technical seminar on security
TRANSCRIPT
Security
Security Objectives
Secrecy
Prevent/detect/deter improperDisclosure of information
Availability
Prevent/detect/deter improperDenial of access to services
IntegrityPrevent/detect/deter Improper modificationof information
PolicyOrganizational policyOrganizational policy
Information systems policyInformation systems policy
Security Overview
Many fears to overcomeIntercepted e-mail messagesUnauthorized access to digital intelligenceCredit card information falling into the wrong
handsTwo types of computer security
Physical - protection of tangible objectsLogical - protection of non-physical objects
What is security?
Dictionary Definition: protection or defense against attack, interference, espionage, etc
System correctnessGood input Good output
SecurityBad input Bad output
Goals of Security
DATA
Integrity
DATA
Availability
DATA
Confidentiality
Aspects of Security
consider 3 aspects of information security:security attacksecurity mechanism (control)security service
note termsthreat – a potential for violation of securityvulnerability – a way by which loss can
happenattack – an assault on system security, a
deliberate attempt to evade security services
Computer Security Classification
SECURITY SERVICESSECURITY SERVICES
DATA
CONFIDENTIALITY
DATA
CONFIDENTIALITY
DATA
INTEGRITY
DATA
INTEGRITY
AUTHENTICATIONAUTHENTICATION
NONREPUDIATIONNONREPUDIATION
ACCESS CONTROLACCESS
CONTROL
Computer Security Classification
1. ENCIPHERMENT
2. DATA INTEGRITY
3. DIGITAL SIGNATURE
4. AUTHENTICATION
EXCHANGE
5. TRAFFIC PADDING
6. ROUTING CONTROL
7. NOTARIZATION
8. ACCESS CONTROL
1. ENCIPHERMENT
2. DATA INTEGRITY
3. DIGITAL SIGNATURE
4. AUTHENTICATION
EXCHANGE
5. TRAFFIC PADDING
6. ROUTING CONTROL
7. NOTARIZATION
8. ACCESS CONTROL
SECURITY MECHANISM
SECURITY MECHANISM
-To provide the services.- A method, tools or procedure for enforcing a security policy.
DATA CONFIDENTIALITY
DATA INTEGRITY
AUTHENTICATION
NONREPUDIATION
ACCESS CONTROL
1,3,4
2,3,7
1,2,3
8
1
SECURITY ATTACKS
PASSIVE ATTACKS
ACTIVE ATTACKS
Interception
Traffic Analysis
Interruption
Fabrication
Replay
Modification
Passive Attack - Interception
Passive Attack: Traffic Analysis
Observe traffic pattern
Active Attack: Interruption
Block delivery of message
Active Attack: Fabrication
Fabricate message
Active Attack: Replay
Active Attack: Modification
Modify message
Handling Attacks
Passive attacks – focus on PreventionEasy to stopHard to detect
Active attacks – focus on Detection and RecoveryHard to stopEasy to detect
System
AttackerAlice
General picture
Security is aboutHonest user (e.g., Alice, Bob, …)Dishonest AttackerHow the Attacker
Disrupts honest user’s use of the system (Integrity, Availability)Learns information intended for Alice only (Confidentiality)
Databases and
data security
It’s your data – are you sure it’s safe?
Network Attacker
Intercepts and controls network communication
Alice
System
Network security
Web Attacker
Sets up malicious site
visited by victim; no control of
networkAlice
System
Web security
OS Attacker
Controls malicious files
and applications
Alice
Operating system security
System
AttackerAlice
Confidentiality : Attacker does not learn Alice’s secrets
Integrity : Attacker does not undetectably corrupt system’s function for Alice
Availability : Attacker does not keep system from being useful to Alice
How Viruses and Worms Spread
25
Defending Against Viruses and Worms
Keys to protecting PCsDon’t open e-mails or IM attachments unless
they are expected and have been inspected by antivirus software
Keep up with software patches for your system
Use caution when exploring Web sitesAvoid software from untrusted sourcesStay away from file-sharing networks
WHY INTERNET IS DIFFERENT?
Paper-Based Commerce Electronic Commerce
Signed paper Documents Digital Signature
Person-to-person Electronic via Website
Physical Payment System Electronic Payment System
Merchant-customer Face-to-face Face-to-face Absence
Easy Detectability of modification Difficult Detectability
Easy Negotiability Special Security Protocol
Specific Elements of a Security PolicyAuthentication
Who is trying to access the site?Access Control
Who is allowed to logon and access the site?Secrecy
Who is permitted to view selected informationData integrity
Who is allowed to change data?Audit
What and who causes selected events to occur, and when?
Three components to security
Three perspectivesUser’s point of viewServer’s point of viewBoth parties
Three partsClient-side securityServer-side securityDocument confidentiality
Client-side securityMeasures to protect the user’s privacy
and the integrity of his computerExample technological solutions
Protection from computer viruses and other malicious software
Limit the amount of personal information that browser’s can transmit without the user’s consent
Any others?
Server-side security
Measures to protect the server and the machine it runs from break-ins, site vandalism, and denial-of-service attacks.
Solutions range installing firewall systemstightening operating systems security
measures
Document confidentiality
Measures to protect private information from being disclosed to third parties.
Example risks:
Solutions rangePassword to identify usersCryptography
Tools Available to Achieve Site Security
Encryption Transforms plain text or data into cipher
text that cannot be read by anyone outside of the sender and the receiver. Purpose: to secure stored information to secure information transmission.
Cipher text text that has been encrypted and thus cannot
be read by anyone besides the sender and the receiver
Symmetric Key Encryption DES standard most widely used
Encryption Public key cryptography
uses two mathematically related digital keys: a public key and a private key.
The private key is kept secret by the owner, and the public key is widely disseminated.
Both keys can be used to encrypt and decrypt a message.
A key used to encrypt a message, cannot be used to unencrypt the message
Public Key Cryptography - A Simple Case
Public Key Cryptography with Digital Signatures
Public Key Cryptography: Creating a Digital Envelope
Securing Channels of Communications
Secure Sockets Layer (SSL) is the most common form of securing channels
Secure negotiated sessionclient-server session where the requested
document URL, contents, forms, and cookies are encrypted.
Session key is a unique symmetric encryption key chosen for a single secure session
Securing Channels of Communications
Secure Hypertext Transfer Protocol (S-HTTP)secure message-oriented
communications protocol for use with HTTP.
Virtual Private Networks (VPN) remote users can securely access internal
networks via Point-to-Point Tunneling Protocol (PPTP)
Secure Negotiated Sessions Using SSL
Protecting Networks Firewalls
software applications that act as a filter between a private network and the Internet
Proxy serverserver that handles all communications
originating from or being sent to the Internet, acting as a spokesperson or bodyguard for the organization
Tension Between Security and Other Values
Ease of use Often security slows down processors and
adds significantly to data storage demands. Too much security can harm profitability; not enough can mean going out of business.
Public Safety & Criminal Use claims of individuals to act anonymously vs.
needs of public officials to maintain public safety in light of criminals or terrorists.
Why Care?
Online banking, trading, purchasing may be insecure Credit card and identity theft
Personal files could be corrupted All school work, music, videos, etc. may be lost
Computer may become too slow to run If you aren't part of the solution you are part of the problem
Pwn2Own contest - 2008 Mac (Leopard) fell first via Safari, Vista took time but was
hacked via Flash Player, Ubuntu stood ground.
Upon discovery, vulnerabilities can be used against many computers connected to the internet.
43