CISC 210 - Class Today
•
•
•
•
Making security decisions
Introductions
Security perimeters
Assignment
Spring 2009
R. Smith - University of St Thomas - Minnesota
1
Making security decisions
• Do you always lock:
– A car door
– A room door
– A house door
• If not always, what decides
otherwise?
Spring 2009
R. Smith - University of St Thomas - Minnesota
2
Decision Making Strategies
• Rule based
– I’m told that’s what we do, and I follow that rule (Passwords)
• Relativistic
– My friend does it, so I do, too.
– My neighbor has a fence and locks his front door. Me, too.
– We all use super-strong Kryptonite bike locks
• “Security Theater”, hunter’s dilemma
• MAD - Deterrence
• Rational
– We look at the risks and choose security measures accordingly
– If an incident occurs, it should prove cheaper than the longterm cost of protecting against it
– Reassess risks as part of the “life cycle” of the asset
Spring 2009
R. Smith - University of St Thomas - Minnesota
3
Decision making in a life cycle
• Identify your practical goals
– What “real” things do you want to accomplish?
– What risks interfere with them?
• Choose the security that fits
– What weaknesses exist?
– What security measures might work?
– What are the trade-offs against goals?
• Measure success
– Monitor for attacks or other failures
– Recover from problems
– Reassess goals and trade-offs
Spring 2009
R. Smith - University of St Thomas - Minnesota
4
So what will the class look at?
• How to assess security in general
• Analyzing trade-offs (risk, cost, effectiveness)
• Specific security issues and techniques
–
–
–
–
–
–
Workstations
LANs
Distributed networks
Internet access
E-commerce
If time, DRM and ‘extreme security’
• Labs
– Some exist, scheduling may be tricky
Spring 2009
R. Smith - University of St Thomas - Minnesota
5
Who are you, who am I
• Ask your neighbor:
– Name, major
– Why are you taking this class?
– Do you “0wn” a computer?
• I.e. can you log in as admin?
– Give a personal, security related fact.
• Experience, skill, incident, etc.
Spring 2009
R. Smith - University of St Thomas - Minnesota
6
The Class On-Line
• Web home page
– courseweb.stthomas.edu/resmith links to it
– Course schedule with homework assignments
– Links to lecture notes
• Blackboard
– Link to course home page
– Grades
– Links to copyrighted material
• Draft book chapters
Spring 2009
R. Smith - University of St Thomas - Minnesota
7
The Syllabus
• Concepts we’ll cover
– “Practical” security planning and assessment
– Risk trade offs - the concept
– Role of security policies
• Environments - in order of breadth
–
–
–
–
–
–
–
Personal desktop/laptop
Access control on shared computer
Desktop encryption
Local network
Internet access from LAN
Distributed LANs
E-commerce
Spring 2009
R. Smith - University of St Thomas - Minnesota
8
Textbook(s)
• The main text is Internet Cryptography
– We don’t need it yet, probably not till March
– Buy a cheap copy
• The initial readings are draft chapters
–
–
–
–
I’m writing a security text book
3 chapters are all finished
3-5 more chapters may be used in this class
Draft Chapters are posted on Blackboard
• Print them, or read on-line, as you prefer
Spring 2009
R. Smith - University of St Thomas - Minnesota
9
Reading the Draft Chapters
• Usually starts with a ‘scenario’
– People involved in a security relevant activity
• “Body” of the chapter
– Concepts and techniques
– What to do - How to do it - How things are related
– Examples of things to do in exercises
• Process examples
– Follow a security situation through the 6-step process
– Sometimes computer-related, sometimes not
• Resources, Review and Exercises
– Study the review questions –source of quiz/exam questions
– Exercises – numbered with ‘E’ – typical homework
Spring 2009
R. Smith - University of St Thomas - Minnesota
10
Personal Computer Security
• Share a dorm room?
• Share an apartment?
• Share a home?
• “My” computer - a security objective
• “I’ll kill you if you touch it”
– a policy statement?
Spring 2009
R. Smith - University of St Thomas - Minnesota
11
Extreme Workstation Security
Does this achieve our goals?
Spring 2009
R. Smith - University of St Thomas - Minnesota
12
A real world example
•
•
•
•
•
•
There is a company
Thieves walk into their buildings every day
The front door is unlocked all day long
Valuable company property is just lying around
The thieves pick it up and carry it away
Most thieves, but not all, get away!
• WHAT IS THIS STUPID COMPANY?
• Why don’t they lock the door, at least?
Spring 2009
R. Smith - University of St Thomas - Minnesota
13
The Security Process
1. Identify your assets
•
What assets and capabilities do you require?
2. Analyze the risks of attack
•
•
What can happen to damage your assets?
What is the likelihood of damage?
3. Establish your security policy
•
•
Trade off of risks, cost of damage, cost of protection
Identify the protections you intend to use
4. Implement your defenses
5. Monitor your defenses
6. Recover from attacks
Spring 2009
R. Smith - University of St Thomas - Minnesota
14
The Process Itself
• Based on industrial models
– “System engineering” process
• We can apply it at a high level
– Examples sprinkled through the text: Bob, 9/11, Troy, etc.
• We also apply steps in detail
– Numerical risk assessments
– Policy planning
– Security implementation plans
Spring 2009
R. Smith - University of St Thomas - Minnesota
15
Security analysis: your PC
• The PC itself isn’t the asset
– Most often, we value what it does, not what it is
• Hardware is interchangeable
• Assets: resources, things that empower us
– Focus on what the assets empower us to achieve:
– Get homework done, socialize, manage finances, etc.
• Risks: things that interfere with assets
– What can interfere with our achievements?
– Assess likelihood and impact
• We identify risks by looking at threats and
vulnerabilities
Spring 2009
R. Smith - University of St Thomas - Minnesota
16
Threats & Vulnerabilities
Defense,
Safeguard, or
“Countermeasure”
Vulnerability
Threat
Asset
An attempt to steal or harm the asset is an attack
Spring 2009
R. Smith - University of St Thomas - Minnesota
17
Simple risk analysis: your PC
• Threats?
– Who, why?
• Vulnerabilities?
– What bad can happen?
– What allows the badness to happen?
• Can we just lock it up?
– Put it in a room
– Put a lock on the door.
– Don’t share the key
• Does this work?
Spring 2009
R. Smith - University of St Thomas - Minnesota
18
Deciding on Protection
• Policy: what protections we need
–
–
–
–
If possible, identify defensive perimeters
Identify other defenses to reduce impact of risks
Balance against how we use the asset
Balance against cost of protection
Spring 2009
R. Smith - University of St Thomas - Minnesota
19
Physically securing an area
• What is a secure perimeter?
–
–
–
–
Contiguous - no breaks
A barrier - actually blocks some attacks
Minimal number of openings
Access restrictions on the openings
• Example: my house
–
–
–
–
–
Wooden frame building - keeps out wild dogs
Glass windows with storms - ditto
Locked doors - ditto
Metal fence - ditto
Gates in the fence - ditto
Spring 2009
R. Smith - University of St Thomas - Minnesota
20
Security Analysis
• What are the threats?
– Wild dogs
– Burglars
– People collecting for nasty charities
• What are the defenses?
• Are there effective attacks on them?
– Effective = threats might use them
Spring 2009
R. Smith - University of St Thomas - Minnesota
21
Is this a complete list of threats?
• Of course not.
– Study history, the news, experience, introspection
– Generate a ‘better’ list
• A notion of “threats”
– Threat = anyone with strongly different goals
– Example: Burger King vs McDonald’s
• Both “sort of” have the same goal: sell burgers
• In fact, BK wants to sell BK burgers, while Mac
wants to sell Mac burgers
• BK people are not trusted in McDonald’s places
Spring 2009
R. Smith - University of St Thomas - Minnesota
22
Potential vs Real Threats
• Potential Threat = strongly different goals
– Not a member of the family, company, community
– Member of competing entity
– But not necessarily motivated to do you harm
• Real Threat = history of attacks
– “Good” neighborhood = neighbors not a threat
– “Bad” neighborhood = neighbors have caused
trouble in the past
Spring 2009
R. Smith - University of St Thomas - Minnesota
23
Now, the Defenses
• Physical world
–
–
–
–
Physical barriers, slows them down a lot
Locks - slow them down, restricts access
Alarms - calls for help
Warnings - shows you care
• Computer world
– Examples?
Spring 2009
R. Smith - University of St Thomas - Minnesota
24
What defenses are “effective”?
• Concept of “work factor”
– How hard does the attacker have to work to overcome the
defense?
– May be computed in hours
– May be computed in likelihood over time
• Example: average of 3 days, $.25M to crack DES
• Effective =
– Work Factor > threat’s motivation or skill
– My Home Example
• Wild dogs motivated but not resourceful
• Charity people resourceful but not motivated
• Burglars may be both, but hopefully not too much so
– Or, deterred by the alarm, and the large dog
Spring 2009
R. Smith - University of St Thomas - Minnesota
25
How does this relate to
computers?
• Defenses are always a trade off
• The same reasoning applies to both
• All security begins with physical security
Spring 2009
R. Smith - University of St Thomas - Minnesota
26
Evolution of
Attacks and Defenses
Attacks
??
Network Sniffing
Defenses
One-Time Passwords
Password Tokens
Password Sharing
Memory Protection
Keystroke Sniffing
Guess Detection
Guessing
Steal the Password File
Masquerade
Password Hashing
Passwords
Remote Terminals
Example: Passwords on Computers
Spring 2009
R. Smith - University of St Thomas - Minnesota
27
The homework assignment
• First, Read Draft Chapter 1
– Posted on Blackboard
• Second, do Exercise E5 at the end of the
chapter: analyze the perimeter of some
commercial or other business location.
Spring 2009
R. Smith - University of St Thomas - Minnesota
28
Creative Commons License
This work is licensed under the Creative
Commons Attribution-Share Alike 3.0 United
States License. To view a copy of this license,
visit http://creativecommons.org/licenses/bysa/3.0/us/ or send a letter to Creative
Commons, 171 Second Street, Suite 300, San
Francisco, California, 94105, USA.
Spring 2009
R. Smith - University of St Thomas - Minnesota
29