Upon completion of this tutorial, you will be able to:
Welcome to COMP400: Computer and Network Security. This first tutorial establishes the essential foundation upon which the entire course is built. Security is no longer an optional add-on to computing systems; it is a fundamental requirement woven into the fabric of every network, application, and data store. Whether you are a future security engineer, a software developer, a system administrator, or a technology leader, understanding the core principles of security is indispensable.
This tutorial introduces the broad landscape of computer and network security, beginning with a clear distinction among the related but distinct fields of information security, computer security, network security, and cybersecurity. We examine why security matters in a hyperconnected world, drawing on real-world incidents that have caused billions of dollars in damage and eroded public trust. The importance of security is not merely technical—it encompasses legal, ethical, economic, and reputational dimensions.
At the heart of security thinking lies the CIA triad: Confidentiality, Integrity, and Availability. These three pillars guide every security decision, from designing a firewall rule set to implementing encryption for data at rest. Beyond the triad, we explore additional security objectives: authenticity, accountability, and nonrepudiation, which are critical for establishing trust in digital transactions and for forensic investigations.
Building on these objectives, we introduce the OSI security architecture (X.800), which provides a standardized framework for classifying security services, mechanisms, and attacks. This framework, although developed in the context of the OSI reference model, remains a valuable tool for analyzing and designing secure systems. We also discuss the three categories of security controls—administrative, technical, and physical—and how they work together to create a defense-in-depth posture.
Finally, we explore the relationship between networking and security, acknowledging that the very protocols that enable global communication also introduce vulnerabilities. The tutorial concludes with an overview of security architecture and an introduction to the concept of security policies, which serve as the governance backbone for all security activities.
This tutorial sets the stage for Tutorial 1.2, where we will delve into the details of cyber threats, vulnerabilities, and security attacks. By mastering the foundational concepts presented here, you will be well-prepared to understand the threat landscape and the countermeasures that form the core of this course.
The terms information security, computer security, network security, and cybersecurity are often used interchangeably in popular discourse, but they represent distinct (though overlapping) domains. A precise understanding of each term is essential for effective communication and for defining the scope of security responsibilities.
Information security is the broadest of the four terms. It encompasses the protection of information in all its forms—whether digital, physical, or even in human memory. The primary goal of information security is to preserve the confidentiality, integrity, and availability of information assets, regardless of the medium on which the information resides. This includes paper records, verbal communications, and digital data. Information security is fundamentally about protecting information assets from unauthorized access, use, disclosure, disruption, modification, or destruction.
Computer security focuses specifically on the protection of computer systems and the data they process, store, and transmit. This includes hardware, software, firmware, and the data itself. Computer security is concerned with ensuring that systems operate as intended, that data is protected, and that resources are available to authorized users. The discipline draws on cryptography, access control, operating system security, and software security. While computer security is a subset of information security, it is often the primary focus of technical security practitioners.
Network security is the protection of network infrastructures, including the devices (routers, switches, firewalls), communication channels (wired and wireless), and the data in transit. Network security addresses threats such as eavesdropping, interception, spoofing, denial of service, and man-in-the-middle attacks. Key technologies include firewalls, intrusion detection/prevention systems, VPNs, and encryption protocols (e.g., TLS, IPsec). Network security is a critical component of any comprehensive security strategy because networks are the primary conduit for data exchange and a common attack vector.
Cybersecurity is the most contemporary and expansive of the four terms. It encompasses the protection of all digital assets, including computers, networks, data, and the people who use them. Cybersecurity addresses threats that originate in or traverse cyberspace, including attacks by nation-states, cybercriminals, hacktivists, and insiders. It includes not only technical measures but also organizational policies, legal frameworks, and human factors. Cybersecurity is often viewed as an enterprise-wide discipline that integrates technology, processes, and people.
The relationship among these domains is best understood as concentric circles: information security is the largest circle, cybersecurity is a subset focusing on the digital realm, computer security focuses on computing devices, and network security focuses on communication pathways. In practice, these domains are deeply intertwined, and a security professional must be conversant in all of them.
| Domain | Scope | Primary Focus | Key Technologies / Practices |
|---|---|---|---|
| Information Security | All forms of information (digital, physical, verbal) | Confidentiality, Integrity, Availability of information assets | Policies, classification, physical security, records management |
| Computer Security | Computer systems (hardware, software, firmware, data) | System integrity, access control, data protection | OS security, cryptography, access control lists, antivirus |
| Network Security | Network infrastructure and data in transit | Protecting communication channels and network devices | Firewalls, IDS/IPS, VPNs, TLS, IPsec, NAC |
| Cybersecurity | All digital assets across the enterprise | Holistic protection of digital systems, data, and people | Security operations, threat intelligence, incident response, GRC |
Security is not a technical luxury; it is a business imperative. In today's interconnected world, the consequences of security failures can be catastrophic. Organizations face threats ranging from data breaches that expose millions of customer records to ransomware attacks that bring critical infrastructure to a standstill. The importance of security can be examined through several lenses:
Throughout this course, we will return to these themes, examining real-world incidents and analyzing the security failures that enabled them.
The CIA triad—Confidentiality, Integrity, and Availability—is the cornerstone of information security. Every security control, mechanism, and policy can be traced back to one or more of these objectives. In addition to the triad, security professionals recognize three other critical objectives: authenticity, accountability, and nonrepudiation.
Confidentiality ensures that information is accessible only to those who have been explicitly authorized. This means preventing unauthorized disclosure of sensitive information. Confidentiality is typically enforced through mechanisms such as encryption (e.g., AES), access control lists (ACLs), role-based access control (RBAC), and data masking. Breaches of confidentiality include data breaches, unauthorized access, and eavesdropping.
Integrity guarantees that information has not been altered or destroyed in an unauthorized manner. Integrity ensures that data is accurate, complete, and trustworthy. Integrity mechanisms include cryptographic hashing (e.g., SHA-256), digital signatures, checksums, and version control. A loss of integrity can occur through data corruption, tampering, or unauthorized modification.
Availability ensures that information and resources are accessible to authorized users when they are needed. This includes protecting against denial-of-service (DoS) attacks, system failures, and other disruptions. Availability is maintained through redundancy, failover mechanisms, load balancing, and robust disaster recovery plans. A denial-of-service attack is a direct assault on availability.
Authenticity (often referred to as authentication in a broader sense) verifies that a user, system, or data is genuine. It ensures that a communication or transaction is legitimate and that the parties involved are who they claim to be. Authenticity is established through authentication mechanisms such as passwords, biometrics, digital certificates, and multifactor authentication (MFA).
Accountability ensures that the actions of a user or system can be traced back to that entity. It is the foundation of auditability and forensics. Accountability is supported through logging, auditing, and monitoring systems. When accountability is properly implemented, it deters malicious behavior and enables post-incident analysis.
Nonrepudiation prevents a party from denying that they performed a particular action or sent a particular message. It provides proof of origin and proof of delivery. Nonrepudiation is typically achieved through digital signatures and time-stamping. It is essential in legal and financial contexts where disputes about transactions must be resolved.
Real-World Application: When you sign a digital document using a certificate-based digital signature, you are simultaneously contributing to authenticity (verifying your identity), integrity (ensuring the document is not modified), and nonrepudiation (you cannot later deny having signed it).
The OSI Security Architecture, defined in the ITU-T X.800 recommendation, provides a systematic framework for describing security services, mechanisms, and attacks. Although it was developed in the context of the OSI reference model, its concepts are widely applicable to modern networking and security design.
X.800 defines a security service as a capability that is provided by a system to ensure the security of data and communications. The standard identifies five major categories of security services:
X.800 defines a security mechanism as a specific technical measure designed to detect, prevent, or recover from a security attack. Mechanisms are the building blocks of security services. The standard distinguishes between specific mechanisms (implemented within a particular layer) and pervasive mechanisms (applied across layers).
Specific security mechanisms include:
Pervasive security mechanisms include:
| Security Service | Primary Security Mechanisms |
|---|---|
| Authentication | Authentication exchange, digital signature, encryption |
| Access Control | Access control lists, capabilities, role-based access |
| Data Confidentiality | Encipherment, traffic padding, routing control |
| Data Integrity | Digital signature, data integrity mechanisms, hash functions |
| Nonrepudiation | Digital signature, notarization, time-stamping |
A security attack is any action that compromises the security of information or systems. X.800 classifies attacks into two broad categories: passive attacks and active attacks. This classification remains a useful framework for understanding the threat landscape.
Passive attacks aim to obtain information without altering the system or its data. They are characterized by eavesdropping or monitoring of transmissions. The primary goal is to learn something about the data or the communication patterns. Passive attacks are difficult to detect because they do not change the state of the system. The main countermeasures are encryption (to protect the content) and traffic analysis countermeasures (to obscure patterns).
Active attacks involve some modification of the data stream or the creation of a false stream. They are more dangerous than passive attacks because they can alter system state, corrupt data, or disrupt operations. Active attacks are generally easier to detect than passive attacks, though they can be more damaging.
Key Distinction: Passive attacks primarily threaten confidentiality. Active attacks threaten integrity, availability, and authenticity. A comprehensive security strategy must address both types of attacks.
Security controls are the safeguards or countermeasures implemented to protect assets and to mitigate risks. They are typically categorized into three broad types: administrative (or managerial), technical (or logical), and physical. A robust security posture relies on a balanced combination of all three.
Administrative controls are policies, procedures, and governance structures that guide human behavior and organizational decision-making. They are often the first line of defense because they establish the rules and expectations for security. Examples include:
Technical controls (also called logical controls) are hardware and software mechanisms that enforce security policies. They are the most visible form of security and include:
Physical controls are measures that protect the physical environment and the people, hardware, and data within it. Physical security is often overlooked in the digital age, but it remains a critical component of any security strategy. Examples include:
| Control Type | Examples | Primary Role |
|---|---|---|
| Administrative | Policies, training, background checks, incident response | Governance, human behavior, process |
| Technical | Firewalls, encryption, IDS/IPS, access control, SIEM | Automated enforcement, detection, prevention |
| Physical | Locks, CCTV, guards, environmental controls, secure storage | Protection of physical assets and environment |
A security policy is a formal statement of the rules, procedures, and practices that an organization adopts to protect its assets. Security policies serve as the foundation upon which all security controls are built. They provide guidance, set expectations, and establish accountability.
Effective security policies are:
Common types of security policies include:
Security architecture refers to the design and structure of security controls, mechanisms, and processes within an organization. It is the blueprint that integrates security into the enterprise architecture. A well-designed security architecture ensures that security is not an afterthought but is woven into the fabric of the organization's operations.
Key components of a security architecture include:
The security architecture must be aligned with the organization's business objectives, risk tolerance, and regulatory requirements. It should be designed to be defensible, resilient, and adaptable to evolving threats.
Networking and security are inextricably linked. The very features that make networks powerful—connectivity, openness, and interoperability—also make them vulnerable. Understanding this relationship is essential for designing secure systems.
How networks enable security:
How networks introduce vulnerabilities:
Modern security approaches, such as Zero Trust and defense-in-depth, explicitly reject the assumption that the network is inherently trustworthy. Instead, they require that every access request be authenticated, authorized, and encrypted, regardless of its origin.
Key Insight: The transition to cloud computing, remote work, and IoT has further blurred the boundaries of the network. Traditional perimeter-based security is no longer sufficient. Security must be embedded into the network itself, with micro-segmentation, identity-based access, and continuous monitoring.
Test your understanding of the foundational concepts presented in this tutorial. Click to reveal answers.
Question 1: Which of the following terms is the broadest, encompassing the protection of information in all its forms, including physical documents and verbal communications?
Question 2: The CIA triad consists of which three core security objectives?
Question 3: Which security objective ensures that a party cannot deny having performed a particular action, such as sending a message?
Question 4: In the OSI security architecture (X.800), which category of attack involves observing the frequency, length, and timing of messages to infer patterns, even if the content is encrypted?
Question 5: Which type of security control includes policies, procedures, training, and governance structures?
Question 6: Which of the following is an example of a technical security control?
Question 7: In the context of the OSI security architecture, what is the primary difference between a security service and a security mechanism?
Question 8: Which of the following is NOT one of the five major categories of security services defined in X.800?
Question 9: An attacker captures a valid payment authorization message and retransmits it later to cause an unauthorized transaction. This is an example of which type of active attack?
Question 10: Which security objective is directly threatened by a denial-of-service (DoS) attack?
Question 11 (Scenario): A hospital's electronic health records (EHR) system is designed to ensure that patient data is accessible to doctors 24/7, that it is accurate and complete, and that it is only visible to authorized personnel. Which of the following correctly maps the security objectives to the EHR system's requirements?
Question 12 (Short Answer): Define the principle of "defense in depth" and provide an example of how it can be applied in a corporate network.
Apply your understanding of the concepts from Tutorial 1.1 through these practical exercises. Each exercise is based on realistic scenarios that security professionals encounter.
Exercise 1: You are hired as a security consultant for a mid-sized financial services firm. The CEO asks you to explain why the company needs to invest in security. Using the concepts from this tutorial, prepare a one-page executive summary that addresses: (a) the economic, legal, and ethical reasons for investing in security; (b) the specific security objectives (CIA + beyond) that the firm should prioritize; and (c) a high-level classification of the types of controls the firm should consider.
Executive Summary
(a) The firm should invest in security for three primary reasons: economic (cybercrime costs are rising, and a breach can cost millions in direct and indirect losses), legal/regulatory (the firm must comply with financial regulations such as PCI DSS and GDPR, with significant penalties for non-compliance), and ethical (the firm has a duty to protect its clients' sensitive financial data).
(b) The firm should prioritize Confidentiality (protecting client data from unauthorized access), Integrity (ensuring transaction records are accurate and unaltered), and Availability (ensuring online banking services are always accessible). Additionally, Nonrepudiation is critical for financial transactions to prevent fraud disputes.
(c) The firm should implement a balanced combination of administrative controls (security policies, staff training), technical controls (encryption, firewalls, MFA, SIEM), and physical controls (secure data centers, access badges). A defense-in-depth approach is recommended.
Exercise 2: A university's IT department is designing a new student information system. They are concerned about protecting student records (which include grades, personal contact information, and financial aid details) from both external attackers and internal misuse. Use the OSI security architecture (X.800) to recommend at least three security services and three corresponding security mechanisms that should be incorporated into the system design. Explain how each service-mechanism pair addresses a specific threat.
Security Service 1: Access Control — Mechanism: Role-Based Access Control (RBAC) with fine-grained permissions. This prevents unauthorized access to student records. For example, faculty members should only see grades for students in their own courses, and financial aid staff should only see financial data.
Security Service 2: Data Confidentiality — Mechanism: Encryption (AES-256) for data at rest and TLS for data in transit. This protects student data from interception and unauthorized disclosure, both externally and internally.
Security Service 3: Data Integrity — Mechanism: Digital signatures and SHA-256 hashing. This ensures that grades and financial records are not tampered with. Any unauthorized modification would be detected via hash verification.
Additional: A logging mechanism (pervasive security) should be implemented for accountability, recording who accessed which records and when.
Exercise 3: Consider an organization that has implemented strong firewalls, intrusion detection systems, and encryption for all data. Despite these technical controls, the organization suffers a major data breach. The investigation reveals that an employee was tricked by a phishing email into providing their credentials. (a) Which category of security control (administrative, technical, or physical) is most likely to prevent this type of incident? (b) Propose at least three specific measures that could have mitigated this risk. (c) Explain how these measures relate to the security principles discussed in this tutorial.
(a) This is a human-factor failure, which falls primarily under administrative controls. Technical controls alone cannot prevent phishing if users are not trained to recognize it.
(b) Three measures: (1) Regular security awareness training that includes phishing simulation exercises to teach employees how to identify suspicious emails. (2) Implementation of Multi-Factor Authentication (MFA) — a technical control — which would prevent the attacker from using the stolen credentials alone. (3) A clear security policy that requires verification of any request for sensitive information, combined with a reporting mechanism for suspicious emails.
(c) These measures align with the principle of defense-in-depth (layering multiple controls) and the objective of authenticity (verifying that the user is genuine). MFA directly supports authenticity, while training and policies address the human factor, which is a critical part of administrative controls.
Exercise 4: Using the CIA triad as your guide, conduct a security analysis of a cloud-based file storage service (e.g., Google Drive, Dropbox). For each of the three CIA objectives, identify: (a) a specific threat that could compromise that objective; (b) a security mechanism that the service provider might use to mitigate that threat; and (c) a responsibility of the user to maintain security for that objective.
Confidentiality: (a) Threat: Unauthorized access to files due to weak passwords or credential theft. (b) Mechanism: Encryption of data at rest and in transit, plus MFA for authentication. (c) User responsibility: Use a strong, unique password and enable MFA on their account.
Integrity: (a) Threat: A malicious insider or malware modifies files without authorization. (b) Mechanism: File versioning and integrity checks (e.g., SHA-256 hashes). (c) User responsibility: Regularly review file versions and enable alerts for suspicious file changes.
Availability: (a) Threat: A distributed denial-of-service (DDoS) attack makes the service inaccessible. (b) Mechanism: Redundant data centers, load balancing, and DDoS mitigation services. (c) User responsibility: Maintain local backups of critical files to ensure access even if the cloud service is unavailable.
Exercise 5: You are tasked with developing a security architecture for a small e-commerce startup that processes credit card payments and stores customer profiles. The startup has a limited budget and a small IT team. Using the concepts from this tutorial, design a minimal but effective security architecture that addresses the key threats. Your design should include: (a) the security objectives that are most critical for this business; (b) at least two administrative controls, two technical controls, and one physical control; and (c) a brief explanation of how your architecture provides defense-in-depth.
(a) Critical security objectives: Confidentiality (customer data and payment card details must be protected), Integrity (orders and inventory must be accurate), and Availability (the website must be accessible to customers). Nonrepudiation is also important for transaction disputes.
(b) Administrative controls: (1) A written security policy that includes an Acceptable Use Policy and an Incident Response Plan. (2) Mandatory security awareness training for all employees, with a focus on phishing and password hygiene. Technical controls: (1) Use of a PCI-compliant payment gateway (Stripe or similar) to offload cardholder data storage. (2) Implementation of a Web Application Firewall (WAF) and SSL/TLS for all web traffic. Physical control: Secure the server room with access badges and environmental monitoring.
(c) This architecture provides defense-in-depth by layering controls: the WAF and TLS protect against network and application attacks; the payment gateway reduces the scope of sensitive data; training and policies address human error; and physical controls protect the hardware. If one layer fails, others remain in place.
These homework questions require research, analysis, and synthesis. They are designed to deepen your understanding and prepare you for the subsequent tutorials.
Homework 1: Research a major data breach that has occurred in the last five years (e.g., SolarWinds, Colonial Pipeline, Equifax, or a breach of your choice). Write a 600-word analysis that: (a) describes the breach, including what information was compromised; (b) identifies which security objective(s) (CIA triad and/or additional objectives) were violated; (c) analyzes which security controls (administrative, technical, physical) failed or were absent; and (d) proposes recommendations that could have prevented or mitigated the breach.
Analysis of the Colonial Pipeline Ransomware Attack (May 2021)
(a) The Colonial Pipeline attack was a ransomware incident that forced the company to shut down a major fuel pipeline serving the U.S. East Coast. The attackers (DarkSide ransomware group) gained access through a compromised VPN password and deployed ransomware that encrypted critical systems. The company paid a ransom of approximately $4.4 million to restore operations.
(b) The attack violated Availability (the pipeline was shut down, disrupting fuel supply) and Integrity (systems were encrypted and rendered unusable). It also threatened Confidentiality as the attackers exfiltrated data before encrypting it.
(c) The primary failure was in technical controls: the VPN account lacked multi-factor authentication (MFA), and there was no robust segmentation between IT and operational technology (OT) networks. Administrative controls were also insufficient, as there was no enforced password policy requiring MFA for remote access.
(d) Recommendations: (1) Enforce MFA for all remote access, especially for privileged accounts. (2) Implement network segmentation to isolate critical OT systems from IT networks. (3) Develop and regularly test an incident response plan that includes ransomware-specific procedures. (4) Maintain offline backups to enable restoration without paying ransom.
Homework 2: Compare and contrast the OSI security architecture (X.800) with a modern security framework such as the NIST Cybersecurity Framework (CSF) or the ISO/IEC 27000 series. In your analysis, address: (a) the purpose and scope of each framework; (b) how security services and mechanisms are represented in each; and (c) which framework is more suitable for contemporary enterprise security management. Justify your answer with examples.
Comparison: OSI X.800 vs. NIST CSF
(a) X.800 is a technical standard focused on providing a systematic description of security services and mechanisms within the OSI reference model. Its scope is primarily network-layer security. The NIST CSF, on the other hand, is a high-level framework for managing cybersecurity risk across an entire enterprise, covering governance, processes, and technical controls.
(b) X.800 defines specific services (Authentication, Access Control, Confidentiality, etc.) and the mechanisms that implement them. NIST CSF uses five core functions (Identify, Protect, Detect, Respond, Recover) and 23 categories that map to organizational processes. While X.800 is more technical, the CSF is more strategic and process-oriented.
(c) For contemporary enterprise security management, the NIST CSF is more suitable because it addresses the full lifecycle of security management, from risk assessment to incident recovery. It is widely adopted in both the public and private sectors. However, X.800 remains valuable as a technical reference for understanding specific security mechanisms and their placement within network architectures.
Homework 3: A manufacturing company is transitioning from a traditional on-premises IT model to a hybrid cloud architecture. The company handles sensitive designs and intellectual property. Using the security architecture concepts from this tutorial, write a 500-word memo to the CIO outlining: (a) the key security challenges introduced by the hybrid cloud transition; (b) the security objectives that must be prioritized; and (c) the types of controls (administrative, technical, physical) that will be required, with specific examples for each.
Memo to CIO: Hybrid Cloud Security Considerations
(a) Key challenges include: expanded attack surface (more endpoints, APIs, and cloud services), loss of direct physical control over data storage, complexity of managing identity across on-prem and cloud environments, and increased risk of misconfiguration in cloud services.
(b) The company must prioritize Confidentiality (protecting intellectual property and trade secrets), Integrity (ensuring design files are not tampered with), and Authenticity (verifying that only authorized personnel access sensitive data). Availability is also critical for production systems.
(c) Administrative controls: Develop a cloud security policy, provide training on cloud-specific security risks, and implement a vendor risk management process. Technical controls: Use a Cloud Access Security Broker (CASB) for visibility and control, implement encryption for data at rest and in transit, enforce MFA and conditional access policies, and deploy cloud-native monitoring (e.g., AWS CloudTrail, Azure Monitor). Physical controls: While the cloud provider handles data center physical security, the company should ensure its on-premises facilities are secured and that any physical tokens or smart cards are properly managed.
Homework 4: Reflect on the "relationship between networking and security" discussed in Section 5.9. Write a 400-word essay that explores how the evolution of networking (from early centralized networks to modern SDN, 5G, and IoT) has transformed the security landscape. Discuss how security must adapt to these changes, referencing at least two of the security principles from this tutorial.
The Evolving Relationship Between Networking and Security
Early networks were centralized, with clear perimeters and limited external connectivity. Security was largely achieved through perimeter defenses such as firewalls and access controls. However, the modern network landscape is fundamentally different: software-defined networking (SDN) decouples the control plane from the data plane, 5G networks introduce massive IoT connectivity, and cloud computing dissolves traditional boundaries.
These changes have expanded the attack surface exponentially. Every connected device — from smart sensors to industrial controllers — becomes a potential entry point for attackers. The principle of defense-in-depth, once satisfied by layered perimeter defenses, now requires micro-segmentation, zero-trust architectures, and continuous monitoring at every node. The principle of least privilege must be applied not only to users but also to devices and services, with dynamic, contextual access decisions.
Security can no longer be a static perimeter; it must be embedded in the network fabric itself. This requires a shift from network-centric to identity-centric security, where trust is never implicit and is continuously verified. As networks become more complex, automation and AI-driven security operations are necessary to detect and respond to threats at machine speed.
Homework 5: Design a security policy outline for a university that offers online courses to students across the globe. The policy must cover: (a) acceptable use of university IT resources; (b) data classification and handling for student records and research data; (c) remote access and VPN requirements; and (d) incident reporting procedures. Provide a 2-page outline with headings and bullet points, and include a brief justification for each major section based on the security concepts from this tutorial.
University Security Policy Outline
1. Acceptable Use Policy (AUP) — Justification: Establishes clear expectations for behavior, reducing the risk of misuse and providing a basis for enforcement (administrative control). Covers: approved uses of networks and systems, prohibited activities (e.g., hacking, torrenting), personal device usage, and consequences of violations.
2. Data Classification and Handling — Justification: Protects confidentiality and integrity by ensuring that sensitive data is handled appropriately. Covers: classification levels (Public, Internal, Confidential, Restricted), handling procedures for each level, encryption requirements, and data retention schedules.
3. Remote Access and VPN Policy — Justification: Secures access to university resources from outside the campus network, reducing the risk of unauthorized access. Covers: mandatory MFA for remote access, use of VPN for all off-campus connections, endpoint security requirements, and logging of remote sessions.
4. Incident Reporting and Response — Justification: Ensures that security incidents are detected and responded to promptly, minimizing damage and supporting accountability. Covers: reporting procedures (who to contact, what to report), incident classification (low, medium, high severity), and post-incident review requirements.
Each section is aligned with the principles of defense-in-depth and the CIA triad, providing a comprehensive governance framework.
This tutorial has laid the essential groundwork for COMP400 by introducing the foundational concepts of computer and network security. We began by distinguishing among information security, computer security, network security, and cybersecurity, recognizing that each domain has a distinct scope but is interdependent in practice. We established the importance of security—not just as a technical necessity, but as an economic, legal, ethical, and operational imperative.
The CIA triad—Confidentiality, Integrity, and Availability—was presented as the core security objectives, along with the equally important properties of authenticity, accountability, and nonrepudiation. These objectives guide the selection and implementation of all security controls and mechanisms. We then introduced the OSI security architecture (X.800), a foundational framework that classifies security services, mechanisms, and attacks, providing a systematic way to analyze and design secure systems.
We explored the three categories of security controls—administrative, technical, and physical—and emphasized that effective security requires a balanced integration of all three. Security policies were presented as the governance backbone that sets expectations and drives behavior. Finally, we examined the intimate relationship between networking and security, noting that the complexity and openness of modern networks demand a shift from perimeter-based to identity-centric, zero-trust architectures.
As you progress to Tutorial 1.2: Cyber Threats, Vulnerabilities, and Security Attacks, you will build on this foundation by examining the specific threat actors, attack methodologies, and vulnerabilities that security controls must address. The concepts you have learned here—the security objectives, the classification of attacks, and the structure of security architectures—will serve as a lens through which to analyze the threat landscape and design effective countermeasures.