06-1 Chapter 6 Information Security 6.1 Concept of Information Security.pptx

第1页：6.1 生词表

第2页：6.1 生词表（续）

第3页：6.1 生词表（续）

第4页：6.1 信息安全概念 课文要点

The issue of information security and data privacy is assuming tremendous importance among global organizations,particularly in an environment marked by computer viruses and terrorist attacks,hackings and destruction of vital data owing to natural disasters.[1]Whenitcomes to information security,most companies fall somewhere between two extreme boundaries:complete access and complete security.分析：本句是复合句。when it comes to sth/doing sth意为当涉及到（做）某事物的情况、事情和问题时，to在此作介词用，其后接名词或动名词;也可以用speaking of/ talking of sth/doing sth取代，意义与用法都相同。例如:When it comes to studying hard, Gary burns the midnight oil almostevery night.说到用功学习，加里几乎每晚都熬通宵。信息安全和数据保密的问题在全球的组织中非常重要，尤其在一个计算机病毒、恐怖分子、黑客攻击以及自然灾害造成重要数据破坏的环境。涉及到信息安全，很多公司会处于两种极端的边界：完全访问和完全安全。

第5页：6.1 信息安全概念 课文要点

A completely secure computer is one that is not connected to any network and physically unreachable by anyone. A computer like this is unusable and does not serve much of a practical purpose. Ontheotherh and,a computer with complete access is very easy to use,requiring no passwords or authorization to provide any information.[2]Unfortunately,having a computer with complete access is also not practical because it would expose every bit of information publicly,from customer records to financial documents. Obviously,there is a middleground—this is the art of information security.分析：本句是复合句。句中unfortunately为评注性状语。评注性状语不是修饰谓语或谓语动词,而是对整个句子进行说明或解释，表明说话人对话语的看法或态度，通常位于句首并用逗号与句子隔开。完全安全的计算机是不连接任何网络的，也不让任何人接触。像这样的计算机是不能用的，也没有多少实际用途。另一方面，完全访问的计算机容易使用，提供任何信息不需要密码和权限。遗憾的是，拥有完全访问的计算机也是不实际的，因为它会公开暴露每一点信息，从客户记录到财政文件。显然可以有一个中间区域——这就是信息安全的技术。

第6页：信息安全的概念集中于下面几部分

信息安全的概念集中于下面几部分：

完整性：收集和维护准确的信息并且避免恶意破坏。

可用性：随时随地根据需要提供对信息的访问。

机密性：避免向未授权或不必要的人泄漏信息。The concept of information security is centered on the following components:

Integrity: gathering and maintaining accurate information and avoiding malicious modification.

Availability: providing access to the information when and where desired.

Confidentiality: avoiding disclosure to unauthorized or unwanted persons.

第7页：6.1 信息安全概念 课文要点

语言点分析：本句是复合句。句中whereby为关系副词，引导定语从句，相当于by which，意为“靠那个，凭那个，借以”。For an information system to be secure,it must have a number of properties:service integrity.[3]This is a property of an information system whereby its availability,reliability,completeness and promptness are assured.安全的信息系统需要具有如下的特性：服务完整性。信息系统的这一特性保证信息系统具有有效性、可靠性、完整性和敏捷性。

第8页：信息系统的这一特性保证纪录可信

数据完整性。信息系统的这一特性保证纪录可信、可靠、完全、无改变、而且可用。对记录进行的操作可靠、适应调整要求、全面、系统，而且能阻止未授权者访问、破坏、改变或删除纪录。这些要求适用于可用计算机处理的数据库、文件以及档案，也适用于人工记录。data integrity. This is a property whereby records are authentic,reliable,complete,unaltered and useable,and the processes that operate on them are reliable,compliant with regulatory requirements,comprehensive,systematic,and prevent unauthorized access,destruction,alteration or removal of records. These requirements apply to machine-readable databases,filesandarchives,and to manual records.

第9页：信息系统的这一特性使得信息只对有授权的人

数据保密。信息系统的这一特性使得信息只对有授权的人可用。很多资料把安全仅作为数据传输中的问题讨论，但是在数据存储和使用环境中安全问题同样重要。鉴定。信息系统这一特性保证行为可以被检查。可鉴定的行为方式包括：数据鉴定，检查已得数据的真实性、精确性、时效性、完全性以及其他方面的性能。data secrecy. This is a property of an information system whereby information is available only to those people authorized to receive it. Many sources discuss secrecy as though it was only an issue during the transmission of data;but it is just as vital in the context of data storage and data use. authentication. Authentication is a property of an information system whereby assertions are checked. Forms of assertion that are subjected to authentication include:"data authentication",whereby captured data's authenticity,accuracy,timeliness,completeness and other quality aspects are checked.

第10页：身份鉴定

"identity authentication",whereby an entity's claim as to its identity is checked. This applies to all of the following:the identity of a person;the identity of an organizational entity;the identity of a software agent;and the identity of a device."attribute authentication",whereby an entity's claim to have a particular attribute is checked,typically by inspecting a"credential".Ofespecial relevance in advanced electronic communications is claim of being an authorized agent,i. e. an assertion by a person,a software agent or a device to represent an organization or a person.身份鉴定，鉴定实体宣称的身份。可应用于鉴定人员的身份、机构实体的身份、软件代理的身份和设备的身份。属性鉴定，鉴定一个实体声称自己具有的特定属性，通常通过检查“凭证”。先进的电子通信领域内最为相关的是授权代理的声明，也就是个人、软件代理商或设备代表某个机构或个人所做的声明。

第11页：信息系统这一特性使实体不能否认所执行过的

Non-repudiation. This is a property of an information system whereby an entity is unable to convincingly deny an action it has taken. There is a strong tendency in the information systems security literature to focus on the security of data communications. But security is important throughout the information life-cycle,i. e. during the collection,storage,processing,use and disclosure phases,as well as transmission. Each of the properties of a secure system identified above needs to be applied to all of the information life-cycle phases.不可否认性。信息系统这一特性使实体不能否认所执行过的行为。在信息系统安全的文献中有个很强的倾向就是关注数据通信中的安全。但是安全在整个信息处理周期中都是很重要的，也就是说，安全在信息的收集、存储、处理、使用和公布阶段，与在传输阶段同样重要。上述安全系统的特性需要应用于信息处理周期的各阶段。

第12页：习题6.1 一 判断正误

习题6.1 一 判断正误：根据课文内容判断下列说法正误。

Put“true”or“false”in the brackets for the following statements according to the passage.

1. ()Complete access and complete security are good for information security.
2. ()A completely secure computer is unusable and does not serve much of a practical purpose.
3. ()Having a computer with complete access is practical.
4. ()Integrity means gathering and maintaining accurate information and avoiding malicious modification.
5. ()Confidentiality means providing access to the information when and where desired.
6. ()Availability means avoiding disclosure to unauthorized or unwanted persons.
7. ()Datasecrecy is a property of an information system whereby information is available only to those people authorized to receive it.
8. ()Authentication is a property of an information system whereby assertions are checked.

第13页：习题6.1 二 练习

习题6.1 二 练习：根据课文内容完成下列练习。

Fillinthe blanks according to the passage.

1. A completely________computer is one that is not connected to any network and physically unreachable by anyone.
2. A computer with complete access is very________touse, requiring no________or authorization to provide any information.
3. The concept of information security is centered on the following components:________,________, and confidentiality.
4. Service integrity is a property of an information system whereby its________,________, completeness and promptness are assured.
5. Datasecrecy is a property of an information system whereby information is available only to those people________to receive it.
6. Forms of assertion that are subjected to authentication include: data________, identity authentication, and________authentication.
7. Non-repudiation is a property of an information system whereby an entity is unable to convincingly________an action it has taken.
8. There is a strong tendency in the information systems security literature to focus on the security of data communications.

第14页：习题6.1 三 翻译

习题6.1 三 翻译：将下列单词和短语译成中文。

Translate the following words and expressions into Chinese.

1. importance
2. environment
3. destruction
4. disaster
5. unreachable
6. unusable
7. maintain
8. process
9. database
10. communication