Information security

Information security

Information security is the intentional process of protecting stored information from unauthorized disclosure, alteration, or destruction. Proper information security procedures protect the following properties of information stores or sources:

• Availability: authorized users are able to access the information when they need it.
• Confidentiality: unauthorized users can not gain access to the information.
• Integrity: only an authorized user can modify or delete information.

Proper information security involves all of the following considerations:

• Environment controls: Physical protection of information stores from intruders, natural disasters, etc.
• Interface controls: Limiting access to the data stores to known, guarded pathways.
• Authentication controls: Identifying users attempting to gain access to information. There are three major methods.
  • Tokens: The user possesses a physical object that identifies him or her to the system.
  • Passwords: The user knows a secret word or phrase for identification.
  • Biometrics: The system recognizes a physical attribute of the user, such as a fingerprint.
• Authorization controls: Verifying that users have the appropriate permission to perform the actions they attempt.

Information security in Star Trek

Federation starships store virtually all information in a central computer system. This system relies primarily on voice-recognition (a biometric method) to authenticate users, although users may also set personal passwords to further control access to sensitive data or computer functions (a practice that became common after the events of TNG "Brothers", see below).

The Federation has repeatedly demonstrated unreliable information security protocols.

• In TNG "The Hunted", Roga Danar was able to bypass a security force field by disabling one of the ship's security personnel and using the guard's communicator (a security token) to order the computer to drop the force field. Roga Danar was also able to access consoles in the ship's engineering section to reroute power to transporters and to determine where to plant a bomb to disable the Enterprise's sensor network, even though he lacked legitimate user credentials.
• In both TNG "Contagion" and TNG "Masks", alien computers were able to upload code to the Enterprise's computer, which then executed the untrusted code.
• In TNG "Brothers", Commander Data was able to seize control of all of the Enterprise's command functions by mimicking the voice of Captain Picard. If he had wanted to, he could have destroyed the ship by triggering the self-destruct system (which required only voice commands from the captain and first officer, identified by voice recognition). Another Soong-type android or a Changeling impersonator could presumably accomplish the same thing.
• In TNG "Hero Worship", Data, Picard, and Troi tell Timothy it was impossible for him to cause the Vico's destruction when he slammed into a console, suggesting that some kind of authentication is required to operate a console. Presumably this is token recognition, since Roga Danar was able to operate consoles without biometric or password authentication, but he did have access to the engineering crew's communicators.
• In TNG "Conundrum", an alien Satarran was able to alter the content of the ship's database to mislead the crew into attacking the Lysians.
• Federation starships are known to allow remote access to their command functions via a prefix code that can be transmitted from other starships, and remote commands can actually override orders issued from the target starship's bridge. Why the Federation would include such a dangerous feature in their warships is unclear.
• In the Voyager episode, "Investigations", Neelix is able to unlock a crewmember's workstation with a voice command that he overheard the chief engineer using, bypassing the biometric authentication usually used for starship computer functions, as well as any passwords that may have been set.

Collectively, these failures indicate poor interface controls and inadequate authentication controls; the Federation's authorization controls have generally been successful. The failure of the Federation's authentication protocols is surprising, since they have the technology to simultaneously implement all three of the major authentication methods with ease, and such a combined approach would make their systems much more secure. The failures of Federation computer security are particularly egregious since virtually all Federation devices can be controlled wirelessly by a starship's main computer, meaning that a Federation ground force could be completely disarmed by a remote command.

Many of the Federation's neighbors have similarly shown incompetent security measures.

• In Star Trek: Nemesis, Data is able to try several different codes on a secured door on the Scimitar and it allows him to continue trying codes, no matter how many wrong ones he enters. On most real life security systems, Data would have been locked out of the system after the third wrong attempt.
• In TNG "Sins of the Fathers" Geordi breaks into the Klingon government security network in minutes.
• In TNG "Unification pt 2", Spock is able to perform a similar feat with the Romulan security network. Data is also able to piggy-back signals to the Enterprise on Romulan signals.

Information security in Star Wars

Officers in the Imperial armed forces all carry on their person one to four code cylinders (the more carried the higher the access level) that they seem to use to access systems from any work station on the network, indicating that Imperial information security is token-based. In many of the Star Wars computer games, these cylinders take on the function of keys, opening locked doors once they are acquired. They also have electronic combination locks that are used to secure high-level systems, vaults, and areas.

The access protocols for Republic and Imperial computers are not clear, but their primary weakness seems to be inadequate authorization controls for low priority systems.

• The astromech droid R2-D2 was granted access to the Death Star's computer network without legitimate credentials, but he was denied access to some information. For instance, he could remotely deactivate the station's garbage compactors, but he could not remotely cut the power to the station's tractor beams. He was able to determine where to disable them manually, but that may have been because he was already in possession of the Death Star's schematics.
• Similarly, R2-D2 was able to determine that Leia Organa was a prisoner on the station and where she was being held, but he could not locate an exit from her cell block other than the main entrance, and he admitted that much of the information he sought was restricted. In this case, the detention block may simply have not had an alternate entrance.

Taken together, these incidents indicate that Imperial networks have "guest" accounts that provide unnecessary access to some systems, and a proficient hacker can exploit these accounts. It also suggests that some confidential information is handled carelessly, indicating poor enforcement of security procedures. Some of that information, such as a prisoner register showing Leia arriving on board the Death Star, could have been logged by that control room, resulting in R2 doing further searches in order to locate her cell.

R2-D2's interface equipment resembles the end of the Imperial Code cylinders, hinting that his hacking process may involve mimicking the information on one of those devices, which he could have obtained by reading a cylinder from one of the dead officers in the hangar control room. It may not be his only way of gaining access, but it does help explain how he could get into some systems but not others. If access was tightened after the station was alerted, the level he'd already gained might be insufficient for further hacking. This would also explain why moving to a different access point didn't hamper his efforts.

It may be worth noting that R2-D2 has been allowed to operate for decades without a memory erasure. This may have allowed the droid to accumulate an exceptionally large store of cracking tools and techniques, something that his various owners (Padmé Amidala, Anakin Skywalker, Bail Organa, Leia Organa, and Luke Skywalker) have probably encouraged.

Furthermore, some of R2-D2's computer "hacks" may not be indications of poor security measures. Shutting down dangerous machinery, like garbage compactors and droid assembly lines, might have minimal authorization requirements by design, allowing any worker to shut down the system in the event of a safety issue. Also, it is fairly conclusive that Darth Vader wanted Leia to be rescued in order to learn the location of the rebel base. As such, some of the information R2 obtained from the Death Star computer may have been deliberately left unprotected for him to discover with relative ease.

The nature of Star Wars computer networks may also change the nature of computer "hacking". Like droids, central computers seem to be AI's, so obtaining access or information from them may be more like social engineering than actual "hacking". For example, the computer system of Cloud City, knowing that the city administrator Lando Calrissian was attempting to escape on the Millennium Falcon, volunteered information about the state of the ship's hyperdrive to R2-D2.

See also

• Brute force attack