Introduction to Major Modules in
Cyber Security
August 31, 2011
Lecture #3
Dr. Bhavani Thuraisingham
3/22/2016 06:48
13-2
Outline
0 What is Cyber Security?
0 What is C. I. A.?
0 Ten Major Modules of Cyber Security
3/22/2016 06:48
13-3
Cyber Security
0 Security traditionally has been about CIA (Confidentiality, Integrity,
Availability)
0 Security now also includes areas like Trustworthiness, Quality,
Privacy
0 Dependability includes Security, Reliability and Fault Tolerance
0 Initially the term used was Computer Security (Compusec); it then
evolved into Infosec – Information security – to include data and
networks – now with web its called Cyber Security
3/22/2016 06:48
13-4
C. I.A.
0 Confidentiality: Preventing from unauthorized disclosure
0 Integrity: Preventing from unauthorized modification
0 Availability: Preventing denial of service
3/22/2016 06:48
13-5
Ten Major Modules of Cyber Security
0 Information Security and Risk Management
0 Access Control
0 Security Architecture and Design
0 Cryptography
0 Network Security
0 Applications Security (aka Data and Applications Security)
0 Legal Regulations, Compliance and Investigations (aka Digital
Forensics)
0 Physical and Environmental Security
0 Business Continuity Planning
0 Operations Security
0 Not included: Hardware security; Performance Analysis, Ethical
Hacking and Penetration Testing, - - -
3/22/2016 06:48
13-6
Information Security and Risk Management
0 Security Management
0 Security Administration
0 Organizational Security Model
0 Information Risk Management
0 Risk Analysis
0 Policies, Standards, Guidelines, Procedures
0 Information Classification
0 Layers of Responsibility
0 Security Awareness Training
3/22/2016 06:48
13-7
Access Control
0 Security Principles
0 Identification, Authentication, Authorization, Accountability
0 Access Control Models
0 Access Control techniques
0 Access Control Administration
0 Access Control Methods
0 Access Control Types
0 Accountability
0 Access Control practices
0 Access Control Monitoring
0 Threats to Access Control
3/22/2016 06:48
13-8
Security Architecture and Design
0 Computer Architecture
0 Systems Architecture
0 Security Models
0 Security Modes of Operation
0 Systems Evaluation Methods
0 Open vs. Closed Systems
0 Enterprise Architecture
0 Security Threats
3/22/2016 06:48
13-9
Physical and Environmental Security
0 What is Physical Security
0 Planning Process
0 Protecting assets
0 Internal Support Systems
0 Perimeter Security
0 Other aspects
3/22/2016 06:48
13-10
Telecommunications and Network Security
0 Open Systems Interconnection Reference Model
0 TCP/IP
0 Types of Transmission
0 LAN Networking
0 Routing Protocols
0 Networking Devices
0 Networking services and protocols
0 Intranets and Extranets
0 Metropolitan Area networks
0 Remote access
0 Wireless technologies
0 Rootkits
3/22/2016 06:48
13-11
Cryptography
0 History, Definitions and Concepts
0 Types of Ciphers
0 Methods of Encryption
0 Type of Asymmetric Systems
0 Message Integrity
0 PKI
0 Key Management
0 Link / End-to-end Encryption
0 Email standards
0 Internet security
0 Attacks
3/22/2016 06:48
13-12
Legal Regulation and Compliance Investigation
0 Cyber law and Cyber crime
0 Intellectual property law
0 Privacy
0 Liability and Ramifications
0 Digital Forensics and Investigations
0 Ethics
3/22/2016 06:48
13-13
Applications Security
0 Database Security
0 Software and applications security issues
0 Secure systems development
0 Application development and security
0 Object-oriented systems and security
0 Distributed computing and security
0 Expert systems and security
0 Web security
0 Mobile code
0 Patch management
3/22/2016 06:48
13-14
Operations Security
0 Role of the Operations Department
0 Administrative Management
0 Assurance Levels
0 Configuration management
0 Media Controls
0 Data Leakage
0 Network and Resource Availability
0 Mainframes
0 Email Security
0 Vulnerability testing
3/22/2016 06:48
13-15
Information Governance and Risk Management
0 Security Management, Administration and Governance
0 Policies, Standards, Guidelines, Procedures
0 Information Classification
0 Roles and Responsibilities
0 Risk Management and Analysis
0 Best Practices
3/22/2016 06:48
13-16
Security Management, Administration and
Governance
0 Information security (ISec) describes activities that relate to the
protection of information and information infrastructure assets
against the risks of loss, misuse, disclosure or damage. Information
security management (ISM) describes controls that an organization
needs to implement to ensure that it is sensibly managing these
risks.
0 The risks to these assets can be calculated by analysis of the
following issues:
0 Threats to your assets. These are unwanted events that could cause
the deliberate or accidental loss, damage or misuse of the assets
0 Vulnerabilities. How susceptible your assets are to attack
0 Impact. The magnitude of the potential loss or the seriousness of the
event.
3/22/2016 06:48
13-17
Security Management, Administration and
Governance
0 Standards that are available to assist organizations implement the
appropriate programs and controls to mitigate these risks are for
example BS7799/ISO 17799, Information Technology Infrastructure
Library and COBIT.
0 Information Security Governance, Information Security Governance
or ISG, is a subset discipline of Corporate Governance focused on
information Security systems and their performance and risk
management.
0 Establish and maintain a framework to provide assurance that
information security strategies are aligned with business objectives
and consistent with applicable laws and regulations
3/22/2016 06:48
13-18
Security Management, Administration and
Governance
0 Develop the information security strategy in support of business
strategy and direction.
0 Obtain senior management commitment and support
0 Ensure that definitions of roles and responsibilities throughout the
enterprise include information security governance activities.
0 Establish reporting and communication channels that support
information security governance activities.
0 Identify current and potential legal and regulatory issues affecting
information security and assess their impact on the enterprise.
0 Establish and maintain information security policies that support
business goals and objectives.
0 Ensure the development of procedures and guidelines that support
information security policies.
0 Develop business case for information security program
investments.
3/22/2016 06:48
13-19
Policies, Standards, Guidelines and Procedures
0 Policies are the top tier of formalized security documents. These
high-level documents offer a general statement about the
organization’s assets and what level of protection they should have.
0 Well-written policies should spell out who’s responsible for security,
what needs to be protected, and what is an acceptable level of risk..
0 Standards are much more specific than policies. Standards are
tactical documents because they lay out specific steps or processes
required to meet a certain requirement. As an example, a standard
might set a mandatory requirement that all email communication be
encrypted. So although it does specify a certain standard, it doesn’t
spell out how it is to be done. That is left for the procedure.
3/22/2016 06:48
13-20
Policies, Standards, Guidelines and Procedures
0 A baseline is a minimum level of security that a system, network, or
device must adhere to. Baselines are usually mapped to industry
standards. As an example, an organization might specify that all
computer systems comply with a minimum Trusted Computer
System Evaluation Criteria (TCSEC) C2 standard.
0 A guideline points to a statement in a policy or procedure by which
to determine a course of action. It’s a recommendation or
suggestion of how things should be done. It is meant to be flexible
so it can be customized for individual situations.
0 A procedure is the most specific of security documents. A procedure
is a detailed, in-depth, step-by-step document that details exactly
what is to be done.
0 A security model is a scheme for specifying and enforcing security
policies. Examples include: Bell and LaPadula, Biba, Access control
lists
3/22/2016 06:48
13-21
Information Classification
0 It is essential to classify information according to its actual value
and level of sensitivity in order to deploy the appropriate level of
security.
0
A system of classification should ideally be:
- simple to understand and to administer
- effective in order to determine the level of protection the
information is given.
- applied uniformly throughout the whole organization (note:
when in any doubt, the higher, more secure classification should
be employed).
3/22/2016 06:48
13-22
Information Classification
0 With the exception of information that is already in the public
domain, information should not be divulged to anyone who is not
authorized to access it or is not specifically authorized by the
information owner.
0 Violations of the Information Classification Policy should result in
disciplinary proceedings against the individual.
0 Number of information classification levels in an organization should
be a manageable number as having too many makes maintenance
and compliance difficult.
3/22/2016 06:48
13-23
Information Classification
0 Top Secret: Highly sensitive internal documents and data. For
example, impending mergers or acquisitions, investment strategies,
plans or designs that could seriously damage the organization if lost
or made public. Information classified as Top Secret has very
restricted distribution indeed, and must be protected at all times.
Security at this level is the highest possible.
0 Highly Confidential: Information which is considered critical to the
organization’s ongoing operations and could seriously impede or
disrupt them if made shared internally or made public. Such
information includes accounting information, business plans,
sensitive information of customers of banks (etc), patients' medical
records, and similar highly sensitive data. Such information should
not be copied or removed from the organization’s operational
control without specific authority. Security should be very high.
3/22/2016 06:48
13-24
Information Classification
0 Proprietary: Procedures, project plans, operational work routines,
designs and specifications that define the way in which the
organization operates. Such information is usually for proprietary
use by authorized personnel only. Security at this level is high.
0 Internal Use Only: Information not approved for general circulation
outside the organization, where its disclosure would inconvenience
the organization or management, but is unlikely to result in financial
loss or serious damage to credibility/reputation. Examples include:
internal memos, internal project reports, minutes of meetings.
Security at this level is controlled but normal.
0 Public Documents: Information in the public domain: press
statements, annual reports, etc. which have been approved for
public use or distribution. Security at this level is minimal.
3/22/2016 06:48
13-25
Roles and Responsibilities
0 Internal Roles
- Executive Management; Information System Security
Professionals; Owners: Data and System Owners; Custodians
- Operational Staff; Users; Legal, Compliance and Privacy
Officers; Internal Auditors; Physical Security Officers
0 External Roles
- Vendors and Supplies; Contractors; Temporary Employees;
Customers; Business Partners; Outsourced Relationships;
Outsourced Security
0 Human Resources
- Employee development and management; Hiring and
termination; Signed employee agreements; Education
3/22/2016 06:48
13-26
Risk Management and Analysis
0 Risk is the likelihood that something bad will happen that causes
harm to an informational asset (or the loss of the asset). A
vulnerability is a weakness that could be used to endanger or cause
harm to an informational asset. A threat is anything (man made or
act of nature) that has the potential to cause harm.
0 The likelihood that a threat will use a vulnerability to cause harm
creates a risk. When a threat does use a vulnerability to inflict harm,
it has an impact. In the context of information security, the impact is
a loss of availability, integrity, and confidentiality, and possibly other
losses (lost income, loss of life, loss of real property). It should be
pointed out that it is not possible to identify all risks, nor is it
possible to eliminate all risk. The remaining risk is called residual
risk.
3/22/2016 06:48
13-27
Risk Managementg and Analysis
0 A risk assessment is carried out by a team of people who have
knowledge of specific areas of the business. Membership of the
team may vary over time as different parts of the business are
assessed.
0 The assessment may use a subjective qualitative analysis based on
informed opinion (scenarios), or where reliable dollar figures and
historical information is available, the analysis may use quantitative
analysis
0 For any given risk, Executive Management can choose to accept the
risk based upon the relative low value of the asset, the relative low
frequency of occurrence, and the relative low impact on the
business. Or, leadership may choose to mitigate the risk by
selecting and implementing appropriate control measures to reduce
the risk. In some cases, the risk can be transferred to another
business by buying insurance or out-sourcing to another business.
3/22/2016 06:48
13-28
Risk Management and Analysis
0 Identification of assets and estimating their value. Include: people,
buildings, hardware, software, data supplies.
0 Conduct a threat assessment. Include: Acts of nature, accidents,
malicious acts originating from inside or outside the organization.
0 Conduct a vulnerability assessment, and for each vulnerability,
calculate the probability that it will be exploited. Evaluate policies,
procedures, standards, training, physical security, - - 0 Calculate the impact that each threat would have on each asset. Use
qualitative analysis or quantitative analysis.
0 Identify, select and implement appropriate controls. Provide a
proportional response. Consider productivity, cost effectiveness,
and value of the asset.
0 Evaluate the effectiveness of the control measures. Ensure the
controls provide the required cost effective protection without
discernible loss of productivity.
3/22/2016 06:48
13-29
Risk Management and Analysis
0 Step 1: Estimate Potential Loss
- SLE = AV ($) x EF (%)
- SLE: Single Loss Expectancy, AV: Asset Value. EF: Exposure
Factor (percentage of asset value)
0 Step 2: Conduct Threat Likelihood Analysis
- ARO Annual Rate of Occurrence
- Number of times per year that an incident is likely to occur
0 Step 3: Calculate ALE
- ALE: Annual Loss Expectancy
- ALE = SLE x ARO
3/22/2016 06:48
13-30
Security Best Practices
0 Job Rotation
0 Separation of Duty
0 Security Awareness training
0 Ethics Education
3/22/2016 06:48
13-31
Security Architecture and Design
0 Computer Architecture
0 Operating System
0 System Architecture
0 Security Architecture
0 Security Models
0 Security Models of Operation
0 System Evaluation Methods
0 Open Vs Closed Systems
0 Some security threats
3/22/2016 06:48
13-32
Computer Architecture Components
0 Central Processing Unit (CPU)
0 Registers
0 Memory Units
0 Input/output Processors
0 Single Processor
0 Multi-Processor
0 Multi-Core Architecture
0 Grids and Clouds
3/22/2016 06:48
13-33
Operating Systems
0 Memory Management
0 Process management
0 File Management
0 Capability Domains
0 Virtual Machines
3/22/2016 06:48
13-34
System Architecture
0 The software components that make up the system
0 Middleware
0 Database management
0 Networks
0 Applications
3/22/2016 06:48
13-35
Security Architecture
0 Security critical components of the system
0 Trusted Computing Base
0 Reference Monitor and Security Kernel
0 Security Perimeter
0 Security Policy
0 Least Privilege
3/22/2016 06:48
13-36
Trusted Computing Base
0 The trusted computing base (TCB) of a computer system is the set of
all hardware, firmware, and/or software components that are critical
to its security, in the sense that bugs or vulnerabilities occurring
inside the TCB might jeopardize the security properties of the entire
system. By contrast, parts of a computer system outside the TCB
must not be able to misbehave in a way that would leak any more
privileges than are granted to them in accordance to the security
policy.
0 The careful design and implementation of a system's trusted
computing base is paramount to its overall security. Modern
operating systems strive to reduce the size of the TCB so that an
exhaustive examination of its code base (by means of manual or
computer-assisted software audit or program verification) becomes
feasible.
3/22/2016 06:48
13-37
Reference Monitor and Security Kernel
0 In operating systems architecture, a reference monitor is a
tamperproof, always-invoked, and small-enough-to-be-fully-testedand-analyzed module that controls all software access to data
objects or devices (verifiable).
0 The reference monitor verifies that the request is allowed by the
access control policy.
0 For example, Windows 3.x and 9x operating systems were not built
with a reference monitor, whereas the Windows NT line, which also
includes Windows 2000 and Windows XP, was designed to contain a
reference monitor, although it is not clear that its properties
(tamperproof, etc.) have ever been independently verified, or what
level of computer security it was intended to provide.
3/22/2016 06:48
13-38
Security Models
0 Bell and LaPadula (BLP) Confidentiality Model
0 Biba Integrity Model (opposite to BLP)
0 Clark Wilson Integrity Model
0 Other Models
- information Flow Model
- Non Interference Model
- Graham Denning Model
- Harrison-Ruzzo-Ullman Model
- Lattice Model
3/22/2016 06:48
13-39
Bell and LaPadula
0 The Simple Security Property - a subject at a given security level
may not read an object at a higher security level (no read-up).
0 The *-property (read "star"-property) - a subject at a given security
level must not write to any object at a lower security level (no writedown). The *-property is also known as the Confinement property.
0 The Discretionary Security Property - use of an access matrix to
specify the discretionary access control.
3/22/2016 06:48
13-40
Secure System Evaluation: TCSEC
0 Trusted Computer System Evaluation Criteria (TCSEC) is a United
States Government Department of Defense (DoD) standard that sets
basic requirements for assessing the effectiveness of computer
security controls built into a computer system. The TCSEC was used
to evaluate, classify and select computer systems being considered
for the processing, storage and retrieval of sensitive or classified
information.
0 The TCSEC, frequently referred to as the Orange Book, is the
centerpiece of the DoD Rainbow Series publications. Initially issued
in 1983 by the National Computer Security Center (NCSC), an arm of
the National Security Agency, and then updated in 1985,.
0
TCSEC was replaced by the Common Criteria international standard
originally published in 2005.
3/22/2016 06:48
13-41
Certification and Accreditation
0 Certification and Accreditation (C&A) is a process for implementing
information security. It is a systematic procedure for evaluating,
describing, testing and authorizing systems prior to or after a
system is in operation.
0 Certification is a comprehensive assessment of the management,
operational, and technical security controls in an information
system, made in support of security accreditation, to determine the
extent to which the controls are implemented correctly, operating as
intended, and producing the desired outcome with respect to
meeting the security requirements for the system.
0 Accreditation is the official management decision given by a senior
agency official to authorize operation of an information system and
to explicitly accept the risk to agency operations (including mission,
functions, image, or reputation), agency assets, or individuals,
based on the implementation of an agreed-upon set of security
controls.
3/22/2016 06:48
13-42
Some Security Threats
0 Buffer Overflow
0 Maintenance Hooks
0 Time of check / Time of use attacks
3/22/2016 06:48
13-43
Access Control
0 Access Control Overview
0 Identification, Authentication, Authorization, Accountability
0 Single Sign-on and Kerberos
0 Access Control Models
0 Access Control Techniques and Technologies
0 Access Control Administration
0 Access Control Monitoring: Intrusion Detection
0 Threats to Access Control
3/22/2016 06:48
13-44
Access Control Overview
0 Access control is a system which enables an authority to control
access to areas and resources in a given physical facility or
computer-based information system.
0 In computer security, access control includes authentication,
authorization and audit. It also includes measures such as physical
devices, including biometric scans and metal locks, hidden paths,
digital signatures, encryption, social barriers, and monitoring by
humans and automated systems.
0 In any access control model, the entities that can perform actions in
the system are called subjects, and the entities representing
resources to which access may need to be controlled are called
objects (see also Access Control Matrix). Subjects and objects
should both be considered as software entities and as human users
3/22/2016 06:48
13-45
Access Control
0 Access control models used by current systems tend to fall into one
of two classes: those based on capabilities and those based on
access control lists (ACLs).
0 In a capability-based model, holding an unforgeable reference or
capability to an object provides access to the object
0 Access is conveyed to another party by transmitting such a
capability over a secure channel.
0
In an ACL-based model, a subject's access to an object depends on
whether its identity is on a list associated with the object
3/22/2016 06:48
13-46
Identification, Authentication, Authorization
0 Access control systems provide the essential services of
identification and authentication (I&A), authorization, and
accountability where:
0 identification and authentication determine who can log on to a
system, and the association of users with the software subjects that
they are able to control as a result of logging in;
0 authorization determines what a subject can do;
0 accountability identifies what a subject (or all subjects associated
with a user) did.
3/22/2016 06:48
13-47
Identification, Authentication, Authorization
0 Authenticators are commonly based on at least one of the following
four factors:
0 Something you know, such as a password or a personal
identification number (PIN). This assumes that only the owner of the
account knows the password or PIN needed to access the account.
0 Something you have, such as a smart card or security token. This
assumes that only the owner of the account has the necessary smart
card or token needed to unlock the account.
0 Something you are, such as fingerprint, voice, retina, or iris
characteristics.
0 Where you are, for example inside or outside a company firewall, or
proximity of login location to a personal GPS device.
3/22/2016 06:48
13-48
Identification, Authentication, Authorization
0 Authorization: Authorization applies to subjects. Authorization
determines what a subject can do on the system.
0 Most modern operating systems define sets of permissions that are
variations or extensions of three basic types of access:
0 Read (R): The subject can
- Read file contents, List directory contents
0 Write (W): The subject can change the contents of a file or directory
with the following tasks:
- Add, Create, Delete, Rename
0 Execute (X): If the file is a program, the subject can cause the
program to be run. (In Unix systems, the 'execute' permission
doubles as a 'traverse directory' permission when granted for a
directory.)
3/22/2016 06:48
13-49
Single Sign-On
0 Single sign-on (SSO) is a property of access control of multiple,
related, but independent software systems. With this property a user
logs in once and gains access to all systems without being
prompted to log in again at each of them. Single sign-off is the
reverse property whereby a single action of signing out terminates
access to multiple software systems.
0 As different applications and resources support different
authentication mechanisms, single sign-on has to internally
translate to and store different credentials compared to what is used
for initial authentication.
3/22/2016 06:48
13-50
Single Sign-on Kerberos
0 Kerberos is a computer network authentication protocol, which
allows nodes communicating over a non-secure network to prove
their identity to one another in a secure manner. It is also a suite of
free software published by MIT that implements this protocol. Its
designers aimed primarily at a client–server model, and it provides
mutual authentication — both the user and the server verify each
other's identity. Kerberos protocol messages are protected against
eavesdropping and replay attacks.
0 Kerberos builds on symmetric key cryptography and requires a
trusted third party, and optionally may use public-key cryptography
by utilizing asymmetric key cryptography during certain phases of
authentication
3/22/2016 06:48
13-51
Kerberos
0 Kerberos uses as its basis the symmetric Needham-Schroeder
protocol. It makes use of a trusted third party, termed a key
distribution center (KDC), which consists of two logically separate
parts: an Authentication Server (AS) and a Ticket Granting Server
(TGS). Kerberos works on the basis of "tickets" which serve to prove
the identity of users.
0 The KDC maintains a database of secret keys; each entity on the
network — whether a client or a server — shares a secret key known
only to itself and to the KDC. Knowledge of this key serves to prove
an entity's identity. For communication between two entities, the
KDC generates a session key which they can use to secure their
interactions.
0 The security of the protocol relies heavily on participants
maintaining loosely synchronized time and on short-lived assertions
of authenticity called Kerberos tickets.
3/22/2016 06:48
13-52
Kerberos
0 The client authenticates itself to the Authentication Server and
receives a ticket. (All tickets are time-stamped.)
0 It then contacts the Ticket Granting Server, and using the ticket it
demonstrates its identity and asks for a service.
0
If the client is eligible for the service, then the Ticket Granting
Server sends another ticket to the client.
0 The client then contacts the Service Server, and using this ticket it
proves that it has been approved to receive the service.
3/22/2016 06:48
13-53
Kerberos: Drawbacks
0 Single point of failure: It requires continuous availability of a central server.
When the Kerberos server is down, no one can log in. This can be mitigated
by using multiple Kerberos servers and fallback authentication mechanisms.
0 Kerberos requires the clocks of the involved hosts to be synchronized. The
tickets have a time availability period and if the host clock is not
synchronized with the Kerberos server clock, the authentication will fail. The
default configuration requires that clock times are no more than five minutes
apart. In practice Network Time Protocol daemons are usually used to keep
the host clocks synchronized.
0 The administration protocol is not standardized and differs between server
implementations.
0 Since all authentication is controlled by a centralized KDC, compromise of
this authentication infrastructure will allow an attacker to impersonate any
user.
3/22/2016 06:48
13-54
Access Control Techniques
0 Role based access control
0 Constrained user interfaces
0 Access control Matrix
0 Content dependent access control
0 Content dependent access control
3/22/2016 06:48
13-55
False Match Rate
0 System gives a false positive by matching a user’s biometric
with another user’s enrollment
- Problem as an imposter can enter the system
0 Occurs when two people have high degree of similarity
- Facial features, shape of face etc.
- Template match gives a score that is higher than the
threshold
- If threshold is increased then false match rate is reduced,
but False no match rate is increased
0 False match rate may be used to eliminate the non-matches
and then do further matching
3/22/2016 06:48
13-56
Intrusion Detection System
0 For the purpose of dealing with IT, there are two main types of IDS's:
network-based and host-based IDS.
0 In a network-based intrusion-detection system (NIDS), the sensors
are located at choke points in the network to be monitored, often in
the demilitarized zone (DMZ) or at network borders. The sensor
captures all network traffic and analyzes the content of individual
packets for malicious traffic.
0 In a host-based system, the sensor usually consists of a software
agent, which monitors all activity of the host on which it is installed,
including file system, logs and the kernel. Some application-based
IDS are also part of this category.
3/22/2016 06:48
13-57
Threats to Access Control
0 Dictionary Attack
0 Brute Force Attack
0 Spoofing at Logon
0 Phishing
0 Identity Theft
3/22/2016 06:48
13-58
Crypography
0 Definition of Cryptography
0 Important concepts
- Symmetric and Asymmetric, Hash, Digital Signature etc.
0 Steganography and Digital watermarking
0 Algorithms
0 Attacks
3/22/2016 06:48
13-59
Definitions
0 Cryptography
- Mathematical manipulation of information that prevents the
information being disclosed or altered
0 Cryptanalysis
- Defeating the protected mechanisms of cryptography
0 Cryptology
- Study of Cryptography and Cryptanalysis
3/22/2016 06:48
13-60
Goals of Cryptography
0 Confidentiality
0 Integrity
0 Authenticity
0 Non-repudiation
0 Access Control
0 Make compromise difficult
3/22/2016 06:48
13-61
Process
0 Input (also called Plaintext or Clear Text)
0 Cryptosystem (device that performs encryption/decryption)
0 Cryptographic Algorithms (Mathematical functions)
0 Output (Cipher text or Cryptogram)
0 Key (Crypto variable)
3/22/2016 06:48
13-62
Key Clustering
0 In cryptography, key clustering is said to occur when two different
keys generate the same ciphertextfrom the same plaintext, using the
same cipher algorithm. A good cipher algorithm, using different keys
on the same plaintext, should generate a different ciphertext,
irrespective of the key length.
0 If an 'attacker' tries to break a cipher by brute-force (trying all
possible keys until it finds the correct key) then key clustering will
result in an easier attack on a particular cipher text. If there are N
possible keys with out any key clustering then the attacker will on
average need to try N/2 keys to decrypt it and a worst case of trying
all N keys. If there are two keys that are clustered then the average
number of keys to try is reduced to N/4 (worst case is N-1 keys). If
three keys cluster than average attempt is only N/6 attempts.
3/22/2016 06:48
13-63
Symmetric Key Cryptography
0 Symmetric-key algorithms are a class of algorithms for cryptography
that use trivially related, often identical, cryptographic keys for both
decryption and encryption.
0 The encryption key is trivially related to the decryption key, in that
they may be identical or there is a simple transformation to go
between the two keys. The keys, in practice, represent a shared
secret between two or more parties that can be used to maintain a
private information link.
0 The disadvantage of symmetric cryptography is that it presumes two
parties have agreed on a key and been able to exchange that key in a
secure manner prior to communication. This is a significant
challenge. Symmetric algorithms are usually mixed with public key
algorithms to obtain a blend of security and speed.
3/22/2016 06:48
13-64
Public Key Cryptography
0 Public-key cryptography is a cryptographic approach which involves
the use of asymmetric key algorithms instead of or in addition to
symmetric key algorithms.
0 Unlike symmetric key algorithms, it does not require a secure initial
exchange of one or more secret keys to both sender and receiver.
0 The asymmetric key algorithms are used to create a mathematically
related key pair: a secret private key and a published public key. Use
of these keys allows protection of the authenticity of a message by
creating a digital signature of a message using the private key,
which can be verified using the public key.
0 It also allows protection of the confidentiality and integrity of a
message, by public key encryption, encrypting the message using
the public key, which can only be decrypted using the private key.
3/22/2016 06:48
13-65
Steganography
0 Steganography is the art and science of writing hidden messages in
such a way that no one, apart from the sender and intended
recipient, suspects the existence of the message, a form of security
through obscurity.
0 Generally, messages will appear to be something else: images,
articles, shopping lists, or some other covertext and, classically, the
hidden message may be in invisible ink between the visible lines of a
private letter.
0 The advantage of steganography, over cryptography alone, is that
messages do not attract attention to themselves.
0 Cryptography protects the contents of a message, steganography
can be said to protect both messages and communicating parties.
3/22/2016 06:48
13-66
Steganography
0 Steganography includes the concealment of information within
computer files.
0 In digital steganography, electronic communications may include
steganographic coding inside of a transport layer, such as a
document file, image file, program or protocol.
0 Media files are ideal for steganographic transmission because of
their large size.
0 As a simple example, a sender might start with an innocuous image
file and adjust the color of every 100th pixel to correspond to a letter
in the alphabet, a change so subtle that someone not specifically
looking for it is unlikely to notice it.
3/22/2016 06:48
13-67
What is Network Security
0 Network security consists of the provisions made in an underlying
computer network infrastructure, policies adopted by the network
administrator to protect the network and the network-accessible
resources from unauthorized access, and consistent and continuous
monitoring and measurement of its effectiveness
0 Network security starts from authenticating the user, commonly with
a username and a password.
0 Once authenticated, a firewall enforces access policies such as what
services are allowed to be accessed by the network users.[
0 Though effective to prevent unauthorized access, this component
may fail to check potentially harmful content such as computer
worms or Trojans being transmitted over the network.
3/22/2016 06:48
13-68
What is Network Security
0 Communication between two hosts using a network could be
encrypted to maintain privacy.
0 Honeypots essentially decoy network-accessible resources, could
be deployed in a network as surveillance and early-warning tools.
Techniques used by the attackers that attempt to compromise these
decoy resources are studied during and after an attack to keep an
eye on new exploitation techniques. Such analysis could be used to
further tighten security of the actual network being protected by the
honeypot.
0 A Botnet is a collection of software agents, or robots, that run
autonomously and automatically. The term is most commonly
associated with malicious software, but it can also refer to a network
of computers using distributed computing software.
3/22/2016 06:48
13-69
Network Forensic
0 Network forensics is essentially about monitoring network
0
0
0
0
traffic and determining if there is an attack and if so,
determine the nature of the attack
Key tasks include traffic capture, analysis and visualization
Many tools are now available
Works together with IDs, Firewalls and Honeynets
Expert systems solutions show promise
3/22/2016 06:48
13-70
OSI Model
0 The Open Systems Interconnection model (OSI model) is a
product of the Open Systems Interconnection effort at the
International Organization for Standardization.
0 It is a way of sub-dividing a communications system into
smaller parts called layers. A layer is a collection of
conceptually similar functions that provide services to the
layer above it and receives services from the layer below it.
0 On each layer an instance provides services to the instances
at the layer above and requests service from the layer below.