MINS 217

Module 1

What is Information Security

Information

• Defined in the text as: “Knowledge obtained from investigation, study, or instruction, intelligence, news, facts…”

• Information is value added knowledge

Security

• Defined in the text as: “Freedom from danger, safety; freedom from fear or anxiety”

• Security means both being, and feeling, safe.

Physical Security

• Physical security has been deemed important for many years and has many constructs in place.– Locks on doors– Safes/vaults– Police/fire departments– Bars on windows– Moats around the castle

Communications Security

• The FDHVDU FLSKHU is an example of an early encryption system developed because messengers were being captured in transit.

• Germany used the Enigma to encrypt messages to their military. See U-571 or try out the Enigma simulator at http://www.ugrad.cs.jhu.edu/~russell/classes/enigma/

Computer/Network Security

• Orange Book – Defined and linked functionality and assurance requirements for specific levels of certification. (NT 4 was C2 certified)

• Red Book – Added network functionality but still linked functionality and assurance.

Information Security

• None of the security efforts (physical communications, computer, or network) mentioned so far have been successful. Why?

Information Security

• Each of the efforts represented a part of a larger problem that must be managed as a whole.

Information Security

• There are no standards at this time to which an organization can certify its systems and be assured of security. Why?– Rapid rate of technological growth continues

making security standards obsolete before they can be implemented.

– It is extremely difficult to prove a system, or even a component of the system, is secure.

Information Security

• Every organization is left to develop a security plan that protects its assets.

• There are many products that can be used in developing a plan, but no blueprint to determine which products to use, and how to weave them together.

• Security is an on-going process with no established finish line.

Information Security Includes

• Virus Protection

• Access Controls

• Firewalls/VPN’s

• Smart Cards

• Biometrics

• Intrusion Detection

• Policy Management

Information Security Includes

• Vulnerability Scanning

• Encryption

• Physical Security

• Etc…

MINS 217

Module 2

Types of Attacks

Types of Attacks

• Access

• Modification

• Denial of Service (DoS)

• Repudiation

Access Attacks

• Snooping – Looking for information by sequentially searching through files

• Eavesdropping – Listening in on a conversation (i.e. sniffer programs)

• Interception – Actively inserting a device into the communications link. The information may or may not then be passed on the legitimate destination.

Modification Attacks

• Changes – Changing information such as a grade or bank account balance on a system.

• Insertion – New information is added to the system.

• Deletion – Removal of existing information

DoS

• Denial of access to:– Information – cutting off access to the

information the user is seeking– Applications – cutting off access to a needed

application– Systems – cutting off access to information by

bringing down the entire system– Communications – cutting off access to

information by saturating or bringing down a communications link

Repudiation

• Masquerading – impersonating a person or device (i.e. taking an IP and/or Ethernet address of a device)

• Denying an event – disputing the accuracy of records which is more easily done in an electronic environment.

MINS 217

Module 3

MINS 217

Module 3

Hacker Techniques

Hacker’s Motivations

• Difference between hackers and crackers.

• Challenge

• Greed

• Vandalism

Historical Hacking Techniques

• Open Sharing (NFS, SMB, Gnutella)

• Bad Passwords (Morris Worm on pg. 41)

• Programming Flaw

• Social Engineering

• Buffer Overflow

• DoS

• DDoS

Advanced Hacking Techniques

• Sniffing switched networks

• Traffic redirection

• ARP spoofing

• DNS spoofing

• IP/MAC spoofing

• Etc…

Malicious Code

• Viruses - programs that piggyback on other programs

• Trojan Horses – A self-contained program that looks like something useful or desirable such as I LOVE YOU.

• Worms – Self-replicating programs (Recall the Morris Worm from module 1. Newer worms such as CodeRed and Slapper continue to be increasingly sophisticated)

MINS 217

Module 4

Information Security Services

Confidentiality

• The confidentiality services should ensure that information is only available to authorized users and applies to:– Files– Information in transmission– Traffic flow

Integrity

• Integrity is required for the prevention of both modification and repudiation attacks.

• The integrity service should ensure the correctness of the information and applies to:– Files– Information in transmission

Availability

• Availability ensures that information and services are accessible. There are several services that work to protect availability:– Backups– Fail-over– Disaster recovery

Accountability

• Should be referred to as AAA – Authentication, Authorization and Accounting. The author has left the second two functions out of this section.

• Authentication – Ensure the identity of the user via something they know, have, or are.

• Authorization – Ensure the user can only access services to which they have been granted access privileges.

• Audit/Accounting – Track each action on the system to the corresponding user.

MINS 217

Module 5

Legal Issues in Information Security

U.S. Criminal Law

• Interesting background can be found on the geocities website at www.access.gpo.gov/uscode/index.html

• 18 US Code 1030 is the primary statute under which computer crime is prosecuted and is fairly vague saying any intentional access of a computer without authorization to do so is illegal.

• Statute also states that the offender must have obtained information that should have been protected, and that the damage is at least $5,000.

More U.S. Criminal Law

• There are extensions to 18 US Code 1030– 18 US Code 1029 – possessing more then 15

counterfeit credit cards is illegal with or without $5,000 in damages.

– 18 US Code 2319 sets a $1,000 limit for copyright infringements (delete Napster)

– 18 US Code 2511 sets rules on interception– Patriot Act (Uniting and Strengthening America by

Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act of 2001) – Increases sentences and relaxes constraints on 18 US Code 1030

Sarbanes-Oxley

• Sarbanes-Oxley Act of 2002 – requires corporate officers to certify that they are responsible for establishing, maintaining, and regularly evaluating the effectiveness of the internal controls of the issuers of the firms financial statements.

• Places a “watch-dog” requirement on auditors that still seems to not be clearly defined.

Privacy Issues

• HIPAA (Health Insurance Portability and Accountability Act)– Sets rules for the standardization and privacy

of health information– To whom does this apply????– Rules in effect as of April 15, 2003– Compliance required for many organizations

by April 15, 2005.

Privacy Continued

• Graham-Leach-Bliley (Financial Services Modernization Act)– Sets rules on the privacy and protection of

customer information

MINS 217

Module 6

Policy

Why is Policy Important?

• Policy provides a common understanding in terms of the goals for security:– Determines how security should be

implemented– Puts everyone on the same page

• See caution regarding education on the top of pg. 117

Defining Policies

• Policies should clearly define its:– Purpose – why was it created– Scope – to whom/what it applies– Responsibility – to whom does the policy

apply

Information Policy

• Information should be classified as to restricted, sensitive, public etc…– Defines protections on each class of info– Defines who has access to each class of info– Defines responsibilities for those with access– Sets rules on how info is transmitted– Determines who, and in what situations, info

can be destroyed– Determines acceptable method for destruction

Security Policy

• Defines requirements for security on computing and communications systems– Authentication/Authorization/Account… (audit)– Access control– Network connectivity

• Importance of VPN’s to wireless and remote conn.

– Encryption– Waivers

Computer Use Policy

• Defines acceptable use of computers– Computers are company owned and only

company computers can be used– Ownership of information– Only company business can be performed– No expectation of privacy!!!!

Other Policies

• Internet Use

• Email

• File storage

• Backups

• Etc…

User Management Policy

• New employee procedure– User profiles are very important here

• Transferred employee• Employee termination

– Critical to remove all of an employees access immediately

– This is difficult to impossible if the user has multiple user names on separate systems that are autonomously managed

System Administration

• Software upgrades

• Vulnerability scans

• Log reviews

• System monitoring

• Backups– Exactly what is backed up, where the backups

are stored, and policies on access to these backups are all important issues

Incident Response Procedure

• In the past this was too often overlooked and incidents were dealt with in an ad-hoc fashion. Objectives to consider:– Protecting the organizations information– Protecting the organizations systems– Restoring operations– Prosecuting offenders– Reducing bad publicity (reducing bad publicity

too often results in an unwillingness to prosecute)

Incident Response Procedure

• Meeting the objectives for a successful incident response requires many processes working effectively:– Identifying the event– Escalation– Information control (reputations are at stake)– Response– Clear authority– Documentation control

Disaster Recovery Plans

• These can be very brief or very complex depending on the organization and include single system failures up to site-wide events.

• An organization may choose to have an entire “hot site” prepared.

• One particular company requires each employee to have a home office. The companies services can be operated out of an ISP site.

Business Continuity Plans

• Business continuity addresses how the company will operate during a crisis:– Some services may be suspended– Some services must remain functional

• Levi Strauss during the 1989 San Francisco quake

– Every business function must have a plan, even if that plan is simply to suspend the function

Creating Policy

• Defining priorities (What is important?)

• Defining acceptable behavior

• Identifying stakeholders

• Defining insightful outlines (RFC 2196)

• Develop the policy with security driving the process

Deploying Policy

• Gain buy-in – this is a huge process as this policy truly affects everyone in the organization. This requires active and visible support from the top of the organization down.

• Education is critical as employees must understand policy and the reasons behind it before they will truly buy in. Policy is better as an education tool then a club.

MINS 217

Module 7

Managing Risk

Risk

• Risk is the potential for loss that requires protection.

Vulnerability

• A vulnerability is a potential avenue of attack. This can be application or operating system related. It can also be a custodian leaving the computer room door open during cleaning

Threat

• Threat - an action or event that may violate the security of the system.

• Figure 7-1, page 145 in course text

Agents

• Agents are people wishing to do harm to an organization.

• Agents require:– Access– Knowledge– Motivation

Access

• The agent must have access to the organization, this access may include– Physical access to resources or facilties– Network access– Access in transit between two sources

Knowledge

• The agent must have some type of useful knowledge such as:– User ID’s– Passwords– File names or locations– Phone numbers– IP addresses– Security procedures

Motivation

• Challenge

• Greed

• Malicious intent

Agents to Consider

• Employees• Ex-employees• Hackers• Commercial rivals• Terrorists• Criminals• Suppliers• Customers

Risk

• Threat x Vulnerability = Risk

• Either threats or vulnerabilities alone are not a risk. Only when combined is a risk created.

Identifying Vulnerabilities

• At least one good place to start looking for vulnerabilities is at the entrance and exit points (physical and electronic) within the organization.

• Some organizations have determined it’s too difficult to accomplish this task.

Identifying Vulnerabilities

• Some examples:– Internet connections– Remote access points– Connections to other organizations– Physical access to facilities– User access points– Wireless access points

Identifying Threats

• Much more difficult to manage threat identification then vulnerabilities

• Imagine if you had to do this for Microsoft

Countermeasures

• Firewalls

• Anti-virus software

• Access controls

• Two-factor authentication systems– Biometrics– Smart cards

• Badges

• Encryption

Module 8

Information Security Process

Cost of Reactive Security

• Total Cost of Security = Cost of Incident + Cost of Countermeasures

Cost of Proactive Security

• Cost of Information Security = Cost of Countermeasures• Cost of the Incident + Cost of Countermeasures >> Cost of

Countermeasures

• Caveat - The information above comes from the author and does not reflect that of the instructor

• While improving security does reduce the likelihood of an incident, it cannot remove the possibility

• Trying to remove the possibility of an incident cannot be accomplished cost effectively

Five Phases of Info Security

• Assessment

• Policy

• Implementation

• Training

• Audit

• See Figure 8-1 on page 163

Information Assessment

• Determine the value of information assets• Determine the threats (all four categories)• Determine current operational vulnerabilities• Determine information asset risk exposure• Determine appropriate measures to reduce risk

to an appropriate level• Provide a foundation for a security plan

Five Types of Assessment

• System-level vulnerability assessment

• Network-level risk assessment

• Organization-wide risk assessment

• Audit

• Penetration test

Assessment Information Sources

• Three primary sources– Employee interview– Document review– Physical inspection

• Examine areas shown on page 165

Network

• Some of the issues you should inspect and document are shown on pages 165 and 166

• Read the paragraphs at the bottom of page 166 for some important insights

Physical Security

• Issues like locks on doors to who has the keys.

• Power

• Disaster Notification

• There are many pertinent issues outlined on pages 167 and 168.

Policies and Procedures

• See page 168 for a list of policies and procedures to inspect

• Note these lists are not comprehensive. Rather they simply provide an example of the types of issues to investigate.

• Also, read the “Ask the Expert” cut out at the top of page 171.

Attitude/Adherance

• Attitude– The “tone at the top” is a reference to the

emphasis top management places on security

• Adherence– Both the intended as well as the actual

security environment must be monitored. It’s not enough to say “this” is the way it’s supposed to be done.

Employees

• Many different areas in the chapter refer to the importance of employees knowing and understanding the security policies.

• It is also critical to ensure that employees buy into the importance of security policies and understand their individual roles and responsibilities.

Develop Policy

• Information policy

• Security policy

• Use policy

• Backup policy

• Account management policy

• Incident handling procedure

• Disaster recovery plan

Implement Security

• Security reporting systems• Authentication systems• Internet security

– Firewalls, VPNs, etc…

• IDS• Encryption• Physical Security• Staff

Awareness Training

• Executives

• Developers

• Administrators

• Employees

• Security staff

Conduct Audits

• Policy adherence audits

• Periodic and new project assessment audits

• Penetration tests

Develop Security Awareness

• Regular emails (perhaps with quizzes)

• Back of badges

• Posters on walls

• Periodic classes

Module 10

Firewalls

Application-Level Firewalls

• Also referred to as proxy firewalls

• All connections terminate on the firewall

• The firewall accepts the connection, analyzes the packet, and if appropriate opens a new connection and forwards to the destination– IP address of the original sender??– Does this violate RIAA proposed legislation??

Packet-Filtering Firewalls

• Connections do not terminate on the firewall.

• The firewall inspects the packet in transit and decides whether to pass it along.

• Stateful inspection allows a “reflexive” feature. (iptables)

• Almost layer 7 protocol independent– FTP

Firewall Design

• Single firewall– Users in front of firewall– Users behind firewall

• Dual firewall– DMZ

Module 11

Virtual Private Networks

Benefits of a Private Network

• Information remains in an organizations system (computers and network links)

• Reduced or perhaps no access limitations for users at remote sites.

• Instantaneous access to applications without the need for increased security relative to users at the local site

Drawbacks of a Private Network

• Cost

• Cost

• Cost

• Cost

• Implementation time

Definition of VPN

• Traffic is encrypted to prevent eavesdropping

• Endpoints authenticate and authorize session before data is exchanged

• Multiple protocols are supported

• Connection is point to point (Note that the session may travel a very diverse network)

Characteristics of VPN’s

• Encryption– Strong enough to ensure security for as long

as the information is valuable

• End point authentication

• Different application-level protocols

• Point-to-point– Access-lists determine “tunnels” and ensure

that each tunnel has appropriate encryption

User VPN’s

• VPN’s between an individual workstation and a central server (campus solution)

• The central server requires an authentication process

• The VPN allows the organization to limit the protocols, files, or systems that can be accessed based on user profile.

• The VPN can also allow use of protocols not otherwise available. (campus MS)

Issues with User VPN’s

• Users can have simultaneous access to networks while connected via VPN to an organizations network.

• If users are infected with a virus or trojan and are allowed access on ports like 135-139 then they can spread the virus.

• Both issues above show that security on the end-users computer must be trustworthy.

Managing User VPN’s

• Organizations must be careful what access is allowed via VPN’s

• If security constraints on VPN connected devices is to be minimal then:– Multi-factor authentication should be used– The organization must directly support the

computers that are allowed to make a VPN connection to the organizations network.

Site VPN

• Allows the secure connection of two networks across the Internet.

• Generally accomplish by border routers or firewalls near the border of the network.

• The router/firewall uses access lists including the sending and receiving IP addresses to determine which packets to drop into the “tunnel”.

Benefits of Site VPN’s

• Considerable cost savings when compared with leased-line alternatives.

• No need to install VPN client software on each users computer.

• Strict limitations can be placed on access making site VPN’s a highly desirable technology for inter-company connections.

Issues with Site VPN’s

• Site VPN’s extend the organizations security perimeter.

• The level of access allowed via the VPN must be balanced by the security integrity of the remote network.

• Key updates must be managed carefully

Managing Site VPN’s

• If edge routers are used as a VPN peering point then CPU loads on the router must be much more carefully managed.

• Access lists must be created with care. Mistyping a single digit in an access list can cause the organization to be sending critical data in the clear. An IDS should be used to ensure data is encrypted.

Module 12

Encryption

Basic Encryption Concepts

• Confidentiality – Hides information either in transit or in storage.

• Integrity – Encryption can be used to identify changes to information in transit, or in storage.

• Accountability – Encryption can be used to authenticate the sender of information and prevent repudiation attacks.

Encryption Terms

• Plaintext – Information in its original form.

• Ciphertext – Information that has been obfuscated by the encryption algorithm.

• Algorithm – The method used to obfuscate the original information.

• Key – The information used to authorize the conversion of data.

Encryption Terms continued

• Encryption – The process of changing from plaintext to ciphertext.

• Decryption – The process of changing from ciphertext to plaintext.

• Cryptography – The use of encryption to conceal data.

• Cryptanalysis – Analyzing cryptographic algorithms to identify weaknesses.

Attacks Against Encryption

• Through weaknesses in the algorithm

• Through brute force against the key

• Through weaknesses in the surrounding system.

Private Key Encryption

• Commonly referred to as symmetric key encryption

• Must use the same key at both the sender and receiver

• Enigma

• http://www.ugrad.cs.jhu.edu/~russell/classes/enigma/

Substitution Ciphers

• Used for many years (Caesar Cipher)

• Susceptible to statistical frequency based attacks and others

• Generally considered weak

One Time Pads

• Theoretically the only unbreakable encryption system.

• The weakness is in the fact that the pad must be carried by the user and is therefore subject to confiscation.

• The cost of creating and distributing pads leads organizations to reuse them. This creates the potential for failure.

Symmetric Encryption Standards

• DES• 3DES• AES (Rijndael)

• IDEA• RC5• Skipjack• Blowfish

Public Key Encryption

• Commonly referred to as an “asymmetric encryption algorithm”

• Uses a key pair with one key encrypting the message and another key decrypting

• Having one key does not allow you to determine the other key

• Provides encryption and authentication services

PKI Encryption Algorithms

• Diffie-Hellman

• RSA

• Elgamal

• Digital Signature Algorithm

• Elliptical Curve Algorithm

Digital Signatures

• In many ways far superior to pen and paper signatures

• Allow for authentication of the source and also tests for modifications

Key Management

• The author refers to key management as “the bane of all encryption systems”

• Generating good keys and distributing them can be difficult and expensive

• Whom should we trust to be the keeper of the keys?

Certificate Authority

• The CA is a central keeper of the keys.

• There may be differing levels of CA’s within an organization.

• The organization may also choose to trust other CA’s (Verisign) to authenticate keys from outside sources.

Module 13

Intrusion Detection

Early forms of Intrusion Detection

• Guards and dogs– Both dogs and guards provided a means to

identify that something was happening and attempt to stop it.

• Alarm system– Businesses have found that a simple sticker

in the window can deter thieves.– A computer based IDS is a little more difficult

as it’s harder to tell the bad guys (packets intended to do harm) from the good.

Intrusion Detection Systems

• Host based– On a host looking for attacks against that

particular host

• Network based– On a separate device that watches network

traffic looking for indications of an attack

Host-based IDS

• There are many different types of sensors that are part of the IDS watching for different types of patterns– Log analyzers– Signature-based sensors– System call analyzers– Application behavior analyzers– File integrity analyzers

Network-based IDS

• Places network interface into promiscuous mode

• Advantages– Completely hidden– Monitors traffic to large number of devices

• Disadvantages– Who writes the rule set and how do you keep

it up to date?– High bandwidth can cause packet misses

Configuring an IDS

• Define the goals of the IDS and what to monitor. This must include thresholds etc…

• Attack recognition

• Policy monitoring

• Policy enforcement

• Incident response