SECURITY ISSUES

1
SECURITY ISSUES IN CLIENT/SERVER COMPUTING
ENVIRONMENT FengChen Aug.31,2000
2
Reliability and security is a concern for any
computer system. These issues require special
attention when considering a change from
mainframe to client/server technologies. Since
mainframes are very secure because they are
generally placed in 'glass rooms' with hardened
infrastructure and controlled access, while
client/server systems are distributed and
therefore more difficult to secure.
3
Basic Components of Security Management

• Confidentiality
• Integrity
• Availability

4
Possible Threats Types of Attacks

• Impersonation
• Sniffing
• Software-Threats--Trojan Horse
• Data-Driven Attacks
• Denial of Service

5
Security Solutions

• Physical Security
• locks and keys
• security guards

• Software security
• Authentication
• Encryption
• Kerberos
• Others

6
Authentication

• Be performed to ensure a user or program has
• specific access to resource or data

Network Authentication
BASIC

• Password
• Retinal Image
• Finger Print
• Algorithm
• in Smart Card
• Physical Location
• (IP Address)

• Username Password
• Security Token

7
Encryption
Shared Key Encryption One key both encrypts
and decrypts
Public/Private Key Encryption Public/Private Key
Encryption Signature One key encrypts,
another different but related key for decrypts

• A combination of these two methods allows for
  mutual authentication.

8
Kerberos

• Kerberos is an authentication and session
  encryption system.

• How it Works?

• A separate ticket granting server gives a ticket
  to a user or application.

• This ticket can then be used for any number of
  resources on the network .

• If a client wants to talk to a server, both the
  client and the server will talk to the
  authentication server to establish that the
  client is authorized.

9
General Security Issues

• The security is only as strong as its weakest
  link
• A flawed security is worse than no security at
  all
• It is always better to use several security
  systems together than only one
• Security by obscurity doesnt work

10
Client/Server THE FUTURE
11
As computing becomes more ubiquitous and more
pervasive, client/server computing will become
the dominant implementation strategy. Convergence
of standards will result in better applications
integration and interoperability. Authentication
and security issues will be resolved sooner
rather than later the enormous interest in
exploiting the commercial potential of the
Internet will propel this process.