Information Security

Threats

Dr. Salman A. Khan

Email: engr.ahmeds@gmail.com

© Salman Khan 1
Threats
• A potential violation of the security of a system or a
network is a threat
• Threats are possible scenarios of security violations
• Actions that may cause these violations to occur are
called attacks
• In order to protect against attacks, we must define good
security mechanisms for identified threats

Attack Counter-
Threat to a
Attack measures (Detect,
System or
Mitigate, and Prevent
Network
Future Occurences
© Salman Khan 2
Threats
Snooping: unauthorized access to information (information
disclosure).
• An attacker observing the flow of email messages on a
network, or browsing through file or system information.
Wiretapping is snooping of a communication network
Possible Defense: Message secrecy e.g. encryption

Src: www.illuminati-news.com

© Salman Khan 3
Threats
Modification: a malicious (bad) entity changes information
deliberately to achieve his objective – It may lead to
others believing in wrong information
• Man-in-the-middle attack: an intruder intercepts
messages from the sender and sends fake messages to
the receiver instead of the original messages..
Possible Defense: Message integrity checks e.g. use of
message authentication codes

© Salman Khan 4
MiM Attack in Action!

© Salman Khan 5
Threats
Masquerading or spoofing: A malicious entity tries to impersonate
the identity of a valid user or a resource of a system or network
 A user accesses a website on the Internet thinking that it is the
actual website, but it is a false website
 Thru DNS translations towards incorrect addresses (DNS poisoning)
 Bad ARP requests make you believe the attacker is a router/or
another valid host
 A user is made to believe that the sender of a message is person X,
whereas he is not
Possible solution: Use authentication for both the resource (website) as
well as the entities initiating the message communication

© Salman Khan 6
Threats
Repudiation of origin: An entity (user or resource)
denying that he did some thing wrong
• A malicious entity creates a website that attracts
customers to it, and steals their usernames/passwords
for another valid website. If the attacker denies creating
this website, he is repudiating his action
Possible solution: User or source authentication

© Salman Khan 7
Threats
Denial of service: a malicious entity prevents valid users from
accessing a service.
 It may occur at the
 destination (by disabling a server from providing service),
 on the communication channel to the server (by disabling channel
access), or
 by discarding messages between the client and the server
Possible solution: Availability mechanisms

© Salman Khan 8
Policies
Policies define what is and what is not allowed in an organizational
network or system
• A security solution or mechanism enforces a defined policy

Examples
• Every user must have a password of length 8 or more to access his
windows account – enforced by disallowing users to set passwords
less than 8 characters in length
• A student is not authorized to copy another student’s homework
assignment – enforced by encouraging users to protect their
computer systems and emails with strong passwords

© Salman Khan 9
Specifications
• A specification is a statement on the desired functioning
of the system
• It helps the organization make a decision on the
purchase of a new system
• It also constraints the harm that can be done to the
organization through security threats if the specifications
are not met
• E.g. The system to be purchased must have strong
specs to protect it from compromise by an outsider

© Salman Khan 10
Design
• Design rules translate the specifications into components
that will implement the specifications.
• A design is said to comply (satisfy) with the
specifications if it does not permit the system to violate
the specifications
• The design of a system relies on assumptions of what
the specifications mean
• A poor design (hardware or software) will lead to
exposure of system vulnerabilities (weaknesses), which
can be exploited

© Salman Khan 11
Implementation
• An implementation creates a system that satisfies a
design.
• Design satisfies specs => implementation will also satisfy
specs
• A good system design closely follows all the
specifications, thus also following the policies that define
the specifications

© Salman Khan 12