Security: Technical and Ethical Issues

1
Security Technical and Ethical Issues
2
Types of Viruses

• Virus - self-replicating code embedding in a host
• common hosts are email attachments
• Worm - spreads through network
• commonly takes advantage of holes in windows
  server software or router software or email
  software on a PC
• Trojan Horse - bad program within a good program
• common in free games found on the internet, etc
• some wait until a certain date before doing harm

3
Difference in "Worm" and "Virus"

• A worm is a sub-type of a virus
• A virus requires human action to spread
• similar to human virus you ingest the virus by
  touching your eyes when the virus is on your
  hands, then you later cough the virus onto a
  surface
• your PC ingest the virus when you open an
  attachment, yadda yadda
• A worm spreads on its own

4
The Internet Worm (book section 6.2.3)

• Robert Morris, Cornell Grad Student
• bugs in ftp, sendmail, and fingerd
• used stack overflow attack
• not intended to delete material, etc intended
  just to see if it would spread
• launched Nov 2, 1988
• he told his friends and they posted a solution
• 3 years probation, 10K fine, 150K fees

5
Denial of Service Attacks

• SYN flood attack
• creates lots of pending processes
• email bombing
• fill up the disk drive with lots of messages
• fill up drive with a huge error file
• Distributed DoS
• thousands of machines simultaneously send web
  requests or email messages
• Univ of Cal estimates 4000 web sites receive DoS
  attacks each week.

6
Goals of a ISO (info security officer)

• Prevent
• unauthorized access to computer system
• alteration of data inside a computer or
  transmitted between computers
• disruption, vandalism, and sabotage of computers
  or networks

7
Ethical Questions

• You are an ISO, and the CEO receives a DoS
  threat. The 10K ransom is far less than the DoS
  will cost. Do you pay?
• You discover the location of an attacker. Should
  you attack them in response?
• Bounty hunters for virus writers?

8
Ethical Questions

• Is there an acceptable virus tolerance level?
• A VP wants to encode data on his PC. Good Idea?
• Should you keep a backup encryption key?
• Is hacking for education okay?

9
Ethic Questions
Online Voting?

• Advantages
• convenience
• accuracy
• Disadvantages
• not as anonymous
• favors well-to-do voters
• big target for DoS attack

10
Next Week

• Tuesday
• Robins, Howell, Downs
• Blow, Vue
• Thursday
• Huffman, Robinson, Smith
• Barbee, Miller