About Me http://www.nku.edu/~waldenj1

1
CSC 382/582 Computer Security

• Introduction

2
About Me http//www.nku.edu/waldenj1

• James Walden
• Assistant Professor of Computer Science
• waldenj_at_nku.edu
• Interests
• Software Security
• Programming Languages
• Software Engineering
• Network Security

3
Course Administration

• Web Site
• Notes, readings, and assignments on web site.
• Assignment submission
• Send electronic submissions to waldenj_at_nku.edu
• Contact Information
• Email waldenj_at_nku.edu
• Phone [phone]

4
Course Goals

• 1. What is computer security?
• 2. How do computer systems fail?
• 3. How can the risks to a system be evaluated?
• 4. How well does a particular security solution
  mitigate the risks to a system?
• 5. How can the costs and trade-offs of a security
  solution be balanced?
• 6. What are the essential problems and solutions
  of network security?
• 7. How do viruses and worms propagate and how can
  they be stopped?
• 8. How can intrusions be detected and
  investigated to determine the nature of the
  attackand the attacker?
• 9. What are the ethical impacts of security
  technologies?

5
Grading
CSC 382
CSC 582
Midterm Exam 25
Final Exam 35
Assignments 30
Research Paper 10
Midterm Exam 30
Final Exam 40
Assignments 30
6
Topics

• A first look at four important questions
• What is security?
• How do we evaluate risks of various threats?
• How does security mitigate these risks?
• How do we balance the costs and trade-offs of our
  security solutions?

7
9/11

• Most devastating terrorist attack in history.
• Low-tech.
• Innovative.
• Completely different than earlier hijackings.
• We thought we had solved airplane bombings by
  ensuring passengers were on same flight as
  baggage.
• What were the security responses?
• How effective were the responses?
• What were the costs?

8
What is Security?

• Security is the prevention of certain types of
  intentional actions from occuring in a system.
• These potential actions are threats.
• Threats that are carried out are attacks.
• Intentional attacks are carried out by an
  attacker.
• Objects of attacks are assets.

9
Safety vs Security

• Adversary An intelligent attacker who
  intentionally causes the system to fail.

• Security
• Home door lock.
• Car alarm.
• Computer Login password.

• Safety
• Home fire alarm.
• Car crumple zones.
• Computer UPS.

Safety and security can interact Who is
watching your computer room after the fire alarm
was pulled?
10
Goals of Security

• Prevention
• Prevent attackers from violating security policy
• Detection
• Detect attackers violation of security policy
• Recovery
• Stop attack, assess and repair damage
• Survivability
• Continue to function correctly even if attack
  succeeds

11
NSTISSC Security Model
12
Components of Security

• Confidentiality
• Keeping data and resources hidden. Privacy.
• Integrity
• Preventing unauthorized changes to data or
  resources.
• Availability
• Enabling access to data and resources

13
Confidentiality

• Authentication
• Passwords, mothers maiden name
• Corporations
• Trade secrets, e.g., the formula for Coca Cola.
• Databases
• SSN, Drivers license
• Governments
• National security
• Embarrassing information www.thememoryhole.org

14
Integrity

• Data Integrity
• content of the information.
• ex 2005 Walmart 1.5 million bar code scam.
• Origin Integrity (authentication)
• source of the information.
• ex 1997 Kurt Vonnegut MIT commencement address
  email. Vonnegut was not the 1997 speaker and the
  content wasnt his.
• Prevention vs Detection

15
Availability

• Prevent loss of system access.
• Denial of service attacks common.
• Easy to launch, difficult to track down.
• Can be just part of another attack

16
States of Information

• Storage
• Information not currently being accessed.
• Processing
• Information currently being used by processor.
• Transmission
• Information in transit between one node and
  another.

17
Security Measures

• Technology.
• Hardware/software used to ensure confidentiality,
  integrity, or availability.
• Policy and practice.
• Security requirements and activities.
• Education, training, and awareness.
• Understanding of threats and vulnerabilities and
  how to protect against them.

18
How can we evaluate security solutions?

1. What assets are you trying to protect?
2. What are the risks to those assets?
3. How well does the security solution mitigate
   those risks?
4. What other risks does the security solution
   cause?
5. What costs and trade-offs does the security
   solution impose?

19
Aspects of Risks

• To evaluate a risk, we need to evaluate both
• Probability of risk occurring.
• Cost incurred by risk if it occurs.
• Minimize product of probability and cost.
• Risks are impacted by environment.
• Building a house in a flood plain incurs
  additional risks beyond that of house itself.
• Similarly, installion and configuration options
  impact risk of software systems.

20
Security is a matter of Trade-offs

• Security is only one of many system goals
• Functionality
• Ease of Use
• Efficiency
• Time to market
• Cost
• Security

21
Cost-Benefit Analysis

• Is it cheaper to prevent violation or recover?
• Cost of good network security
• Money, time, reduced functionality, annoyed
  users.
• Large and ongoing.
• Risks of bad network security
• Angry customers, bad press, network downtime.
• Small and temporary.

22
Airport Security

• Lets consider the issue of airport security
  again from the standpoint of what weve learned.
  Develop a solution, keeping the 5 questions in
  mind
• What assets are you trying to protect?
• What are the risks to those assets?
• How well does the security solution mitigate
  those risks?
• What other risks does the security solution
  cause?
• What costs and trade-offs does the security
  solution impose?

23
Human Issues People Problems

• Social engineering
• Kevin Mitnick testified before Congress I was so
  successful in that line of attack that I rarely
  had to resort to a technical attack.
• Circumvention
• Users write down passwords, leave screens
  unlocked.
• Insider attacks

24
Human Issues Organizations

• Low priority
• Security costs, but doesnt produce income.
• Lack of liability reduces costs of bad security.
• Variable impact
• Cost of security violation highly variable.
• Insurance converts variable risk to fixed cost,
  but risk too variable for much involvement so
  far.
• Power and responsibility
• Personnel responsible for security often dont
  have power to enforce security.

25
Security Laws and Customs

• Are desired security measures illegal?
• cryptography export before 2000
• is it legal to monitor security breakins?
• international commerce
• Will users circumvent them?
• writing down passwords
• removing file ACLs

26
Security Liability

• Product liability
• Tires Continental recalled Ford SUV tires in
  2002 due to wire and vibration problems.
• Software Manufacturer not liable for security
  flaws.
• Since Microsoft isnt liable for Windows security
  failures, why would they want to sacrifice money,
  time, functionality, and ease of use for security?

27
Assumptions

• Security rests on assumptions specific to type of
  security required and environment.
• Example
• TCP/IP designed for pre-commercial Internet.
• Assumed only legitimate admins had root access.
• Trusted IP addresses, since only root can set IP
  addr.
• What happens to network when Windows 95 systems
  added to network, where desktop user has all
  privileges?

28
Assurance

• How much can you trust a system?
• Example
• Purchasing aspirin from a drugstore.
• Bases for trust
• Certification of drug by FDA.
• Reputation of manufacturer.
• Safety seal on bottle.

29
How much do you trust?

• Ken Thompsons compiler hack from Reflections
  on Trusting Trust.
• Modified C compiler does two things
• If compiling a compiler, inserts the
  self-replicating code into the executable of the
  new compiler.
• If compiling login, inserts code to allow a
  backdoor password.
• After recompiling and installing old C compiler
• Source code for Trojan horse does not appear
  anywhere in login or C compiler.
• Only method of finding Trojan is analyzing
  binary.

30
Key Points

• Components of security
• Confidentiality
• Integrity
• Availability
• Evaluating risk and security solutions.
• Security is a matter of trade-offs.
• Security is a human problem.

31
References

1. Ross Anderson, Security Engineering, Wiley, 2001.
2. Matt Bishop, Introduction to Computer Security,
   Addison-Wesley, 2005.
3. Peter Neumann, (moderator), Risks Digest,
   http//catless.ncl.ac.uk/Risks/
4. Bruce Schneier, Beyond Fear, Copernicus Books,
   2003.
5. Ken Thompson, Reflections on Trusting Trust,
   Communication of the ACM, Vol. 27, No. 8, August
   1984, pp. 761-763 (http//www.acm.org/classics/sep
   95/)