An account can be hijacked because of password reuse, or someone may enter a card number on a fake website. Information-security accidents can happen to anyone. In this lesson, we will study the three elements of information security, authentication and encryption, typical attack methods, and the Unauthorized Computer Access Law.
The Three Elements of Information Security
Information security is defined as maintaining the confidentiality, integrity, and availability of information. Confidentiality means that only authorized people can access information. Integrity means that information remains accurate without being altered or destroyed. Availability means that information and systems can be used whenever necessary. The initials form the term CIA. For example, if an attack stops a server’s service, availability has been violated; if a Web page is rewritten, integrity has been violated.
Authentication — Confirming Someone’s Identity
Authentication is the system used to confirm that a user is the person they claim to be. Authentication factors are classified into three types. ① Knowledge factors: things only the person knows (passwords and PINs); ② possession factors: things only the person has (smartphones and IC cards); and ③ biometric factors: physical characteristics of the person (fingerprints, faces, and irises). Authentication combining two or more factors of different types is called multifactor authentication (two-factor authentication). Even if a password is leaked, the second barrier provides protection, greatly improving security. As a general rule, passwords should be “long, difficult to guess, and different for each service.”
Encryption — Making Data Unreadable Even If It Is Viewed
Encryption means transforming data according to a set rule (a key) so that third parties cannot read it. Data before encryption is called plaintext, encrypted data is called ciphertext, and restoring it to its original form is called decryption. There are two major methods. Symmetric-key encryption uses the same key for encryption and decryption. It is fast, but safely delivering the key to the other party is a problem (the key-distribution problem). The number of keys required also increases rapidly as communication partners increase. Public-key encryption uses a pair consisting of a “public key” made available to everyone and a “private key” held only by the owner. Data encrypted with the public key can be decrypted only with the corresponding private key. This solves the key-distribution problem, but processing is slower than with symmetric-key encryption. Actual Web communication (SSL/TLS for URLs beginning with https) uses a combination of both methods, called a hybrid method: public-key encryption safely shares a symmetric key, after which communication uses fast symmetric-key encryption.
Cyberattack Methods and the Unauthorized Computer Access Law
Malicious software is collectively called malware. Examples include a computer virus, which attaches itself to other files; a worm, which independently reproduces itself; a Trojan horse, which enters while pretending to be useful software; and ransomware, which encrypts data without permission and demands payment. Social engineering, which exploits weaknesses in human psychology, such as shoulder surfing and impersonation calls, is also a serious threat. As a legal system, the Unauthorized Computer Access Law prohibits logging in without permission using another person’s ID and password, breaking into a system by attacking security holes, illegally obtaining or storing another person’s authentication information, and setting up phishing sites. “I only tried logging into my friend’s account” is still a serious crime.
- The three elements of information security are confidentiality, integrity, and availability (CIA).
- The three authentication factors are knowledge, possession, and biometrics. Combining different types is multifactor authentication.
- Symmetric-key encryption is fast but has the key-distribution problem. Public-key encryption solves that problem but is slower.
- SSL/TLS (https) is a hybrid of public-key and symmetric-key encryption.
- Distinguish types of malware: viruses, worms, Trojan horses, and ransomware.
- Logging in with another person’s ID violates the Unauthorized Computer Access Law. It is not merely “a prank.”
- Updating software is an important measure for closing security holes.
Practice Questions
- List all three elements of information security and state which element is violated when a website is rewritten by a third party.
- Explain the difference between symmetric-key and public-key encryption from the perspectives of keys and speed.
- Explain why multifactor authentication is safer than password-only authentication.
- Explain what phishing is and give one effective countermeasure.
Answers and Explanations
- Answer: The three elements are confidentiality, integrity, and availability. Altering a website violates integrity, which means that information should remain accurate.
Explanation: Organize them as follows: leakage = confidentiality, alteration = integrity, and service interruption = availability. - Answer: Symmetric-key encryption uses the same key for encryption and decryption and is fast, but it has the key-distribution problem of safely delivering the key to the other party. Public-key encryption uses a public-key and private-key pair, solving the key-distribution problem, but its processing speed is slower than that of symmetric-key encryption.
Explanation: Compare three points: “the same key or a key pair,” “fast or slow,” and “whether the key-distribution problem exists.” In practice, both methods are combined in a hybrid system. - Answer: Because it combines different types of authentication factors—knowledge, possession, and biometrics—even if a password (a knowledge factor) is leaked, an attacker must also obtain a smartphone (a possession factor) or fingerprint (a biometric factor) to log in, making unauthorized access more difficult.
Explanation: The idea of layered defense—“even if one is broken, the others provide protection”—is essential. Two factors of the same type, such as two passwords, do not constitute multifactor authentication. - Answer: Phishing is a method of disguising an actual company or other organization in an email or SMS, directing the victim to a fake website, and stealing information by getting them to enter an ID, password, or credit-card number. One countermeasure is to avoid opening links in messages and access the site through the official app or a bookmark saved by oneself.
Explanation: Understand the two-step structure: “disguise and lead the victim” and “get the victim to enter information and steal it.” Checking the URL domain and enabling multifactor authentication are also correct countermeasures.