Professional Documents
Culture Documents
Cyber Security
Lecture #3
Dr. Bhavani Thuraisingham
01/11/24 13:25
13-2
Outline
0 What is Cyber Security?
0 What is C. I. A.?
0 Ten Major Modules of Cyber Security
01/11/24 13:25
13-3
Cyber Security
0 Security traditionally has been about CIA (Confidentiality, Integrity,
Availability)
0 Security now also includes areas like Trustworthiness, Quality,
Privacy
0 Dependability includes Security, Reliability and Fault Tolerance
0 Initially the term used was Computer Security (Compusec); it then
evolved into Infosec – Information security – to include data and
networks – now with web its called Cyber Security
01/11/24 13:25
13-4
C. I.A.
0 Confidentiality: Preventing from unauthorized disclosure
0 Integrity: Preventing from unauthorized modification
0 Availability: Preventing denial of service
01/11/24 13:25
13-5
13-6
13-7
Access Control
0 Security Principles
0 Identification, Authentication, Authorization, Accountability
0 Access Control Models
0 Access Control techniques
0 Access Control Administration
0 Access Control Methods
0 Access Control Types
0 Accountability
0 Access Control practices
0 Access Control Monitoring
0 Threats to Access Control
01/11/24 13:25
13-8
13-9
13-10
13-11
Cryptography
0 History, Definitions and Concepts
0 Types of Ciphers
0 Methods of Encryption
0 Type of Asymmetric Systems
0 Message Integrity
0 PKI
0 Key Management
0 Link / End-to-end Encryption
0 Email standards
0 Internet security
0 Attacks
01/11/24 13:25
13-12
13-13
Applications Security
0 Database Security
0 Software and applications security issues
0 Secure systems development
0 Application development and security
0 Object-oriented systems and security
0 Distributed computing and security
0 Expert systems and security
0 Web security
0 Mobile code
0 Patch management
01/11/24 13:25
13-14
Operations Security
0 Role of the Operations Department
0 Administrative Management
0 Assurance Levels
0 Configuration management
0 Media Controls
0 Data Leakage
0 Network and Resource Availability
0 Mainframes
0 Email Security
0 Vulnerability testing
01/11/24 13:25
13-15
13-16
Security Management, Administration and
Governance
0 Information security (ISec) describes activities that relate to the
protection of information and information infrastructure assets
against the risks of loss, misuse, disclosure or damage. Information
security management (ISM) describes controls that an organization
needs to implement to ensure that it is sensibly managing these
risks.
0 The risks to these assets can be calculated by analysis of the
following issues:
0 Threats to your assets. These are unwanted events that could cause
the deliberate or accidental loss, damage or misuse of the assets
0 Vulnerabilities. How susceptible your assets are to attack
0 Impact. The magnitude of the potential loss or the seriousness of the
event.
01/11/24 13:25
13-17
Security Management, Administration and
Governance
0 Standards that are available to assist organizations implement the
appropriate programs and controls to mitigate these risks are for
example BS7799/ISO 17799, Information Technology Infrastructure
Library and COBIT.
0 Information Security Governance, Information Security Governance
or ISG, is a subset discipline of Corporate Governance focused on
information Security systems and their performance and risk
management.
0 Establish and maintain a framework to provide assurance that
information security strategies are aligned with business objectives
and consistent with applicable laws and regulations
01/11/24 13:25
13-18
Security Management, Administration and
Governance
0 Develop the information security strategy in support of business
strategy and direction.
0 Obtain senior management commitment and support
0 Ensure that definitions of roles and responsibilities throughout the
enterprise include information security governance activities.
0 Establish reporting and communication channels that support
information security governance activities.
0 Identify current and potential legal and regulatory issues affecting
information security and assess their impact on the enterprise.
0 Establish and maintain information security policies that support
business goals and objectives.
0 Ensure the development of procedures and guidelines that support
information security policies.
0 Develop business case for information security program
investments.
01/11/24 13:25
13-19
13-20
13-21
Information Classification
0 It is essential to classify information according to its actual value
and level of sensitivity in order to deploy the appropriate level of
security.
0 A system of classification should ideally be:
- simple to understand and to administer
- effective in order to determine the level of protection the
information is given.
- applied uniformly throughout the whole organization (note:
when in any doubt, the higher, more secure classification
should be employed).
01/11/24 13:25
13-22
Information Classification
0 With the exception of information that is already in the public
domain, information should not be divulged to anyone who is not
authorized to access it or is not specifically authorized by the
information owner.
0 Violations of the Information Classification Policy should result in
disciplinary proceedings against the individual.
0 Number of information classification levels in an organization
should be a manageable number as having too many makes
maintenance and compliance difficult.
01/11/24 13:25
13-23
Information Classification
0 Top Secret: Highly sensitive internal documents and data. For
example, impending mergers or acquisitions, investment strategies,
plans or designs that could seriously damage the organization if lost
or made public. Information classified as Top Secret has very
restricted distribution indeed, and must be protected at all times.
Security at this level is the highest possible.
0 Highly Confidential: Information which is considered critical to the
organization’s ongoing operations and could seriously impede or
disrupt them if made shared internally or made public. Such
information includes accounting information, business plans,
sensitive information of customers of banks (etc), patients' medical
records, and similar highly sensitive data. Such information should
not be copied or removed from the organization’s operational
control without specific authority. Security should be very high.
01/11/24 13:25
13-24
Information Classification
0 Proprietary: Procedures, project plans, operational work routines,
designs and specifications that define the way in which the
organization operates. Such information is usually for proprietary
use by authorized personnel only. Security at this level is high.
0 Internal Use Only: Information not approved for general circulation
outside the organization, where its disclosure would inconvenience
the organization or management, but is unlikely to result in financial
loss or serious damage to credibility/reputation. Examples include:
internal memos, internal project reports, minutes of meetings.
Security at this level is controlled but normal.
0 Public Documents: Information in the public domain: press
statements, annual reports, etc. which have been approved for
public use or distribution. Security at this level is minimal.
01/11/24 13:25
13-25
13-26
13-27
13-28
13-29
13-30
13-31
13-32
13-33
Operating Systems
0 Memory Management
0 Process management
0 File Management
0 Capability Domains
0 Virtual Machines
01/11/24 13:25
13-34
System Architecture
0 The software components that make up the system
0 Middleware
0 Database management
0 Networks
0 Applications
01/11/24 13:25
13-35
Security Architecture
0 Security critical components of the system
0 Trusted Computing Base
0 Reference Monitor and Security Kernel
0 Security Perimeter
0 Security Policy
0 Least Privilege
01/11/24 13:25
13-36
13-37
13-38
Security Models
0 Bell and LaPadula (BLP) Confidentiality Model
0 Biba Integrity Model (opposite to BLP)
0 Clark Wilson Integrity Model
0 Other Models
- information Flow Model
- Non Interference Model
- Graham Denning Model
- Harrison-Ruzzo-Ullman Model
- Lattice Model
01/11/24 13:25
13-39
13-40
13-41
13-42
13-43
Access Control
0 Access Control Overview
0 Identification, Authentication, Authorization, Accountability
0 Single Sign-on and Kerberos
0 Access Control Models
0 Access Control Techniques and Technologies
0 Access Control Administration
0 Access Control Monitoring: Intrusion Detection
0 Threats to Access Control
01/11/24 13:25
13-44
13-45
Access Control
0 Access control models used by current systems tend to fall into one
of two classes: those based on capabilities and those based on
access control lists (ACLs).
0 In a capability-based model, holding an unforgeable reference or
capability to an object provides access to the object
0 Access is conveyed to another party by transmitting such a
capability over a secure channel.
0 In an ACL-based model, a subject's access to an object depends on
whether its identity is on a list associated with the object
01/11/24 13:25
13-46
13-47
13-48
13-49
Single Sign-On
0 Single sign-on (SSO) is a property of access control of multiple,
related, but independent software systems. With this property a user
logs in once and gains access to all systems without being
prompted to log in again at each of them. Single sign-off is the
reverse property whereby a single action of signing out terminates
access to multiple software systems.
0 As different applications and resources support different
authentication mechanisms, single sign-on has to internally
translate to and store different credentials compared to what is used
for initial authentication.
01/11/24 13:25
13-50
13-51
Kerberos
0 Kerberos uses as its basis the symmetric Needham-Schroeder
protocol. It makes use of a trusted third party, termed a key
distribution center (KDC), which consists of two logically separate
parts: an Authentication Server (AS) and a Ticket Granting Server
(TGS). Kerberos works on the basis of "tickets" which serve to prove
the identity of users.
0 The KDC maintains a database of secret keys; each entity on the
network — whether a client or a server — shares a secret key known
only to itself and to the KDC. Knowledge of this key serves to prove
an entity's identity. For communication between two entities, the
KDC generates a session key which they can use to secure their
interactions.
0 The security of the protocol relies heavily on participants
maintaining loosely synchronized time and on short-lived assertions
of authenticity called Kerberos tickets.
01/11/24 13:25
13-52
Kerberos
0 The client authenticates itself to the Authentication Server and
receives a ticket. (All tickets are time-stamped.)
0 It then contacts the Ticket Granting Server, and using the ticket it
demonstrates its identity and asks for a service.
0 If the client is eligible for the service, then the Ticket Granting
Server sends another ticket to the client.
0 The client then contacts the Service Server, and using this ticket it
proves that it has been approved to receive the service.
01/11/24 13:25
13-53
Kerberos: Drawbacks
0 Single point of failure: It requires continuous availability of a central server.
When the Kerberos server is down, no one can log in. This can be mitigated
by using multiple Kerberos servers and fallback authentication mechanisms.
0 Kerberos requires the clocks of the involved hosts to be synchronized. The
tickets have a time availability period and if the host clock is not
synchronized with the Kerberos server clock, the authentication will fail. The
default configuration requires that clock times are no more than five minutes
apart. In practice Network Time Protocol daemons are usually used to keep
the host clocks synchronized.
0 The administration protocol is not standardized and differs between server
implementations.
0 Since all authentication is controlled by a centralized KDC, compromise of
this authentication infrastructure will allow an attacker to impersonate any
user.
01/11/24 13:25
13-54
13-55
13-56
13-57
13-58
Crypography
0 Definition of Cryptography
0 Important concepts
- Symmetric and Asymmetric, Hash, Digital Signature etc.
0 Steganography and Digital watermarking
0 Algorithms
0 Attacks
01/11/24 13:25
13-59
Definitions
0 Cryptography
- Mathematical manipulation of information that prevents the
information being disclosed or altered
0 Cryptanalysis
- Defeating the protected mechanisms of cryptography
0 Cryptology
- Study of Cryptography and Cryptanalysis
01/11/24 13:25
13-60
Goals of Cryptography
0 Confidentiality
0 Integrity
0 Authenticity
0 Non-repudiation
0 Access Control
0 Make compromise difficult
01/11/24 13:25
13-61
Process
0 Input (also called Plaintext or Clear Text)
0 Cryptosystem (device that performs encryption/decryption)
0 Cryptographic Algorithms (Mathematical functions)
0 Output (Cipher text or Cryptogram)
0 Key (Crypto variable)
01/11/24 13:25
13-62
Key Clustering
0 In cryptography, key clustering is said to occur when two different
keys generate the same ciphertextfrom the same plaintext, using the
same cipher algorithm. A good cipher algorithm, using different keys
on the same plaintext, should generate a different ciphertext,
irrespective of the key length.
0 If an 'attacker' tries to break a cipher by brute-force (trying all
possible keys until it finds the correct key) then key clustering will
result in an easier attack on a particular cipher text. If there are N
possible keys with out any key clustering then the attacker will on
average need to try N/2 keys to decrypt it and a worst case of trying
all N keys. If there are two keys that are clustered then the average
number of keys to try is reduced to N/4 (worst case is N-1 keys). If
three keys cluster than average attempt is only N/6 attempts.
01/11/24 13:25
13-63
13-64
13-65
Steganography
0 Steganography is the art and science of writing hidden messages in
such a way that no one, apart from the sender and intended
recipient, suspects the existence of the message, a form of security
through obscurity.
0 Generally, messages will appear to be something else: images,
articles, shopping lists, or some other covertext and, classically, the
hidden message may be in invisible ink between the visible lines of a
private letter.
0 The advantage of steganography, over cryptography alone, is that
messages do not attract attention to themselves.
0 Cryptography protects the contents of a message, steganography
can be said to protect both messages and communicating parties.
01/11/24 13:25
13-66
Steganography
0 Steganography includes the concealment of information within
computer files.
0 In digital steganography, electronic communications may include
steganographic coding inside of a transport layer, such as a
document file, image file, program or protocol.
0 Media files are ideal for steganographic transmission because of
their large size.
0 As a simple example, a sender might start with an innocuous image
file and adjust the color of every 100th pixel to correspond to a letter
in the alphabet, a change so subtle that someone not specifically
looking for it is unlikely to notice it.
01/11/24 13:25
13-67
13-68
13-69
Network Forensic
13-70
OSI Model