Security and Control

1
Security and Control

2

• Lecture Part 2

3
Initial Exercise

• Pretend that you are a hacker who would like to
  trick people into giving you their user IDs and
  passwords to their Amazon.com accounts. What are
  some of the ways that this might be accomplished?

4
Types of Threats and Attacks

• Nontechnical attack An attack that uses
  chicanery to trick people into revealing
  sensitive information or performing actions that
  compromise the security of a network

5
Security and Control Why Systems are Vulnerable

• Threats or Attacks
• Disaster
• Advances in Telecommunications and Computer
  Software
• Controls
• Security

6
Security and Control Why Systems are Vulnerable
Threats or Attacks
7
Types of Threats and Attacks (cont.)

• Social engineering A type of nontechnical attack
  that uses social pressures to trick computer
  users into compromising computer networks to
  which those individuals have access

8
Types of Threats and Attacks (cont.)

• Multiprong approach used to combat social
  engineering
• Education and training
• Policies and procedures
• Penetration testing

9
Types of Threats and Attacks (cont.)

• Technical attack An attack perpetrated using
  software and systems knowledge or expertise

10
Types of Threats and Attacks (cont.)

• Common (security) vulnerabilities and exposures
  (CVEs) Publicly known computer security risks,
  which are collected, listed, and shared by a
  board of security-related organizations
  (cve.mitre.org)

11
Security

• http//www.cert.org/encyc_article/tocencyc.html
  Security of the Internet
• www.cve.mitre.org CVE
• Google (examples of hidden fields)
• ltINPUT TYPEhidden Nameprice.
• http//frontpage.stormer.com/simple.htm
• This example shows to send hidden fields in a
  form to a shopping cart?
• What else is your browser sending?

12
Types of Threats and Attacks (cont.)

• Denial-of-service (DoS) attack An attack on a
  Web site in which an attacker uses specialized
  software to send a flood of data packets to the
  target computer with the aim of overloading its
  resources

13
Types of Threats and Attacks (cont.)

• Distributed denial-of-service (DDoS) attack A
  denial-of-service attack in which the attacker
  gains illegal administrative access to as many
  computers on the Internet as possible and uses
  these multiple computers to send a flood of data
  packets to the target computer

14
Types of Threats and Attacks (cont.)
15
Security Mechanisms

• Encryption
• To ensure confidentiality
• User authentication
• Verification of user's identity
• Dynamic password assignment
• Access control lists for authorized access to
  network resources

16
Types of Threats and Attacks

• Malware A generic term for malicious software
• The severity of the viruses increased
  substantially, requiring much more time and money
  to recover
• 85 of survey respondents said that their
  organizations had been the victims of e-mail
  viruses in 2002

17
Types of Threats and Attacks (cont.)

• Malicious code takes a variety of formsboth pure
  and hybrid
• Virus A piece of software code that inserts
  itself into a host, including the operating
  systems, to propagate it requires that its host
  program be run to activate it

18
Types of Threats and Attacks (cont.)

• Worm A software program that runs independently,
  consuming the resources of its host in order to
  maintain itself and is capable of propagating a
  complete working version of itself onto another
  machine

19
Types of Threats and Attacks (cont.)

• Macro virus or macro worm A virus or worm that
  is executed when the application object that
  contains the macro is opened or a particular
  procedure is executed

20
Types of Threats and Attacks (cont.)

• Trojan horse A program that appears to have a
  useful function but that contains a hidden
  function that presents a security risk

21
Security and Control Why Systems are Vulnerable
Disaster
22
Disaster

• Fault-tolerant computer systems Contain extra
  hardware, software, and power supply components
  to provide continuous uninterrupted service
• Online transaction processing Transactions
  entered online are immediately processed by
  computer

23
Disaster

• Disaster recovery plan Runs business in event of
  computer outage
• High-availability computing Tools and
  technologies enabling system to recover quickly
  from a crash
• Load balancing Distributes large number of
  requests for access among multiple servers

24
Disaster

• Mirroring Duplicating all processes and
  transactions of server on backup server to
  prevent any interruption in service
• Clustering Linking two computers together so
  that a second computer can act as a backup to the
  primary computer or speed up processing

25
Security and Control Why Systems are Vulnerable
Advances in Telecommunications and Computer
Software
26
Security and Control - Telecommunications
http//digitalenterprise.org/security/security.htm
l
27
Security Aspects Network and Server

• Issues
• Physical connectivity
• Availability
• Correct routing

28
Security Aspects Network and Server

• Threats
• Sabotage
• Denial of service
• Address spoofing

29
Security and Control - Telecommunications

• Firewalls
• Prevent unauthorized users from accessing private
  networks
• Two types
• Proxies and stateful inspection
• http//www.webopedia.com/TERM/S/stateful_inspectio
  n.html
• Intrusion Detection System
• Monitors vulnerable points in network to detect
  and deter unauthorized intruders

30
Security Aspects Network and Server

• Packet filters Rules that can accept or reject
  incoming packets based on source and destination
  addresses and the other identifying information
• Application-level proxy A firewall that permits
  requests for Web pages to move from the public
  Internet to the private network

31
Security Aspects Network and Server

• Bastion gateway A special hardware server that
  utilizes application-level proxy software to
  limit the types of requests that can be passed to
  an organizations internal networks from the
  public Internet
• Proxies Special software programs that run on
  the gateway server and pass repackaged packets
  from one network to the other

32
Security Aspects Network and Server
33
Securing EC Networks (cont.)

• Packet filters Rules that can accept or reject
  incoming packets based on source and destination
  addresses and the other identifying information
• Application-level proxy A firewall that permits
  requests for Web pages to move from the public
  Internet to the private network

34
Securing EC Networks (cont.)

• Bastion gateway A special hardware server that
  utilizes application-level proxy software to
  limit the types of requests that can be passed to
  an organizations internal networks from the
  public Internet
• Proxies Special software programs that run on
  the gateway server and pass repackaged packets
  from one network to the other

35
Securing EC Networks (cont.)
36
Securing EC Networks (cont.)

• Intrusion detection systems (IDSs) A special
  category of software that can monitor activity
  across a network or on a host computer, watch for
  suspicious activity, and take automated action
  based on what it sees

37
Securing EC Networks (cont.)

• Network-based IDS uses rules to analyze
  suspicious activity at the perimeter of a network
  or at key locations in the network
• Consists of a monitora software package that
  scans the software agents that reside on various
  host computers and feed information back to the
  monitor

38
Security Services
39
Security Services

• Confidentiality
• The ability to ensure that the contents of a
  message are secret and known only to the sender
  and intended receiver
• How can this be implemented on a network?

40
Security Services

• Integrity
• The ability to ensure that the contents of a
  message are not modified during transmission
• How can this be implemented on a network?

41
Security Services

• Non-repudiation (or Non-denial)
• The ability to ensure that the sender of a
  message cannot deny sending the message, or the
  receiver denying receiving it
• How can this be implemented on a network?

42
Security Services
43
Additional Security Services for eCommerce

• Availability
• The ability to ensure that an e-commerce site
  functions as intended

44
Security Aspects Network and Server

• Objectives
• Ensuring access to the subscribed services
• Preventing outsiders from reading or manipulating
  the content or sequence of messages
• Preventing falsification of payment instructions
  or generation of spurious messages
• Saving records correctly and safely

45
Passive Attacks
tracert www.ssl.com

• In passive attacks, attacker tries to gather
  information by monitoring and copying data
  transmissions (sniffing or eavesdropping).
• Passive attacks are difficult to detect since
  they do not involve any alteration of the data.
• Passive attack types
• Data interception
• Data analysis

46
Active Attacks

• In active attacks, attacker somehow modifies the
  message.
• Examples
• Masquerade and message modification
• Attacker obtains the user ID and password of a
  legitimate user and logs on to the network to
  modify the data being transmitted, or to obtain
  additional privileges.
• Denial of service (DoS)
• Rendering a server unavailable to others, e.g.,
  by flooding a server with multiple bogus
  connection requests.
• Web spoofing

47
Security at Different Network Levels

• Network level
• Network connections are secured, providing bulk
  protection from one end system to another (e.g.,
  Firewalls, IPSec)
• IPSec
• http//www.webopedia.com/TERM/I/IPsec.html

IPSec
48
Security at Different Network Levels

• Transport level
• Transport connections are secured (e.g., using
  SSL when network is not reliable)

49
Security at Different Network Levels
Network Level

• Application level
• The application is secured
• PGP
• http//www.elook.org/internet/129.html
• SET
• http//www.dbmsmag.com/9709d161.html

Application




TCP


IP


Transport Level
Application
SSL




TCP





IP
50
Security and Control Computer Software
Development Errors
51
Security and Control Computer Software

• Bugs
• Program code defects or errors
• Computer Viruses
• Maintenance Nightmare
• Maintenance costs high due to organizational
  change, software complexity, and faulty system
  analysis and design

52
Security and Control Why Systems are Vulnerable

• Controls

53
CREATING A CONTROL ENVIRONMENT

• Controls
• Methods, policies, and procedures that ensure
  protection of organizations assets
• Ensure accuracy and reliability of records, and
  operational adherence to management standards

54
General Controls and Application Controls

• General controls
• Establish framework for controlling design,
  security, and use of computer programs
• Include software, hardware, computer operations,
  data security, implementation, and administrative
  controls

55
General Controls and Application Controls

• Application controls
• Unique to each computerized application
• Include input, processing, and output controls

56
Creating a Control Structure Costs and Benefits

• Criteria for determining control structure
• Importance of data
• Efficiency, complexity, and expense of each
  control technique
• Level of risk if a specific activity or process
  is not properly controlled

57
The Role of Auditing in the Control Process

• MIS audit
• Identifies all controls that govern individual
  information systems and assesses their
  effectiveness

58
MIS Audit
59
Creating a Control Structure Why Systems are
Vulnerable

• Security

60
Security Services

• Authentication
• Confidentiality
• Integrity
• Non-repudiation (or Non-denial)
• Availability
• Privacy
• Explanations and implementations?

61
Security Services

• Authentication
• The ability to positively identify persons or
  entities

62
Security Mechanisms

• Message authentication
• To ensure that a message is not modified during
  transmission (message integrity)
• How can this be implemented on a network?

63
User Authentication

• Authentication is the process of validating the
  identity of a user (individuals or computing
  devices).
• Methods used for authenticating a human user fall
  in 3 categories
• Something the user knows (e.g., a password)
• Something the user has (e.g., an identification
  card)
• Something the user is (e.g., a biometric like
  fingerprint)

64
Managing EC Security (cont.)

• Methods of securing EC
• Authentication system
• Access control mechanism
• Passive tokens
• Active tokens

65
Authentication

• Authentication system System that identifies the
  legitimate parties to a transaction, determines
  the actions they are allowed to perform, and
  limits their actions to only those that are
  necessary to initiate and complete the transaction

66
Authentication (cont.)

• Access control mechanism Mechanism that limits
  the actions that can be performed by an
  authenticated person or group

67
Authentication (cont.)

• Passive tokens Storage devices (e.g., magnetic
  strips) used in a two-factor authentication
  system that contain a secret code

68
Authentication (cont.)

• Active tokens Small, stand-alone electronic
  devices in a two factor authentication system
  that generate one-time passwords

69
User Authentication

• Biometric authentication
• A biometric is a feature measured from the human
  body distinguishing enough to be used for
  authentication.
• Biometrics can be classified into two groups
• Acquired biometrics, e.g.,
• Handwritten signature
• Keystroke dynamics
• Innate biometrics, e.g.,
• Fingerprint
• Eye (iris/retina) scan
• Dental imprints
• Hand geometry
• DNA

70
Biometric Controls

• Biometric systems Authentication systems that
  identify a person by measurement of a biological
  characteristic such as a fingerprint, iris (eye)
  pattern, facial features, or voice

71
Biometric Controls (cont.)

• Physiological biometrics Measurements derived
  directly from different parts of the body (e.g.,
  fingerprints, iris, hand, facial characteristics)
• Behavioral biometrics Measurements derived from
  various actions and indirectly from various body
  parts (e.g., voice scans or keystroke monitoring)

72
Biometric Controls (cont.)

• Fingerprint scanning Measurement of the
  discontinuities of a persons fingerprint,
  converted to a set of numbers that are stored as
  a template and used to authenticate identity
• Iris scanning Measurement of the unique spots in
  the iris (colored part of the eye), converted to
  a set of numbers that are stored as a template
  and used to authenticate identity

73
Biometric Controls (cont.)

• Voice scanning Measurement of the acoustical
  patterns in speech production, converted to a set
  of numbers that are stored as a template and used
  to authenticate identity

74
Biometric Controls (cont.)

• Keystroke monitoring Measurement of the
  pressure, speed, and rhythm with which a word is
  typed, converted to a set of numbers that are
  stored as a template and used to authenticate
  identity this biometric is still under
  development

75

• Extra Slides