Week 1

 What is security?
 Security Architecture
 Security Principles
 Security Policy
 Security Attacks / Threats
 Methods of Defense
 Security Services
 Security Mechanisms
 Definition:
◦ Security is the quality or state of
being secure that is to be free from
danger and
◦ to be protected from adversaries –
from those who would do harm,
intentionally or otherwise
 Information Security:
◦ Information Security is the
protection of information and the
systems and hardware that use,
store, and transmit that information
By NSTISSC
 Threat
◦ A threat may be an expressed or demonstrated
intent to harm an asset or cause it to become
unavailable.
◦ Example: Hostile acts that target an asset,
irrespective of the motive, human error.
◦ Impact of threats can cause web service or email
interruptions, loss or unintentional disclosure of
sensitive information,.
 Vulnerabilities
◦ vulnerability is a flaw in the measures you take to
secure an asset. This is a broader interpretation of
the traditional definition, which considers only
flaws or weaknesses in systems or networks.
◦ Example :
 if you do not run antivirus and antimalware software,
your laptop or mobile device is vulnerable to
infections.
 User behaviors create opportunities for attackers and
are thus vulnerabilities
◦ Impact :
 expose your organization's assets to harm
 Exploits
◦ exploit is commonly used to describe a software
program that has been developed to attack an asset
by taking advantage of a vulnerability.
◦ Example : Virus, malware, trojan, rootkit
◦ Impact : able to control the asset, loss to
organization
 Risk is a measure of the cost of a vulnerability
(taking into account probability of a
successful attack).
 Risk analysis determines whether expenditure

on (new/better) safeguards is warranted.

10 SECURITY INNOVATION ©2003

 Tools: scanner such as virus scanner, internet
Detection scanner and Web server scanner

Tools: proxy, firewall Prevention

Recovery
Tools: cryptography techniques,
proper planning
 Prevention of unauthorized disclosure of
Confidentiality information

Prevention of unauthorized Integrity

modification of information

Prevention of unauthorized Availability

withholding of information or
resources
 Defined by ITU-T Recommendation
X.800 that called OSI Security
Architecture.
 Useful to managers as a way of
organizing the task of providing
security
 Architecture was developed as an
international standard, computer and
communications vendors have
developed security features for their
products and services that relate to the
structured definition of services and
mechanisms.
 Focuses on security attacks, security
mechanisms and security services.
 Classified
By X.800 and RFC 2828 Into
2

Passive attacks: eavesdropping or

monitoring the transmissions
Passive
Goal: to obtain information that is Attacks
being transmitted
Types: release of message contents
& traffic analysis

Active attacks: Involve some

modification of the data stream or
Active
the creation of a false stream Attacks
Goal: to obtain authorization
Categories: masquerade, replay,
modification of messages & denial of
service
 Read contents of message from
Halim to Anita

Internet or other
communications
facility
 Observe pattern of messages
from Halim to Anita

Internet or other
communications
facility
 Message from Alex that appears
to be from Halim

Internet or other
communications
facility
 Capture message from Halim to
Anita; later replay
message to Anita

Internet or other
communications
facility
 Alex modifies message from Halim
to Anita

Internet or other
communications
facility
 Alex disrupts service provided
by server

Internet or other
communications
facility
 Passive Attack  Active Attack
◦ Very difficult to ◦ Quite difficult to
detect. Why? prevent active
◦ Feasible to prevent attacks. Why?
the success of these ◦ Instead, the goal
attacks. How? is to detect active
◦ Emphasis in dealing attacks and to
with passive attacks recover from any
is on prevention disruption or
rather than delays caused by
detection. them.
 We can deal with harm that
occurs when a threat is realized
against a vulnerability in several
ways:
◦ Prevent it, by blocking the attack
or closing the vulnerability.
◦ Deter it, by making the attack
harder, but not impossible.
◦ Deflect it, by making another
target more attractive.
◦ Detect it, either as it happens or
some time after the fact.
◦ Recover from its effects.
 Encryption
 Software Controls - access
limitations in a data base, in
operating system protect each
user from other users
 Hardware Controls –
smartcard
 Policies - frequent changes
of passwords
 Physical Controls
 Program controls include:
◦ Internal program controls: part of the program
that enforce security restrictions, such as access
limitations in a database management program.

◦ Operating system and network system controls:

limitations enforced by the operating system or
network to protect each user from all other users.

◦ Independent control programs: application

programs, such password checkers, intrusion
detection utilities or virus scanners, that protect
against certain types of vulnerabilities.

◦ Development controls: quality standards under

which a program is designed, coded, tested and
maintained, to prevent software faults from
becoming exploitable vulnerabilities.
 Numerous hardware devices have been
created to assist in providing computer
security. These devices include a variety
of means, such as:
◦ Hardware or smart card
implementations of encryption
◦ Locks or cables limiting access or
deterring theft
◦ Devices to verify user’s identities
◦ Firewalls
◦ Intrusion detection systems
◦ Circuit boards that control access to
storage media
 Controls can also be in place
based on agreed-upon
procedures or policies among
users, rather than enforcing
security through hardware or
software means.
 Training and administration
follow immediately after
establishment of policies, to
reinforce the importance of
security policy and to ensure
their proper use.
 Encryption is the formal name for
scrambling data so that interpretation is
meaningless without the intruder’s knowing
how the scrambling was done.
 Encryption can virtually nullify the value of
an interception and the possibility of
effective modification or fabrication.
◦ It clearly addresses the need for
confidentiality of data.
◦ It also can be used to ensure integrity.
 Encryption is the basis of protocols that
enable us to provide security while
accomplishing an important system or
network task.
 Principle of effectiveness:
Controls must be used and
used properly to be effective.
 There are several aspects that
can enhance the effectiveness
of controls:
◦ Awareness of problem
◦ Likelihood of use
◦ Overlapping controls
◦ Periodic review
 Defined by X.800:
◦ A security service as a service provided
by a protocol layer of communicating
open systems which ensure adequate
security of the systems or of data
transfers.
 Defined by RFC 2828:
◦ A processing or communication
service that is provided by a system to
give a specific kind of protection to
system resources where security
services implement security policies
and are implemented by security
mechanisms.
 Authentication - assurance that the
communicating entity is the one claimed
 Access Control - prevention of the

unauthorized use of a resource

 Data Confidentiality –protection of data from

unauthorized disclosure
 Data Integrity - assurance that data received

is as sent by an authorized entity

 Non-Repudiation - protection against denial

by one of the parties in a communication

 Entity authentication provides checking of a
claimed identity at a point in time.
 Typically used at start of a connection.
 Addresses masquerade and replay threats.
 Origin authentication provides verification of

source of data.
 Does not protect against duplication or

modification of data.
 GSM, web servers

32 SECURITY INNOVATION ©2003

 Provides protection against unauthorized use
of resource, including:
◦ use of a communications resource,
◦ reading, writing or deletion of an information
resource,
◦ execution of a processing resource.
 Remote users

33 SECURITY INNOVATION ©2003

 Protection against unauthorized disclosure of
information (from passive attack).
 Four types:
◦ Connection confidentiality,
◦ Connectionless confidentiality,
◦ Selective field confidentiality,
◦ Traffic flow confidentiality.
 Internet banking session
 Encrypting routers as part of Swift funds
transfer network

34 SECURITY INNOVATION ©2003

 Provides protection against active threats to the
validity of data.
 No modification, no insertion, no deletion, no replay.
 Five types:
◦ Connection integrity with recovery,
◦ Connection integrity without recovery (detection
only)
◦ Selective field connection integrity,
◦ Connectionless integrity,
◦ Selective field connectionless integrity.
 MD5 hashes
http://www.apache.org/dist/httpd/binaries/linux/

35 SECURITY INNOVATION ©2003

 Protects against a sender of data denying that
data was sent (non-repudiation of origin).
 Protects against a receiver of data denying

that data was received (non-repudiation of

delivery).
 Analogous to signing a letter and sending

recorded delivery

36 SECURITY INNOVATION ©2003

 Security mechanism is any process (or a device incorporating
such a process) that is designed to detect, prevent or recover
from a security attack.
 Security mechanisms exist to provide and support security
services and was defined by X.800
 Divided into two classes: those that are implemented in a
specific protocol layer and those that are not specific to any
particular protocol layer or security services
◦ Specific Security Mechanisms
 May be incorporated into the appropriate protocol layer in order to
provide some of the OSI security services.
◦ Pervasive Security Mechanisms
 Mechanisms that are not specific to any particular OSI security service
or protocol layer.
 En
e ci
ch ang t ph
Ex e
SECURITY MECHANISMS

n rm
c a tio en
nt i
he
Aut Data Integrity
Digital Signature

d ing
d Access Control
Pa
ffic

ms
Tra
Notar
izatio

nis
n

ha
Routing Control

ec
yM
rit
cu
Se
ific
ec
Sp
 Encryption mechanisms = encryption or
cipher algorithms.
◦ Can provide data and traffic flow confidentiality.
 Digital signature mechanisms
◦ signing procedure (private),
◦ verification procedure (public).
◦ Can provide non-repudiation, origin authentication
and data integrity services.
 Both can be basis of some authentication
exchange mechanisms.

43 SECURITY INNOVATION ©2003

 Access Control mechanisms
◦ A server using client information to decide
whether to grant access to resources
 E.g. access control lists, capabilities, security labels.
 Data integrity mechanisms
◦ Protection against modification of data.
 Provide data integrity and origin authentication
services. Also basis of some authentication
exchange mechanisms.
 Authentication exchange mechanisms
◦ Provide entity authentication service.

44 SECURITY INNOVATION ©2003

 Traffic padding mechanisms
◦ The addition of ‘pretend’ data to conceal real volumes of
data traffic.
◦ Provides traffic flow confidentiality.
 Routing control mechanisms
◦ Used to prevent sensitive data using insecure channels.
◦ E.g. route might be chosen to use only physically secure
network components.
 Notarization mechanisms
◦ Integrity, origin and/or destination of data can be
guaranteed by using a 3rd party trusted notary.
 Notary typically applies a cryptographic transformation to
the data.

45 SECURITY INNOVATION ©2003

 i ty
SECURITY MECHANISMS

i o nal
ct
d Fun
r uste
T
Security label Security Audit Trail

very
o
R ec
Event Detection
ity

s
ur

sm
c
Se

ni
ha
ec
M
ity
cur
Se
e
iv
as
rv
Pe
 Trusted functionality
◦ Any functionality providing or accessing security
mechanisms should be trustworthy.
◦ May involve combination of software and hardware.
 Security labels
◦ Any resource (e.g. stored data, processing power,
communications bandwidth) may have security label
associated with it to indicate security sensitivity.
◦ Similarly labels may be associated with users. Labels
may need to be securely bound to transferred data.

47 SECURITY INNOVATION ©2003

 Event detection
◦ Includes detection of
 attempted security violations,
 legitimate security-related activity.
◦ Can be used to trigger event reporting (alarms), event
logging, automated recovery.
 Security audit trail
◦ Log of past security-related events.
◦ Permits detection and investigation of past security
breaches.

48 SECURITY INNOVATION ©2003

 Security recovery
◦ Includes mechanisms to handle requests to recover from
security failures.
◦ May include immediate abort of operations, temporary
invalidation of an entity, addition of entity to a blacklist.

49 SECURITY INNOVATION ©2003

 Mechanism
Service Encipherme Digital Acces Data Authenticati Traffic Routin Notarizati
nt Signatu s Integri on Padding g on
re Contr ty Exchange Contr
ol ol
Peer Entity Y Y Y
Authenticatio
n
Data Origin Y Y
Authenticatio
n
Access Y
Control
Confidentialit Y Y
y
Traffic Flow Y Y Y
Confidentialit
y
Data Integrity Y Y Y
Nonrepudiati Y Y Y
on
 Due to the technology era today, information
security is made more importance implemented in
most of organization.
 Studying information security is also importance
due to the demand career in this area.
 Most of the major requirements for security
services can be given self-explanatory one word
labels:
◦ Confidentiality, authentication, nonrepudiation, integrity