Introduction to Data Encryption and Network Security
Content
Data Encryption & Network Security y
Lecture # 1
[email protected]
1 October 2009
1
Course Outline
Areas of Information Security
Cryptography (Data Encryption) Network Security Security Management Computer Forensics Distributed system Security Secure Software Development
1 October 2009 2
What security is about in general?
Prevention
take measures that prevent your assets from being damaged (or stolen)
Detection
take measures so that you can detect when, how, and by whom an asset has been damaged
Reaction
take measures so that you can can……
1 October 2009
3
Real world example
Prevention
locks at doors, window bars, secure the walls around the property, hire a guard
Detection
missing items, burglar alarms, closed circuit TV
Reaction
attack on burglar, call the police, replace stolen items, make an insurance claim
1 October 2009
4
Internet shopping example
Prevention
encrypt your order and card number, enforce merchants h t t to d do some extra t checks, h k d don’t ’t send d card number via Internet
Detection
an unauthorized transaction appears on your credit card statement
R Reaction ti
complain, dispute, ask for a new card number, sue ( (if you y can find of course ☺) Or, pay and forget (a glass of cold water) ☺
1 October 2009 5
Information security in past and present
Traditional Information Security
keep the cabinets locked put them in a secure room human guards electronic surveillance systems in general:physical and administrative mechanisms Data are in computers Computers are interconnected Computer and Network Security
6
Modern World
1 October 2009
Global Perspective
According to an FBI study, 90% of US companies suffered a security incident in 2005 The FBI also estimates that cyber crime cost each US companies an average of $24 $24,000 000 in 2005 But, , they y estimate that the total cost of cyber y crime to the US was over $400 billion in 2005 alone
1 October 2009
7
Cyber Crime
“Criminal acts using computers and networks as tools or targets” “Traditional crimes conducted through the use of computers” Can be based on malicious code such as a virus virus, email virus, virus worm or Trojan horse. Passive Attacks Or actively perpetrated by knowledgeable individuals, individuals who attempt to exploit network, computer, and software flaws Active Attacks
1 October 2009
8
Cyber Crime
Pre-existing crimes that are facilitated by the Internet or ones that have found new life because the Internet has made them lucrative endeavours endeavours.
Theft, theft of information, financial crimes, fraud, copyright infringement, pornography, scams, harassment, and terrorism
1 October 2009
9
WHAT ARE WE UP AGAINST?
FIRST We are faced with weak underlying technology and i h inherently tl vulnerable l bl software ft
SECOND Issues such as users anonymity coupled with uninformed, misguided, and malicious users contribute to the problem
FINALLY Weak or non-existent legal, regulatory, and policy environments y countries’ ability y to tackle cyber y crimes limit many
1 October 2009 10
CYBER CRIMINALS
Cyber criminals come in many forms. The most harmful can be malicious insiders, and disgruntled or uninformed employees p y The Internet also has its share of professional criminals like hackers, , organized g crime and pedophiles, p p , who make a living off of their well honed skills and criminal endeavours Finally, competing business, governments and terrorists will also use the internet to improve their position or further their cause
1 October 2009 11
Technology Factors
Technology plays a key role in securing computers and networks, but only if properly deployed and maintained There are a panoply of security tools at your disposal. If used properly they will shield your organization from most attacks Security ranges from the basics like limiting access to the network, forcing users to change passwords at regular intervals, to physically limiting access to certain computers
1 October 2009
12
Technology Factors
A step up would involve virus scanners that inspect incoming files for viruses, to firewalls, which limit incoming and outgoing network traffic To sophisticated tools like intrusion detection systems, which constantly analyze network traffic and send out alerts or shut off access in the event of anomalies If information must be sent over the Internet Internet, encryption technology can shield sensitive data when it must be transmitted
1 October 2009
13
Policy Factors
Ensure laws, regulations and policies provide the necessary support and focus that can complement cyber security endeavours A strong legal framework sends a message that cyber crime will be dealt with seriously and that limits on online conduct will be imposed It must also ensure that countries are able to investigate arrest and prosecute cyber criminals investigate,
1 October 2009 14
Policy Factors
A well articulated regulatory scheme will ensure that key players such as security providers, government and industry understand their roles in ensuring a secure environment Well articulated policies that outline the roles, responsibilities and commitments of users and governments t will ill bring b i all ll this thi together t th
1 October 2009
15
Terminology
Computer Security
automated tools and mechanisms to protect data in a computer, even if the computers are connected to a network
against hackers (intrusion) against viruses against Denial of Service attacks
Network Security
measures to prevent prevent, detect detect, and correct security violations that involve the transmission of information in a network or interconnected network
1 October 2009
16
Services, Mechanisms, Attacks
application presentation session transport p network data link physical RPC TCP IP 802.11 Smart Sniffers, RF Noise RPC worms, portmapper exploits SYN flooding, RIP attacks, sequence number prediction IP smurfing and other address spoofing attacks WEP attacks email, il Web, W b NFS Sendmail, FTP, Sendmail FTP NFS bugs, bugs chosen-protocol and version-rollback attacks
Only as secure as the single weakest layer…
1 October 2009 17
Services, Mechanisms, Attacks
3 aspects of information security:
security attacks (and threats)
actions that compromise security
security services
services counter to attacks
security mechanisms
used by services E g secrecy is a service E.g. service, encipherment is a mechanism
1 October 2009 18
Attacks
Attacks on computer systems
break-in to destroy y information break-in to steal information blocking to operate properly malicious software
wide spectrum of problems
1 October 2009
19
Attacks
Network Security threats Passive attacks
Active Passive
Interception of the messages What can the attacker do?
use information internally release the content traffic analysis
hard to avoid hard to understand can be understood
Hard to detect, try to prevent
1 October 2009
20
Attacks
Active attacks (cont’d)
deny
repudiate sending/receiving a message later
modification
change the content of a message
1 October 2009
21
Eavesdropping on a Dialog
Dialog
Hello Client PC Bob Server Alice
Hello
Attacker (Eve) intercepts and reads messages
22
Encryption for Confidentiality
Encrypted Message “100100110001”
Client PC Bob “100100110001” Attacker (Eve) intercepts but cannot read
Server Alice
Original Message “Hello”
Decrypted Message “Hello”
23
Attacks
Active attacks involves interruption, modification and fabrication, etc. Masquerade fabrication Replay
pretend as someone else possible to get more privileges create a bogus message passively capture data and send later preventing the normal use of servers, end users, or network itself
24
Denial-of-service
1 October 2009
Masquerading & Authentication
I’m Bob
Client Cli t PC Bob
Attacker Att k (Eve)
Prove it! (Authenticate Yourself) Server Alice
25
Message Modification
Dialog
Client PC Bob
Balance = $1
Balance = $1,000,000
Server Alice
Balance = $1 Attacker (Eve) intercepts and alters messages
Balance = $1,000,000
26
Secure Dialog System
Secure Dialog
Client PC Bob
Automatically Handles Negation of Security Options Authentication Encryption Integrity
Server Alice
Attacker cannot read messages, alter messages, or impersonate
27
Network Penetration Attacks
Scanning (Probing) Attacks
Reply from 172.16.99.1 Probe Packets to 172.16.99.1, 172.16.99.2, etc.
Host 172.16.99.1
Internet
Attacker No Host 172.16.99.2 Results 172.16.99.1 is reachable 172 16 99 2 is 172.16.99.2 i not t reachable h bl …
No Reply
Corporate Network
28
Single-Message Break-In Attack
1. Single Break-In Packet
2. Server Taken Over By Single Message
Attacker
29
Denial-of-Service (DoS) Flooding Attack
Message Flood
Server Overloaded By Message Flood
Attacker
30
Network Penetration Attacks and Firewalls
Passed Packet Internet Firewall Hardened Client PC Attack Packet
Internet Attacker
Dropped Packet Hardened Server Log File
Internal Corporate Network
31
Intrusion Detection System (Defense against penetration attacks )
4. Alarm Intrusion Detection System 1. Suspicious Packet
Network Administrator
2. Suspicious Packet Passed
Internet Attacker
3. Log Packet
Hardened Server Log g File p Network Corporate
32
Security Services
to prevent or detect attacks to enhance the security y replicate functions of physical documents
e.g. g
have signatures, dates need protection from disclosure, tampering, or destruction Notarization record
1 October 2009
33
Basic Security Services
Authentication
assurance that the communicating entity is the one it claims to be peer entity authentication Data-origin Data origin authentication
mutual confidence in the identities of the parties involved in a connection assurance about the source of the received data
Access Control
Data Confidentiality
prevention of the unauthorized use of a resource protection of data from unauthorized disclosure
1 October 2009
34
Basic Security Services
Data Integrity
assurance that data received are exactly as sent by an authorized sender i.e. no modification, insertion, deletion etc
Non-Repudiation
protection against denial by one of the parties in a communication Origin non-repudiation
proof that the message was sent by the specified party
Destination non-repudiation
proof that the message was received by the specified party
1 October 2009
35
Security Mechanisms
Basically cryptographic techniques
that serve to security services to prevent/detect/recover attacks
E i he e t Encipherment
use of mathematical algorithms to transform data into a form that is not readily y intelligible; g ; encryption
keys are involved
1 October 2009
36
Security Mechanisms
Message Digest
similar to encipherment, but one-way (recovery not possible) generally no keys are used
Digital g Signatures g and Message g Authentication Codes
data appended to, or a cryptographic transformation of, a data unit to prove the source and the integrity of the data
Authentication Exchange
ensure the identity of an entity by exchanging some information
37
1 October 2009
Security Mechanisms
Notarization
use of a trusted third party to assure certain properties of a data exchange
Timestamping
inclusion of correct date and time within messages
Non-cryptographic mechanisms
intrusion detection and prevention firewalls
1 October 2009
38
Model for Network Security
1 October 2009
39
Model for Network Security
using this model requires us to:
design a suitable algorithm for the security transformation (Encryption Algorithms) generate the secret information (keys) used by the algorithm (Key Generation ) develop methods to distribute and share the secret information ( (Key y distribution mechanisms) ) specify a protocol enabling the principals to use the transformation and secret information for a security service
1 October 2009 40
Model for Network Access Security
1 October 2009
41
Model for Network Access Security
using this model requires us to:
select appropriate gatekeeper functions to identify users and ensure only authorized users access designated information or resources
e g password-based e.g. password based
Internal control to monitor the activity y and analyze y information to detect unwanted intruders
1 October 2009
42
Network Defenses
Systems
Implementations
Firewalls, intrusion detection detection… SSL, IPSec, access control…
Blueprints
Protocols and policies
Building B ildi blocks
Cryptographic primitives
RSA, DES, SHA-1…
…all defense mechanisms must work correctly and securely
1 October 2009 43
Fundamental Dilemma of Security
“Security unaware users have specific security requirements but no security expertise.”
from D. Gollmann
Solution: level of security is given in predefined classes specified in some common criteria
Orange book (Trusted Computer System Evaluation Criteria) is such a criteria
1 October 2009 44
Fundamental Tradeoff
Between security and ease-of-use Security y may y require q clumsy y and inconvenient restrictions on users and processes
“If security is an add-on that people have to do something special to get, then most of the time they will not get it” it Martin Hellman, co inventor of Public Key Cryptography co-inventor
1 October 2009 45
Design criteria for a successful product ???
Do not assume potential users to be security experts
but provide enough set of options for security experts
A security feature in a product is a plus, but a security product is a challenge in the market
people intend to pay for secure products, but not to pay security p products
1 October 2009
46
THANK U
1 October 2009 47
Lecture # 1
[email protected]
1 October 2009
1
Course Outline
Areas of Information Security
Cryptography (Data Encryption) Network Security Security Management Computer Forensics Distributed system Security Secure Software Development
1 October 2009 2
What security is about in general?
Prevention
take measures that prevent your assets from being damaged (or stolen)
Detection
take measures so that you can detect when, how, and by whom an asset has been damaged
Reaction
take measures so that you can can……
1 October 2009
3
Real world example
Prevention
locks at doors, window bars, secure the walls around the property, hire a guard
Detection
missing items, burglar alarms, closed circuit TV
Reaction
attack on burglar, call the police, replace stolen items, make an insurance claim
1 October 2009
4
Internet shopping example
Prevention
encrypt your order and card number, enforce merchants h t t to d do some extra t checks, h k d don’t ’t send d card number via Internet
Detection
an unauthorized transaction appears on your credit card statement
R Reaction ti
complain, dispute, ask for a new card number, sue ( (if you y can find of course ☺) Or, pay and forget (a glass of cold water) ☺
1 October 2009 5
Information security in past and present
Traditional Information Security
keep the cabinets locked put them in a secure room human guards electronic surveillance systems in general:physical and administrative mechanisms Data are in computers Computers are interconnected Computer and Network Security
6
Modern World
1 October 2009
Global Perspective
According to an FBI study, 90% of US companies suffered a security incident in 2005 The FBI also estimates that cyber crime cost each US companies an average of $24 $24,000 000 in 2005 But, , they y estimate that the total cost of cyber y crime to the US was over $400 billion in 2005 alone
1 October 2009
7
Cyber Crime
“Criminal acts using computers and networks as tools or targets” “Traditional crimes conducted through the use of computers” Can be based on malicious code such as a virus virus, email virus, virus worm or Trojan horse. Passive Attacks Or actively perpetrated by knowledgeable individuals, individuals who attempt to exploit network, computer, and software flaws Active Attacks
1 October 2009
8
Cyber Crime
Pre-existing crimes that are facilitated by the Internet or ones that have found new life because the Internet has made them lucrative endeavours endeavours.
Theft, theft of information, financial crimes, fraud, copyright infringement, pornography, scams, harassment, and terrorism
1 October 2009
9
WHAT ARE WE UP AGAINST?
FIRST We are faced with weak underlying technology and i h inherently tl vulnerable l bl software ft
SECOND Issues such as users anonymity coupled with uninformed, misguided, and malicious users contribute to the problem
FINALLY Weak or non-existent legal, regulatory, and policy environments y countries’ ability y to tackle cyber y crimes limit many
1 October 2009 10
CYBER CRIMINALS
Cyber criminals come in many forms. The most harmful can be malicious insiders, and disgruntled or uninformed employees p y The Internet also has its share of professional criminals like hackers, , organized g crime and pedophiles, p p , who make a living off of their well honed skills and criminal endeavours Finally, competing business, governments and terrorists will also use the internet to improve their position or further their cause
1 October 2009 11
Technology Factors
Technology plays a key role in securing computers and networks, but only if properly deployed and maintained There are a panoply of security tools at your disposal. If used properly they will shield your organization from most attacks Security ranges from the basics like limiting access to the network, forcing users to change passwords at regular intervals, to physically limiting access to certain computers
1 October 2009
12
Technology Factors
A step up would involve virus scanners that inspect incoming files for viruses, to firewalls, which limit incoming and outgoing network traffic To sophisticated tools like intrusion detection systems, which constantly analyze network traffic and send out alerts or shut off access in the event of anomalies If information must be sent over the Internet Internet, encryption technology can shield sensitive data when it must be transmitted
1 October 2009
13
Policy Factors
Ensure laws, regulations and policies provide the necessary support and focus that can complement cyber security endeavours A strong legal framework sends a message that cyber crime will be dealt with seriously and that limits on online conduct will be imposed It must also ensure that countries are able to investigate arrest and prosecute cyber criminals investigate,
1 October 2009 14
Policy Factors
A well articulated regulatory scheme will ensure that key players such as security providers, government and industry understand their roles in ensuring a secure environment Well articulated policies that outline the roles, responsibilities and commitments of users and governments t will ill bring b i all ll this thi together t th
1 October 2009
15
Terminology
Computer Security
automated tools and mechanisms to protect data in a computer, even if the computers are connected to a network
against hackers (intrusion) against viruses against Denial of Service attacks
Network Security
measures to prevent prevent, detect detect, and correct security violations that involve the transmission of information in a network or interconnected network
1 October 2009
16
Services, Mechanisms, Attacks
application presentation session transport p network data link physical RPC TCP IP 802.11 Smart Sniffers, RF Noise RPC worms, portmapper exploits SYN flooding, RIP attacks, sequence number prediction IP smurfing and other address spoofing attacks WEP attacks email, il Web, W b NFS Sendmail, FTP, Sendmail FTP NFS bugs, bugs chosen-protocol and version-rollback attacks
Only as secure as the single weakest layer…
1 October 2009 17
Services, Mechanisms, Attacks
3 aspects of information security:
security attacks (and threats)
actions that compromise security
security services
services counter to attacks
security mechanisms
used by services E g secrecy is a service E.g. service, encipherment is a mechanism
1 October 2009 18
Attacks
Attacks on computer systems
break-in to destroy y information break-in to steal information blocking to operate properly malicious software
wide spectrum of problems
1 October 2009
19
Attacks
Network Security threats Passive attacks
Active Passive
Interception of the messages What can the attacker do?
use information internally release the content traffic analysis
hard to avoid hard to understand can be understood
Hard to detect, try to prevent
1 October 2009
20
Attacks
Active attacks (cont’d)
deny
repudiate sending/receiving a message later
modification
change the content of a message
1 October 2009
21
Eavesdropping on a Dialog
Dialog
Hello Client PC Bob Server Alice
Hello
Attacker (Eve) intercepts and reads messages
22
Encryption for Confidentiality
Encrypted Message “100100110001”
Client PC Bob “100100110001” Attacker (Eve) intercepts but cannot read
Server Alice
Original Message “Hello”
Decrypted Message “Hello”
23
Attacks
Active attacks involves interruption, modification and fabrication, etc. Masquerade fabrication Replay
pretend as someone else possible to get more privileges create a bogus message passively capture data and send later preventing the normal use of servers, end users, or network itself
24
Denial-of-service
1 October 2009
Masquerading & Authentication
I’m Bob
Client Cli t PC Bob
Attacker Att k (Eve)
Prove it! (Authenticate Yourself) Server Alice
25
Message Modification
Dialog
Client PC Bob
Balance = $1
Balance = $1,000,000
Server Alice
Balance = $1 Attacker (Eve) intercepts and alters messages
Balance = $1,000,000
26
Secure Dialog System
Secure Dialog
Client PC Bob
Automatically Handles Negation of Security Options Authentication Encryption Integrity
Server Alice
Attacker cannot read messages, alter messages, or impersonate
27
Network Penetration Attacks
Scanning (Probing) Attacks
Reply from 172.16.99.1 Probe Packets to 172.16.99.1, 172.16.99.2, etc.
Host 172.16.99.1
Internet
Attacker No Host 172.16.99.2 Results 172.16.99.1 is reachable 172 16 99 2 is 172.16.99.2 i not t reachable h bl …
No Reply
Corporate Network
28
Single-Message Break-In Attack
1. Single Break-In Packet
2. Server Taken Over By Single Message
Attacker
29
Denial-of-Service (DoS) Flooding Attack
Message Flood
Server Overloaded By Message Flood
Attacker
30
Network Penetration Attacks and Firewalls
Passed Packet Internet Firewall Hardened Client PC Attack Packet
Internet Attacker
Dropped Packet Hardened Server Log File
Internal Corporate Network
31
Intrusion Detection System (Defense against penetration attacks )
4. Alarm Intrusion Detection System 1. Suspicious Packet
Network Administrator
2. Suspicious Packet Passed
Internet Attacker
3. Log Packet
Hardened Server Log g File p Network Corporate
32
Security Services
to prevent or detect attacks to enhance the security y replicate functions of physical documents
e.g. g
have signatures, dates need protection from disclosure, tampering, or destruction Notarization record
1 October 2009
33
Basic Security Services
Authentication
assurance that the communicating entity is the one it claims to be peer entity authentication Data-origin Data origin authentication
mutual confidence in the identities of the parties involved in a connection assurance about the source of the received data
Access Control
Data Confidentiality
prevention of the unauthorized use of a resource protection of data from unauthorized disclosure
1 October 2009
34
Basic Security Services
Data Integrity
assurance that data received are exactly as sent by an authorized sender i.e. no modification, insertion, deletion etc
Non-Repudiation
protection against denial by one of the parties in a communication Origin non-repudiation
proof that the message was sent by the specified party
Destination non-repudiation
proof that the message was received by the specified party
1 October 2009
35
Security Mechanisms
Basically cryptographic techniques
that serve to security services to prevent/detect/recover attacks
E i he e t Encipherment
use of mathematical algorithms to transform data into a form that is not readily y intelligible; g ; encryption
keys are involved
1 October 2009
36
Security Mechanisms
Message Digest
similar to encipherment, but one-way (recovery not possible) generally no keys are used
Digital g Signatures g and Message g Authentication Codes
data appended to, or a cryptographic transformation of, a data unit to prove the source and the integrity of the data
Authentication Exchange
ensure the identity of an entity by exchanging some information
37
1 October 2009
Security Mechanisms
Notarization
use of a trusted third party to assure certain properties of a data exchange
Timestamping
inclusion of correct date and time within messages
Non-cryptographic mechanisms
intrusion detection and prevention firewalls
1 October 2009
38
Model for Network Security
1 October 2009
39
Model for Network Security
using this model requires us to:
design a suitable algorithm for the security transformation (Encryption Algorithms) generate the secret information (keys) used by the algorithm (Key Generation ) develop methods to distribute and share the secret information ( (Key y distribution mechanisms) ) specify a protocol enabling the principals to use the transformation and secret information for a security service
1 October 2009 40
Model for Network Access Security
1 October 2009
41
Model for Network Access Security
using this model requires us to:
select appropriate gatekeeper functions to identify users and ensure only authorized users access designated information or resources
e g password-based e.g. password based
Internal control to monitor the activity y and analyze y information to detect unwanted intruders
1 October 2009
42
Network Defenses
Systems
Implementations
Firewalls, intrusion detection detection… SSL, IPSec, access control…
Blueprints
Protocols and policies
Building B ildi blocks
Cryptographic primitives
RSA, DES, SHA-1…
…all defense mechanisms must work correctly and securely
1 October 2009 43
Fundamental Dilemma of Security
“Security unaware users have specific security requirements but no security expertise.”
from D. Gollmann
Solution: level of security is given in predefined classes specified in some common criteria
Orange book (Trusted Computer System Evaluation Criteria) is such a criteria
1 October 2009 44
Fundamental Tradeoff
Between security and ease-of-use Security y may y require q clumsy y and inconvenient restrictions on users and processes
“If security is an add-on that people have to do something special to get, then most of the time they will not get it” it Martin Hellman, co inventor of Public Key Cryptography co-inventor
1 October 2009 45
Design criteria for a successful product ???
Do not assume potential users to be security experts
but provide enough set of options for security experts
A security feature in a product is a plus, but a security product is a challenge in the market
people intend to pay for secure products, but not to pay security p products
1 October 2009
46
THANK U
1 October 2009 47
