and skills of security experts to prop-
erly audit systems and tailor solutions to fit the operating requirements of the organization. Because
most organizations are dynamic in nature, with workers accessing company IT resources locally and
remotely, the need for secure computing environments has become more pronounced.
Unfortunately, most organizations (as well as individual users) regard security as an afterthought, a
process that is overlooked in favor of increased power, productivity, and budgetary concerns. Proper
security implementation is often enacted postmortem — after an unauthorized intrusion has already
occurred. Security experts agree that the right measures taken prior to connecting a site to an untrusted
network such as the Internet is an effective means of thwarting most attempts at intrusion.

1.1. What is Computer Security?

Computer security is a general term that covers a wide area of computing and information process-
ing. Industries that depend on computer systems and networks to conduct daily business transactions
and access crucial information regard their data as an important part of their overall assets. Several
terms and metrics have entered our daily business vocabulary, such as total cost of ownership (TCO)
and quality of service (QoS). In these metrics, industries calculate aspects such as data integrity and
high-availability as part of their planning and process management costs. In some industries, such
as electronic commerce, the availability and trustworthiness of data can be the difference between
success and failure.
1.1.1. How did Computer Security Come about?
Many readers may recall the movie "Wargames," starring Matthew Broderick in his portrayal of a
high school student who breaks into the United States Department of Defense (DoD) supercomputer
and inadvertently causes a nuclear war threat. In this movie, Broderick uses his modem to dial into the
DoD computer (called WOPR) and plays games with the artificially intelligent software controlling
all of the nuclear missile silos. The movie was released during the "cold war" between the former
Soviet Union and the United States and was considered a success in its theatrical release in 1983.
The popularity of the movie inspired many individuals and groups to begin implementing some of
the methods that the young protagonist used to crack restricted systems, including what is known as
war dialing — a method of searching phone numbers for analog modem connections in a defined area
code and phone prefix combination.
More than 10 years later, after a four-year, multi-jurisdictional pursuit involving the Federal Bureau
of Investigation (FBI) and the aid of computer professionals across the country, infamous computer
cracker Kevin Mitnick was arrested and charged with 25 counts of computer and access device fraud
that resulted in an estimated US$80 Million in losses of intellectual property and source code from
Nokia, NEC, Sun Microsystems, Novell, Fujitsu, and Motorola. At the time, the FBI considered it the
largest computer-related criminal offense in U.S. history. He was convicted and sentenced to a com-
bined 68 months in prison for his crimes, of which he served 60 months before his parole on January
21, 2000. He was further barred from using computers or doing any computer-related consulting until
2003. Investigators say that Mitnick was an expert in social engineering — using human beings to
gain access to passwords and systems using falsified credentials.
Information security has evolved over the years due to the increasing reliance on public networks
to disclose personal, financial, and other restricted information. There are numerous instances such
as the Mitnick and the Vladimir Levin case (refer to Section 1.1.2 Computer Security Timeline for