Welcome back here we'll cover the question What is security and what security solutions often prove
ineffective.
Here we will examine more formal methods for computer security.
Let us start with the basics.
That is from some classic definitions.
The first comes from Cambridge Dictionary of English and states.
Security is an ability to avoid damage resulting from any kind of risk danger or threats.
Please note that this definition is very general and quite restrictive.
We must avoid damage.
Thus the definition suggests that you could avoid any kind of damage and that your system would be completely
secure.
On the other hand security standards such as ISO IEC 2 7 0 0 2 defined security as a preservation of
confidentiality integrity and the availability of information.
However both definitions share the same full they are based on too optimistic of an assumption.
They require people who are responsible for computer security like you and I to do something impossible.
They require us to avoid any damage
in the previous lectures.
We discuss the service level agreement and we mentioned that the recovery time objective is defined
as a percentage but it can never be 100 percent.
Security is similar.
It would be unrealistic to assume that complete security can be achieved speaking more realistically.
There are only different levels of computer system protection.
With that in mind let's try to rephrase our definition of security.
However we have to remember that system security must not interfere with system functionality.
That is to say you cannot implement security solutions at the expense of functionality.
Granted it would be relatively easy to design a highly secure but very impractical system.
For example a system with no graphic interface that would require a user to confirm their identity every
15 minutes by providing a 64 character password would be very secure.
But as functionality would be greatly limited.
Besides I assure you that if security interferes with functionality users will find a way to bypass
it.
Users always prefer solutions that are more comfortable and effective security policy must not provoke
them to ignore it.
Security should not be pitted against functionality keeping that in mind let us try to redefine security
once more.
The goal of security is to be able to avoid too much damage by assessing risk dangers or threats.
It may not sound that optimistic but it is certainly more realistic.
Therefore we will consider how to assess risk and potential damage by means of threat classification.