SCSC 455 Computer Security Chapter 1 Introduction Dr. Frank Li Index Definition of Computer Security OSI Security Architecture Security Attacks Security Services Security Mechanisms Model Standards Additional Concepts: Risk, People, Security certifications Definition of Computer Security Definition of Computer security page 4 There are many unauthorized computer access events and attacks on computer networks. Do you know … Carlos Felipe Salgado used sniffing technique to collect over 100,000 credit card numbers from online merchants. He was arrested in June 1997 as he tried to sell them to undercover FBI agents. On Nov. 3, 1988, system administrators all over the U.S. found that their systems were running abnormally slowly. Overview Computer Security Do you know … (cont’) In early 2000, a series of attacks attempt to shut down many web sites (Yahoo, eBay, Microsoft Network, etc.) by overwhelming them with bogus requests. Q: What are the causes of so many attacks on networks and computer systems? Evolution of computing and security Mainframe era The only computers were a few mainframes, which are used for specialized tasks. Users access the mainframes through “dumb” terminals Little threat of security breaches or vulnerabilities being exploited at that time. Why? Mainframe era Because … Only a handful of people, who knew how to operate the computer, work in a closed environment. Although some mainframes are networked, it was done in a crude fashion for specific tasks. Although the OS of that time had problems, software bugs, and vulnerabilities, not many people were interested in taking advantage of them. PC and networking era PC and networking era (1980 -- ) Personal computers (PCs) become more efficient and cheaper The functionality of the system grew, various applications were developed Millions individuals have access to computers Millions of computers are networked and birth of the client / server computing model Many security issues emerge Data got corrupted accidentally due to individual mistakes unexpected inputs from users malicious attempts from crackers Pros and cons of Networking A large number of computers are networked nowadays. This broad access represents the power of networked computers, but also represents opportunities for malicious intent. The more broadly a computer is networked, the more potential for access to that computer A great deal of valuable information (personal, financial …) are stored on computers. Two terms are commonly used to persons who break into computer systems: hacker vs. cracker. The motivations: for fun or for profit Other causes of computer attacks Cyber-terrorism: the use of computing resources to intimidate or coerce others. E.g. Hacking into a hospital computer system and changing someone's medicine prescription to a lethal dosage as an act of revenge. Information warfare is the offensive and defensive use of information and information systems to deny, exploit, corrupt, or destroy, an adversary's information, information-based processes, information systems, and computer-based networks while protecting one's own. Such actions are designed to achieve advantages over military, political or business adversaries. -- Dr. Ivan Goldberg Computer Crime: unauthorized access to a computer system. Gathering accurate statistics of the damages caused by computer crime is difficult. Why? How are nations affected? We are increasingly dependent on computer /network technology for communication, funds transfers, utility management, government services, military action, and maintaining confidential information. E.g. 1, A majority of the military vehicles, weapons systems, and communication systems are controlled by computer systems. E.g. 2, Critical infrastructures and industries, such as power grid and communication channels, are controlled by computer systems. Most governments have recognized this vulnerability and have started taking steps to evade these types of attacks. How are companies affected? Many companies are finding out how security affects their bottom line in ways they never expected. If a company suffers a security breach, it will have to deal with a wide range of issues, such as sued by the customers. Organizations have had trade secrets and intellectual property stolen by employees who left to work for a competitor. A company can lose money and time is by its lack of readiness to react to a situation. To get a good insurance rate, companies must prove that they have a solid security program and that they are doing all that they can to protect their own investments. Three Key Objectives Confidentiality Integrity Data Confidentiality Privacy Data Integrity System Integrity Availability Two additional Key Objectives Authenticity Accountability OSI Security Architecture What is OSI Security Architecture Definition of threat Definition of Attack Focus Areas Security attack Passive attacks Active attacks Security mechanism (Table 1.3) Security service (Table 1.2) Five categories : authentication, Access control, Data Confidentiality, Data integrity, Nonrepudiation Model for Network Security Two components Four Basic Tasks in designing a security service A security-related transformation Some secret information shared by the two principals 1 2 3 4 Other situations Unwanted access The placement that exploits vulnerabilities Standards NIST FIPS SP Internet Society IETF and IAB RFC (The next few slides are some additional concepts.) Outsider vs. Insider Crackers break into systems in order to: steal data e.g. credit card corrupt data block access to the system maybe unintentionally, but often for malicious reasons as in a Denial-of-Service (DoS) attack Crackers are not the only threat to systems, a majority of security incidents result from the actions of users within an organization The approaches to security A paradox of computer security: the more secure a system is, the less usable it is. The best approach to security is to make a system highly secure without undue annoyance to authorized users. “Security through obscurity” assumes that if no one knows about your system, you are safe, Is it a good approach? Why? The approaches to security “Security through obscurity” must be avoided. Because … The key to good security is not to hope that no one finds the security weaknesses of your system, but rather to eliminate those weaknesses. Risk Assessment Security should begin with a careful analysis of the assets being protected and their value These assets can include reputation, revenue generation, secret data, or other factors Definition of risk Risk Assessment Computer security is really about people Beside technology, Computer security is really about people knowing why they act as they do and knowing whom to trust is true from the perspective of the system administrator and the cracker The system administrator must proceed with caution regarding where they obtain Linux and other software A back door is a method of accessing a program that is known to its creator but not to other users Social engineering involves a cracker manipulating a user to extract needed access information E.g., A cracker will simply obtain a user’s name and call them in order to obtain information. E.g. A cracker could walk past an employee’s workstation and gather information from posted data The purpose of security certification Two purpose of Security Certification helps companies identify individuals who have the ability, knowledge, and experience To perform risk analysis, To identify necessary countermeasures, To implement solid security practices, To help the organization as a whole protect its facility, network, systems, and information. also provides security professionals with the credential that represents the skill set they want to offer to employers. Popular IT security certifications CompTIA Security+ and Network+ certifications (or equivalent knowledge) are helpful to prepare advanced security certifications. ( www.comptia.org ) CompTIA has more than 22,000 member companies in over 100 countries around the world; also serves the IT industry as the world's largest developer of vendorneutral IT certification exams. Advanced security certifications (details next …) Certified information systems security professional (CISSP) SANS Institute offers training and information security certifications through Global Information Assurance Certification (GIAC) The international council of electronic commerce consultants (ECCouncil) offers Certified ethical hacker (CEH) Compare security certifications CISSP More concerned with policies and procedures Although it is not geared toward the technical IT professional, it has become one of the standards for many security professionals. GIAC certifications are classified in five subject areas: Security Administration Management Operations Legal Audit CEH certifications People with this certification will most likely be placed on a team called a “red team” that conducts network penetration test. Probing vulnerability of the networks and computer systems. The CISSP Requirements CISSP exam requires one of the following professional experience requirements: At least three years of experience in one (or more) of the ten domains and a college degree Four years of professional experience in one (or more) of the domains within the Common Body of Knowledge (CBK) Two years of experience plus a bachelor’s degree or a master’s degree in information security from a National Center of Excellence Associate of CISSP For candidates who do not meet professional experience requirements The Common Body of Knowledge (CBK) CISSP exam covers the ten domains that make up the CISSP CBK Access Control Systems and Methodology This domain examines mechanisms and methods used to enable administrators and managers to control what subjects can access, the extent of their capabilities after authorization and authentication, and the auditing and monitoring of these activities. The Common Body of Knowledge (CBK) Telecommunications and Network Security This domain examines internal, external, public, and private communication systems; networking structures; devices; protocols; and remote access and administration. Security Management Practices This domain examines the identification of company assets, the proper way to determine the necessary level of protection required, and What type of budget to develop for security implementations with the goal of reducing threats and monetary loss. The Common Body of Knowledge (CBK) Applications and Systems Development Security This domain examines the security components within operating systems and applications and how to best develop and measure their effectiveness. This domain looks at software life cycles, change control, and application security. Cryptography This domain examines methods and techniques for disguising data for protection purposes. This involves cryptography techniques, approaches, and technologies. The Common Body of Knowledge (CBK) Security Architecture and Models This domain examines concepts, principles, and standards for designing and implementing secure applications, operating systems, and systems. This covers international security measurement standards and their meaning for different types of platforms. Operations Security This domain examines controls over personnel, hardware, systems, and auditing and monitoring techniques. This also covers possible abuse channels and how to recognize and address them. The Common Body of Knowledge (CBK) Business Continuity Planning (BCP) and Disaster Recovery Planning (DRP) This domain examines the preservation of business activities when faced with disruptions or disasters. This involves the identification of real risks, proper risk assessment, and countermeasure implementation. Laws, Investigation, and Ethics This domain examines computer crimes, laws, and regulations. This includes techniques in investigating a crime, gathering evidence, and handling procedures. It also covers how to develop and implement an incident-handling program. The Common Body of Knowledge (CBK) Physical Security This domain examines threats, risks, and countermeasures to protect facilities, hardware, data, media, and personnel. This involves Facility selection, authorized entry methods, and environmental and safety procedures.