WEBVTT 1 00:00:00.080 --> 00:00:03.040 Welcome to another deep dive. This time we're cracking Open 2 00:00:03.080 --> 00:00:07.960 Security and Computing fifth Edition Classic. It really is, yeah, 3 00:00:08.199 --> 00:00:11.000 and for any listeners who want to check it out themselves, 4 00:00:11.080 --> 00:00:15.560 you can find it with ISBN thirteen nine seven eight 5 00:00:15.679 --> 00:00:18.280 zero one three four zero eight five zero four to 6 00:00:18.359 --> 00:00:23.000 three okay or ISBN ten zero one three four zero 7 00:00:23.039 --> 00:00:25.440 eight five zero four three perfect. But we're going to 8 00:00:25.440 --> 00:00:28.320 distill it down all the key insights from this textbook 9 00:00:28.320 --> 00:00:31.239 and even its glossary almost like a cheat sheet, right 10 00:00:31.600 --> 00:00:35.520 for understanding the essential concepts of computer security and privacy. 11 00:00:35.640 --> 00:00:37.399 Yeah, and it's really cool because what's interesting about this 12 00:00:37.439 --> 00:00:39.359 book is that it's not just about the technical stuff 13 00:00:39.439 --> 00:00:42.479 right right, it's about how computers affect our lives, like 14 00:00:42.560 --> 00:00:45.560 everyday life and the choices we make exactly every single day. 15 00:00:45.640 --> 00:00:48.399 Yeah, it's about you. So one thing that really caught 16 00:00:48.399 --> 00:00:51.000 my eye was the section on data integrity. And you know, 17 00:00:51.039 --> 00:00:52.920 it's one thing to think about typos and like, oh, 18 00:00:53.039 --> 00:00:56.520 you know, is the data accurate? But the book takes 19 00:00:56.520 --> 00:00:57.479 it way beyond that. 20 00:00:57.719 --> 00:00:59.560 It does, and it should right because you're talking about 21 00:00:59.600 --> 00:01:02.159 bankings soon as you're talking about infrastructure, like this stuff 22 00:01:02.200 --> 00:01:05.640 needs to be right on point, because imagine a database 23 00:01:05.760 --> 00:01:11.680 where financial transactions are like reordered. It's just very subtly. Yeah, 24 00:01:11.719 --> 00:01:14.760 but in a way that benefits someone with malicious intent. 25 00:01:15.079 --> 00:01:16.640 WHOA, Okay, so all the. 26 00:01:16.599 --> 00:01:19.439 Numbers add up, the order's just different. Yeah, that's a 27 00:01:19.560 --> 00:01:20.799 huge integrity issue. 28 00:01:20.840 --> 00:01:23.599 That's insidious. And the book also talks about i mean 29 00:01:23.920 --> 00:01:27.280 even on the hardware level, right, the pentium chip flaw. 30 00:01:27.560 --> 00:01:32.599 Oh yeah, back in the day, the nineties. So Intel's 31 00:01:32.599 --> 00:01:36.680 pentium chip had a flaw where it would produce incorrect 32 00:01:36.680 --> 00:01:40.079 results for certain calculations. Yeah, and like you're thinking, well, 33 00:01:40.079 --> 00:01:42.480 how often does that really happen? Well, if you're doing 34 00:01:42.519 --> 00:01:47.239 like scientific modeling or financial analysis, any little error can 35 00:01:47.280 --> 00:01:50.159 snowball huge. You do a huge problem. Intel had to 36 00:01:50.200 --> 00:01:53.200 replace millions of chips, so yeah, they learned the hard. 37 00:01:53.000 --> 00:01:56.560 Way extensive lesson. So then you know, it gets even 38 00:01:56.599 --> 00:02:01.400 a little bit more unsettling when the book delves into terrorism. Oh, 39 00:02:01.480 --> 00:02:04.840 terrorism in the digital age. And the thing that surprised 40 00:02:04.879 --> 00:02:07.719 me was that there are actually four ways, according to 41 00:02:07.719 --> 00:02:10.479 this book, that terrorists use computers. Yeah. 42 00:02:10.479 --> 00:02:13.360 It's not just about like you know, building bombs or something, right, 43 00:02:13.360 --> 00:02:17.800 There's more to it than that computers are enablers, like 44 00:02:17.800 --> 00:02:19.719 if you think about the two thousand and eight moon 45 00:02:19.759 --> 00:02:23.199 by attacks, right, they use Google Earth, Oh wow, to plan. 46 00:02:23.639 --> 00:02:25.000 Imagine a tool. 47 00:02:24.759 --> 00:02:27.240 That we use every day exactly for you know, getting 48 00:02:27.280 --> 00:02:28.680 directions to the grocery store. 49 00:02:28.719 --> 00:02:30.560 Exactly. Crazy wild. 50 00:02:30.879 --> 00:02:34.960 So besides being aware of, you know, these darker sides 51 00:02:35.000 --> 00:02:37.719 of technology and how it can be used, what can 52 00:02:37.759 --> 00:02:40.879 we do as individuals to protect ourselves? The book talks 53 00:02:40.919 --> 00:02:44.080 a lot about authentication, which I think is a very 54 00:02:44.120 --> 00:02:45.319 hot topic these days. 55 00:02:45.439 --> 00:02:47.759 It is more than ever, especially with the rise of 56 00:02:47.840 --> 00:02:50.400 data breaches. Yeah, and it's more than just you know, 57 00:02:50.479 --> 00:02:54.639 remembering a really strong, complex password, right, it could be tough. 58 00:02:54.960 --> 00:02:58.599 So there are three ways to authenticate something you know, 59 00:02:59.400 --> 00:03:00.840 something you are, something you have. 60 00:03:01.120 --> 00:03:03.840 Oh okay, I've heard that before, but bring that down 61 00:03:03.919 --> 00:03:04.199 for me. 62 00:03:04.599 --> 00:03:09.319 Okay, So something you know that's like a password, something 63 00:03:09.360 --> 00:03:14.599 you are is like a biometric fingerprint, facial scan, and 64 00:03:14.639 --> 00:03:18.000 then something you have is a physical token like a keyfob. 65 00:03:19.120 --> 00:03:22.639 And we're seeing more companies using that, especially for sensitive accounts. 66 00:03:22.840 --> 00:03:24.960 Right, multi factor authentication. 67 00:03:24.560 --> 00:03:28.719 Right, right, exactly? Yeah, But the book also warns against 68 00:03:28.879 --> 00:03:31.280 you know, just adding more and more layers of authentication. 69 00:03:31.520 --> 00:03:35.639 Really, I would think that more security equals more protection. 70 00:03:36.199 --> 00:03:38.479 Yeah, you would think so, so what's the problem with that? 71 00:03:38.960 --> 00:03:42.120 Sometimes it can backfire really, Like there's this case study 72 00:03:42.120 --> 00:03:44.599 in the book about Ulster Bank, you know, their online 73 00:03:44.599 --> 00:03:50.240 banking system, and they implemented so many authentication factors that 74 00:03:50.319 --> 00:03:54.039 it actually made the system more vulnerable. Wow, because it 75 00:03:54.080 --> 00:03:58.159 created this really clunky and confusing user experience. Oh right, 76 00:03:58.199 --> 00:03:59.400 so customers were making. 77 00:03:59.159 --> 00:04:02.560 Mistakes struggling to remember all their different passwords, right. 78 00:04:02.599 --> 00:04:04.960 Oh, interesting, So yeah, they were making mistakes that actually 79 00:04:04.960 --> 00:04:05.759 weakened the system. 80 00:04:05.919 --> 00:04:08.879 Okay, So it's not always about more is better, it's 81 00:04:08.919 --> 00:04:12.800 about finding the right balance. So once we are authenticated, 82 00:04:12.800 --> 00:04:15.120 we're in the system, how do we make sure we're 83 00:04:15.120 --> 00:04:16.560 only accessing what we're supposed to do? 84 00:04:16.680 --> 00:04:16.920 Right? 85 00:04:17.160 --> 00:04:18.720 Isn't that where access control comes in? 86 00:04:19.079 --> 00:04:22.319 Access control? Think of it like the bouncer at the club. Okay, 87 00:04:22.319 --> 00:04:25.040 they're deciding who gets in and what they can access 88 00:04:25.079 --> 00:04:28.319 once they're inside. And we have all these different mechanisms 89 00:04:28.480 --> 00:04:31.519 simple list of users, or we have these complex role 90 00:04:31.560 --> 00:04:32.720 based systems. 91 00:04:32.839 --> 00:04:36.519 So like some systems are like exclusive VIP areas and 92 00:04:36.560 --> 00:04:38.839 others are more open door exactly. 93 00:04:38.439 --> 00:04:41.279 And there's a trade off between security and complexity. Right. 94 00:04:41.319 --> 00:04:43.639 So the more layers of access control, the more secure 95 00:04:43.680 --> 00:04:45.680 it is. But then it can slow things down and 96 00:04:45.720 --> 00:04:46.680 it's harder to manage. 97 00:04:46.800 --> 00:04:51.480 Okay, so authentication, we're in access control. Now we're only 98 00:04:51.480 --> 00:04:54.680 seeing what we should be seeing. But what about keeping 99 00:04:54.680 --> 00:04:55.600 our data secret? 100 00:04:55.759 --> 00:04:59.759 Encryption? Yeah, one of the most powerful tools for protecting 101 00:04:59.800 --> 00:05:03.199 in information. It's basically writing a message in code that 102 00:05:03.319 --> 00:05:05.079 only someone with the right key can read. 103 00:05:05.360 --> 00:05:08.000 Right, Right, But there are different types of encryption. 104 00:05:07.839 --> 00:05:09.800 Right, There are symmetric and asymmetric. 105 00:05:09.839 --> 00:05:10.920 Okay, so what's the difference. 106 00:05:11.199 --> 00:05:14.759 Symmetric encryption is using the same key for both encrypting 107 00:05:14.839 --> 00:05:19.959 and decrypting. Okay, So it's fast, it's efficient, but securely sharing. 108 00:05:19.560 --> 00:05:21.360 That key, yeah, right, how do you do that? 109 00:05:21.759 --> 00:05:24.160 It's tricky. So that's where asymmetric comes in. 110 00:05:24.319 --> 00:05:24.639 Okay. 111 00:05:24.759 --> 00:05:28.199 Asymmetric encryption uses two keys. You have a public key 112 00:05:28.199 --> 00:05:30.759 that you can share freely, and then a private key 113 00:05:30.759 --> 00:05:31.600 that's kept secret. 114 00:05:32.000 --> 00:05:33.399 Oh interesting, Okay. 115 00:05:33.639 --> 00:05:37.600 Anyone can encrypt a message using that public key, but 116 00:05:37.720 --> 00:05:40.160 only the person with the private key can decrypt it. 117 00:05:40.399 --> 00:05:43.680 So it's like a mailbox with two slots, one for 118 00:05:43.759 --> 00:05:46.399 anyone to drop a letter in and one that only 119 00:05:46.399 --> 00:05:48.959 the owner can open perfect analogy. That makes a lot 120 00:05:49.000 --> 00:05:52.439 of sense. So asymmetric encryption is like having separate keys 121 00:05:52.519 --> 00:05:56.000 for sending and receiving messages, which makes it much easier. Right, 122 00:05:56.319 --> 00:05:59.639 but are there any downsides? I mean, there's gotta be right. 123 00:05:59.720 --> 00:06:03.839 Well, asymmetric is generally slower and needs more processing power. 124 00:06:04.199 --> 00:06:07.279 It's like choosing between a speed scooter and a sturdy truck. 125 00:06:07.800 --> 00:06:10.680 Yeah, okay, it depends on what you need exactly. 126 00:06:11.120 --> 00:06:14.399 And then you know, even with the best encryption algorithms, 127 00:06:14.759 --> 00:06:18.519 there's always the risk of human error, right, exact sloppy 128 00:06:18.519 --> 00:06:20.519 implementation that can weaken the system. 129 00:06:20.680 --> 00:06:24.279 Human factor always comes into play. So we've been talking 130 00:06:24.279 --> 00:06:27.360 about you know, individual computers and data, but what happens 131 00:06:27.399 --> 00:06:29.360 when we start connecting those to networks. 132 00:06:29.399 --> 00:06:32.720 Oh yeah, that opens up a whole new can of worms. Networks, 133 00:06:33.040 --> 00:06:36.079 just like our bodies, they have weaknesses. 134 00:06:35.560 --> 00:06:38.480 That can be exploited. Right, exactly what kind of weaknesses 135 00:06:38.480 --> 00:06:39.399 are we talking about here? 136 00:06:39.439 --> 00:06:42.240 And one thing is if you think about microwave signals, 137 00:06:42.399 --> 00:06:45.360 those aren't confined by wires, right, so it's easier to 138 00:06:45.399 --> 00:06:50.360 intercept those signals. And then wireless networks themselves are vulnerable 139 00:06:50.439 --> 00:06:52.199 to things like MSc address spoofing. 140 00:06:53.120 --> 00:06:55.759 Wait a minute, back up, what's MSc address spoofing? 141 00:06:56.040 --> 00:07:01.480 So basically, an attacker disguises their devices network address. Oh okay, 142 00:07:01.560 --> 00:07:04.319 to make it look like a trusted device. He exactly 143 00:07:04.600 --> 00:07:06.720 like sneaking into a party with someone else's name attack. 144 00:07:06.959 --> 00:07:09.920 And then there are those denial of service attacks that 145 00:07:09.959 --> 00:07:14.079 we're always hearing about. Those are a huge network vulnerability 146 00:07:14.480 --> 00:07:20.199 and we're seeing a rise in these DDAs attacks. Distributed distributed, right, 147 00:07:20.519 --> 00:07:24.319 so the attack comes from multiple computers, making it super 148 00:07:24.319 --> 00:07:25.319 hard to defend. 149 00:07:25.000 --> 00:07:29.040 Against, like a swarm of bees exactly coming from every direction. 150 00:07:29.279 --> 00:07:31.560 And the book has a really crazy example of a 151 00:07:31.639 --> 00:07:35.040 DIDOS attack, does it. Yeah, this online gambling site is 152 00:07:35.040 --> 00:07:39.000 called bett Cross got hit by a massive DIDAS attack 153 00:07:39.639 --> 00:07:44.160 and get this, the attackers demanded a ransom to stop 154 00:07:44.199 --> 00:07:45.360 the attack, so. 155 00:07:45.279 --> 00:07:47.360 They're holding the website hostage. 156 00:07:47.680 --> 00:07:49.839 Basically yeah wow. Yeah. 157 00:07:49.879 --> 00:07:53.360 So how do we protect against these network attacks because 158 00:07:53.399 --> 00:07:55.079 that sounds pretty scary. 159 00:07:55.319 --> 00:07:58.439 Well, there are different levels of protection. You can encrypt 160 00:07:58.480 --> 00:08:01.199 the data as it travels across a specific link. 161 00:08:01.680 --> 00:08:03.279 Between two offices or yeah. 162 00:08:03.120 --> 00:08:05.319 Exactly, okay, Or you can do what's called end to 163 00:08:05.519 --> 00:08:08.199 end encryption, which protects the data all the way from 164 00:08:08.279 --> 00:08:09.959 the sender to the recipient. 165 00:08:10.079 --> 00:08:12.560 Okay, got it. So it's like protecting the data in transit. 166 00:08:12.639 --> 00:08:16.800 But are there ways to prevent data loss even when 167 00:08:16.839 --> 00:08:17.920 it's not being transmitted? 168 00:08:18.079 --> 00:08:18.399 Yeah? 169 00:08:18.439 --> 00:08:20.800 I know the book talks about data loss prevention, but 170 00:08:20.879 --> 00:08:21.920 what exactly is that. 171 00:08:22.480 --> 00:08:26.399 It's like a watchdog for your sensitive info. It uses 172 00:08:26.439 --> 00:08:31.160 all these technologies to detect and prevent sensitive data from 173 00:08:31.279 --> 00:08:32.399 leaving the organization. 174 00:08:32.799 --> 00:08:36.879 Okay, so it's like accidentally emailing something or copying it 175 00:08:36.919 --> 00:08:40.600 to a USB drive exactly, or even printing it out exactly. Okay, 176 00:08:40.759 --> 00:08:42.840 so that's a big deal, especially these days with all 177 00:08:42.840 --> 00:08:46.440 these high profile data leaks. Oh yeah, absolutely, So DLP 178 00:08:46.679 --> 00:08:50.159 is like that last line of defense to stop those 179 00:08:50.240 --> 00:08:53.799 oops moments from turning into a pr night neer exactly. 180 00:08:53.879 --> 00:08:54.840 Well what about the cloud? 181 00:08:55.320 --> 00:08:56.240 Oh yeah, the cloud? 182 00:08:56.360 --> 00:08:59.960 It's so convenient it is. But are there security risks 183 00:09:00.159 --> 00:09:02.720 with storing our data in the cloud? I mean, are 184 00:09:02.759 --> 00:09:04.320 we making it more vulnerable? 185 00:09:04.759 --> 00:09:07.759 You're essentially trusting a third party with your data. You 186 00:09:07.840 --> 00:09:10.000 got to trust that they have the right security measures 187 00:09:10.000 --> 00:09:12.480 in place, that they're handling it responsibly. 188 00:09:12.720 --> 00:09:15.240 But you can't always guarantee that trust and I Remember 189 00:09:15.639 --> 00:09:18.600 the book actually had a good example of this with Dropbox. 190 00:09:18.720 --> 00:09:19.519 What happened there? 191 00:09:19.720 --> 00:09:24.600 So back in twenty eleven, Dropbox had this coding error 192 00:09:25.159 --> 00:09:29.919 that basically disabled their authentication system. Oh no for several hours, 193 00:09:30.279 --> 00:09:33.360 No way, so anyone could have accessed any account during 194 00:09:33.360 --> 00:09:33.759 that time. 195 00:09:33.879 --> 00:09:38.159 Yikes. So even a big reputable company like Dropbox right 196 00:09:38.279 --> 00:09:41.240 can have those vulnerabilities absolutely, and. 197 00:09:41.240 --> 00:09:43.519 You have to think about you know, you've got attacks 198 00:09:43.559 --> 00:09:46.879 against shared resources, You've got insecure APIs. 199 00:09:46.960 --> 00:09:49.120 Oh no, I need a little help here. What are 200 00:09:49.159 --> 00:09:50.360 insecure APIs? 201 00:09:50.720 --> 00:09:53.679 So those are like the interfaces that allow applications to 202 00:09:53.720 --> 00:09:56.840 talk to each other. Okay, if those aren't secure, it 203 00:09:56.919 --> 00:09:59.480 creates vulnerabilities that attackers can exploit. 204 00:09:59.639 --> 00:10:01.919 Okay, got it. So it's not just about choosing a 205 00:10:01.919 --> 00:10:05.720 trustworthy cloud provider. It's also understanding the security of that 206 00:10:05.799 --> 00:10:07.759 whole shared environment exactly. 207 00:10:07.919 --> 00:10:10.200 And moving to the cloud doesn't mean you're off the hook. Yeah, 208 00:10:10.240 --> 00:10:11.960 you still need to do your due diligence, make sure 209 00:10:11.960 --> 00:10:13.960 the cloud provider meets your security needs. 210 00:10:14.440 --> 00:10:17.159 It's like renting a car. You're responsible for driving it 211 00:10:17.200 --> 00:10:19.120 safely exactly, even though you don't own it. 212 00:10:19.399 --> 00:10:19.919 Exactly. 213 00:10:20.240 --> 00:10:24.240 Shared responsibility, shared responsibility Okay, so we've been focusing a 214 00:10:24.279 --> 00:10:26.600 lot on the technical aspects, but I want to shift 215 00:10:26.679 --> 00:10:29.480 gears a little bit to talk about privacy because it 216 00:10:29.519 --> 00:10:32.240 seems like that's a growing concern in this digital age, 217 00:10:32.360 --> 00:10:35.120 especially with all the data we're generating online. 218 00:10:35.240 --> 00:10:38.440 Absolutely, privacy is not just a computer issue, right, right, 219 00:10:38.480 --> 00:10:41.480 But computers have definitely like amplified the risks. 220 00:10:41.519 --> 00:10:44.519 They've changed the game they have. Yeah, it's not just 221 00:10:44.600 --> 00:10:49.519 about someone peeking into your diary. It's about vast amounts 222 00:10:49.559 --> 00:10:54.080 of data being collected, analyzed, often without our knowledge. 223 00:10:53.960 --> 00:10:57.039 Right, and used in ways that we may not even realize. 224 00:10:57.120 --> 00:10:59.399 Yeah, it's like big Brother is watching. But a lot 225 00:10:59.440 --> 00:11:02.039 of times it's not even the government, it's corporations. 226 00:11:02.440 --> 00:11:02.679 Right. 227 00:11:02.879 --> 00:11:06.519 So, what are some specific ways that computers are impacting 228 00:11:06.600 --> 00:11:07.320 our privacy? 229 00:11:07.679 --> 00:11:10.080 Well, you got RFID tags, they're everywhere. 230 00:11:10.159 --> 00:11:11.759 Yeah, those tiny little chip. 231 00:11:11.639 --> 00:11:16.039 Credit cards, passports, they can be read wirelessly, often without 232 00:11:16.080 --> 00:11:19.320 our knowledge. So it's not just about our online activities. 233 00:11:19.360 --> 00:11:21.639 It's like our physical movements being tracked. 234 00:11:21.759 --> 00:11:21.960 Right. 235 00:11:22.360 --> 00:11:25.559 And then you've got those privacy policies, you know, those long, 236 00:11:25.720 --> 00:11:27.120 complicated documents. 237 00:11:27.200 --> 00:11:29.480 Yeah, the ones I just click accept on and hope 238 00:11:29.480 --> 00:11:31.960 for the best, exactly but they probably say a lot 239 00:11:31.960 --> 00:11:34.360 of important stuff about how our data is being collected 240 00:11:34.399 --> 00:11:34.960 and shared. 241 00:11:35.720 --> 00:11:38.080 Right, But even if you read them, sometimes they're written 242 00:11:38.080 --> 00:11:40.559 in a way that's hard to understand. Yeah, it's like 243 00:11:40.600 --> 00:11:42.159 this transparency paradox. 244 00:11:42.320 --> 00:11:45.120 Right, how do you provide detailed information in a way 245 00:11:45.200 --> 00:11:49.519 that's both comprehensive but also user friendly? So what can 246 00:11:49.559 --> 00:11:52.960 we do to protect our privacy in this digital age? 247 00:11:53.000 --> 00:11:54.399 I mean, is it even possible? 248 00:11:54.559 --> 00:11:58.480 It's not easy, but awareness is key. We can try 249 00:11:58.480 --> 00:12:03.039 to minimize our digital foot print. Use privacy focused browsers 250 00:12:03.039 --> 00:12:06.440 and search engines, be careful what we share online, actually 251 00:12:06.480 --> 00:12:09.080 read the key sections of those privacy policies. 252 00:12:09.200 --> 00:12:12.039 Yeah, be informed. We have to be informed consumers, right, 253 00:12:12.159 --> 00:12:16.600 exactly of digital services and make choices. Okay, but even 254 00:12:16.679 --> 00:12:19.720 if we're careful about our own data, what about the 255 00:12:19.759 --> 00:12:23.039 security of the systems that we use? I mean, how 256 00:12:23.039 --> 00:12:25.960 can we be sure that those are protected from attack? 257 00:12:26.279 --> 00:12:29.320 Security testing? You've got to find the flaws before the 258 00:12:29.320 --> 00:12:29.960 bad guys do. 259 00:12:30.440 --> 00:12:32.039 I imagine that's pretty complex. 260 00:12:32.279 --> 00:12:34.679 It is. It's not just checking if things work right, 261 00:12:35.039 --> 00:12:38.440 it's trying to break the system. Oh wow, thinking like an. 262 00:12:38.360 --> 00:12:40.840 Attacker, So you're playing cat and mouse. 263 00:12:40.559 --> 00:12:44.399 With the hackers kind of but with serious stakes. And 264 00:12:44.480 --> 00:12:47.039 the book talks about how, you know, the old school 265 00:12:47.279 --> 00:12:50.759 penetrate and patch method isn't enough anymore. You find a flaw, 266 00:12:50.919 --> 00:12:53.360 fix it, that's not going to cut it these days, right, right, 267 00:12:53.440 --> 00:12:57.679 security testing needs to be way more comprehensive, way more systematic. 268 00:12:57.279 --> 00:12:58.960 Holistic approach, I guess. 269 00:12:58.919 --> 00:13:01.120 Exactly, and it can just be a one time thing. 270 00:13:01.120 --> 00:13:04.039 You got to be constantly adapting to new. 271 00:13:03.919 --> 00:13:07.240 Threats, so we have to be vigilant. But security isn't 272 00:13:07.320 --> 00:13:10.840 just about technology, right, It's about people and processes too. 273 00:13:10.840 --> 00:13:13.720 You're absolutely right, and that's where security management comes in, 274 00:13:13.919 --> 00:13:17.720 having the right people, plans, procedures to manage and mitigate 275 00:13:17.720 --> 00:13:18.720 those security risks. 276 00:13:18.840 --> 00:13:21.120 So it's like you got to have a plan, A, B, 277 00:13:21.399 --> 00:13:24.200 and C to deal with all the security challenges that 278 00:13:24.200 --> 00:13:26.200 are going to come our way, exactly. But even with 279 00:13:26.279 --> 00:13:28.600 all the plans and technology in the world, sometimes there 280 00:13:28.600 --> 00:13:31.720 are situations where there's no easy answer, absolutely right. So 281 00:13:31.759 --> 00:13:34.519 that's where ethics come in, right. This book really talks 282 00:13:34.559 --> 00:13:39.120 about that ethics being like the compass for those tricky situations, 283 00:13:39.639 --> 00:13:42.200 especially when the law is fuzzy, right, yeah. 284 00:13:42.039 --> 00:13:45.039 Or inadequate and in the world of computer security. That's 285 00:13:45.039 --> 00:13:45.440 a lot. 286 00:13:46.159 --> 00:13:49.960 So how do we make ethical decisions in this crazy 287 00:13:49.960 --> 00:13:50.720 digital world. 288 00:13:51.000 --> 00:13:55.519 The book really emphasizes personal principles and responsible. 289 00:13:55.000 --> 00:13:58.320 Action, thinking about the consequences not just for ourselves but 290 00:13:58.360 --> 00:14:01.120 for others. Right, Okay, So we've covered a lot of 291 00:14:01.159 --> 00:14:03.279 ground in this first part of our deep dive into 292 00:14:03.600 --> 00:14:10.120 security in computing. Data integrity, the role of computers and terrorism, authentication, 293 00:14:10.399 --> 00:14:17.679 access control, encryption, network vulnerabilities, data loss prevention, cloud security, privacy, 294 00:14:17.759 --> 00:14:20.159 security testing, and even ethics. 295 00:14:21.159 --> 00:14:22.360 It's a lot, it is. 296 00:14:22.440 --> 00:14:25.080 It's a lot to process, but I think it shows 297 00:14:25.159 --> 00:14:29.559 just how complex and important this field of computer security is. 298 00:14:29.720 --> 00:14:31.159 Absolutely, it's always evolving. 299 00:14:33.320 --> 00:14:37.039 Welcome back to our deep dive into security in computing. 300 00:14:37.600 --> 00:14:40.679 We just scratched the surface of this complex field. But 301 00:14:40.759 --> 00:14:43.799 now we're getting to the good stuff, the tools and 302 00:14:43.840 --> 00:14:46.360 techniques they use to protect our digital world. 303 00:14:46.440 --> 00:14:48.799 Yeah, it's like peeking behind the curtain, seeing how the 304 00:14:48.840 --> 00:14:49.639 magic happens. 305 00:14:49.759 --> 00:14:52.320 I love that analogy. And one of the most fundamental 306 00:14:52.399 --> 00:14:54.799 tools we have is encryption. We talked about it before, 307 00:14:54.840 --> 00:14:57.720 but this book goes deep into the nitty gritty of 308 00:14:57.799 --> 00:14:58.799 different algorithms. 309 00:14:58.840 --> 00:15:00.039 Oh yeah, it gets pretty. 310 00:15:00.240 --> 00:15:02.559 It really does. And it's fascinating how they work. We 311 00:15:02.639 --> 00:15:06.000 talked about those two main types, symmetric and asymmetric encryption, 312 00:15:06.639 --> 00:15:09.559 but the book mentions all these specific algorithms like a 313 00:15:09.600 --> 00:15:13.399 whole alphabet soup of acronyms. It's a little intimidating, I. 314 00:15:13.360 --> 00:15:15.320 Know what you mean. It can be, but once you 315 00:15:15.399 --> 00:15:19.200 understand the basic principles, it's easier to see the bigger picture. Okay, 316 00:15:19.960 --> 00:15:24.039 so let's start with symmetric encryption. Does DES? RC two, 317 00:15:24.320 --> 00:15:26.559 RC four? Do those ring a bell? 318 00:15:26.840 --> 00:15:30.039 Vaguely? I remember DES being like the old standard, but 319 00:15:30.080 --> 00:15:31.080 I'm fuzzy on the rest. 320 00:15:31.279 --> 00:15:35.320 Right, DES the Data Encryption Standard. It was the go 321 00:15:35.399 --> 00:15:37.399 to for a long time, but these days it's been 322 00:15:37.399 --> 00:15:40.840 mostly replaced by AES, the Advanced Encryption Standard. 323 00:15:40.919 --> 00:15:41.240 Okay. 324 00:15:41.399 --> 00:15:44.519 Think of it like upgrading from a rotary phone to 325 00:15:44.639 --> 00:15:45.360 a smartphone. 326 00:15:45.399 --> 00:15:48.679 Okay, so AES is the more modern, more robust version. 327 00:15:48.840 --> 00:15:49.559 Gotcha, right? 328 00:15:49.840 --> 00:15:53.200 What about those RC algorithms? Are they completely obsolete? 329 00:15:53.519 --> 00:15:57.799 Not entirely. They're generally considered less secure than AES, but 330 00:15:57.879 --> 00:16:01.840 they still have their uses actually in situations where speed 331 00:16:01.960 --> 00:16:05.000 is more important than absolute security. Okay, Like you know, 332 00:16:05.360 --> 00:16:08.679 if you're encrypting a quick email RC four might be enough, 333 00:16:09.159 --> 00:16:11.960 but if you're dealing with like top secret government documents, 334 00:16:12.000 --> 00:16:14.440 you're going to want that heavy duty protection of AES. 335 00:16:14.600 --> 00:16:16.559 Okay, So it's all about choosing the right tool for 336 00:16:16.600 --> 00:16:19.799 the job exactly. Speaking of different tools, the book also 337 00:16:19.840 --> 00:16:23.240 mentions this RC five, which seems a little unique. 338 00:16:23.399 --> 00:16:25.120 Yeah. RC five is a bit different. It's called a 339 00:16:25.120 --> 00:16:28.840 fully parameterized block cipher, which basically means you can adjust 340 00:16:28.840 --> 00:16:31.080 the key length, of the block size, even the number 341 00:16:31.080 --> 00:16:34.600 of cycles, so you could really customize the level of security. 342 00:16:34.919 --> 00:16:36.919 It's like having an adjustable wrench for encryption. 343 00:16:37.120 --> 00:16:39.759 I love that it's so much easier to grasp these 344 00:16:39.759 --> 00:16:42.279 concepts when you have a visual absolutely. 345 00:16:42.600 --> 00:16:45.320 And it's interesting to note that RC five actually served 346 00:16:45.360 --> 00:16:47.840 as a model for RC six, which was one of 347 00:16:47.840 --> 00:16:50.279 the candidates considered for the AES standard. 348 00:16:50.360 --> 00:16:53.120 Oh really, So the RC family has had quite an 349 00:16:53.159 --> 00:16:54.519 impact on the world of encryption. 350 00:16:54.720 --> 00:16:55.440 Yeah, definitely. 351 00:16:55.480 --> 00:16:58.360 Okay, so we've covered a lot of ground with symmetric encryption. 352 00:16:58.919 --> 00:17:01.679 What about AC symmetric encryption, that's the one with the 353 00:17:01.679 --> 00:17:03.879 public and private keys, right exactly. 354 00:17:04.160 --> 00:17:07.440 And this cleverly solves that key distribution problem we talked 355 00:17:07.480 --> 00:17:11.960 about earlier with symmetric encryption, Sharing a secret key securely 356 00:17:12.039 --> 00:17:15.599 can be a real pain, especially in today's interconnected world. 357 00:17:15.880 --> 00:17:17.920 Right It's like trying to whisper a secret in a 358 00:17:17.960 --> 00:17:19.880 crowded room without anyone overhearing. 359 00:17:20.119 --> 00:17:21.319 Yeah, pretty much impossible. 360 00:17:21.440 --> 00:17:21.960 Day much. 361 00:17:22.119 --> 00:17:26.759 But with asymmetric encryption, you have two keys, a public 362 00:17:26.799 --> 00:17:29.680 key which you can share freely, and a private key 363 00:17:29.839 --> 00:17:32.960 which you keep super secret. Anyone can use your public 364 00:17:33.000 --> 00:17:35.839 key to encrypt a message for you, but only you 365 00:17:36.480 --> 00:17:38.319 with that private key can decrypt it. 366 00:17:38.599 --> 00:17:41.640 So it's like having a mailbox with two slots, one 367 00:17:41.680 --> 00:17:44.319 for anyone to drop mail in and one that only 368 00:17:44.359 --> 00:17:45.759 the owner can open with their key. 369 00:17:46.079 --> 00:17:49.599 Perfect analogy, and this system totally eliminates the need to 370 00:17:49.599 --> 00:17:52.440 share a secret key, making it so much more secure. 371 00:17:52.599 --> 00:17:55.359 Right, that makes sense. So what are some of the 372 00:17:55.440 --> 00:17:58.480 common algorithms used for asymmetric encryption. 373 00:17:58.920 --> 00:18:01.880 One of the most widely used as RSA. It's been 374 00:18:01.920 --> 00:18:05.240 around since the seventies and it's still considered extremely secure. 375 00:18:05.559 --> 00:18:09.599 It's based on the mathematical difficulty of factoring large prime numbers, okay, 376 00:18:10.200 --> 00:18:12.039 which trust me, is incredibly hard to do. 377 00:18:12.319 --> 00:18:15.200 So rsay that name sounds familiar. It's like the gold 378 00:18:15.319 --> 00:18:17.400 standard for asymmetric encryption. Right. 379 00:18:17.559 --> 00:18:19.519 Yeah, you could say that it's built to withstand some 380 00:18:19.599 --> 00:18:20.440 serious attacks. 381 00:18:20.519 --> 00:18:23.480 So RSA is like Fort Knox. Okay, but are there 382 00:18:23.519 --> 00:18:26.920 any downsides to asymmetric encryption? Is there a trade off 383 00:18:26.920 --> 00:18:28.039 for that extra security? 384 00:18:28.119 --> 00:18:32.599 There is? Generally speaking, asymmetric encryption is slower and requires 385 00:18:32.640 --> 00:18:34.880 more processing power than symmetric encryption. 386 00:18:34.960 --> 00:18:35.319 Makes sense. 387 00:18:35.519 --> 00:18:38.519 It's a bit like choosing between a speedy scooter and 388 00:18:38.759 --> 00:18:42.200 a sturdy but slower truck. It all depends on your 389 00:18:42.240 --> 00:18:44.119 needs and the resources you have available. 390 00:18:44.279 --> 00:18:48.400 It's about finding that balance between security and efficiency, right exactly. 391 00:18:49.240 --> 00:18:52.720 So we've got encryption for keeping our data secret, but 392 00:18:52.839 --> 00:18:56.240 what about ensuring that data hasn't been tampered within transit. 393 00:18:56.720 --> 00:18:58.400 That's where hash functions come in, right. 394 00:18:58.319 --> 00:19:01.200 You got it. Hash functions are like creating a digital 395 00:19:01.240 --> 00:19:04.960 fingerprint for your data. They generate this unique digest that 396 00:19:05.000 --> 00:19:07.640 represents the data, and if even a single bit of 397 00:19:07.680 --> 00:19:10.559 the data changes, the hash function will spit out a 398 00:19:10.599 --> 00:19:13.880 completely different digest, basically shouting, hey, something's wrong here. 399 00:19:13.960 --> 00:19:15.640 So it's like a tamper proof seal. 400 00:19:15.839 --> 00:19:18.400 Exactly, the seal is broken, you know something's up. 401 00:19:18.519 --> 00:19:21.680