Download Lecture1

Introduction to Cyber Security
May 29, 2015
Lecture #1
Dr. Bhavani Thuraisingham
5/25/2017 11:30
13-2
Outline
0 Cyber Security Modules
0 Risk and Governance
0 Security Architectures
0 Access Control
0 Cryptography
0 Network Security
0 Digital Forensics
0 Data Management Security
5/25/2017 11:30
13-3
C. I.A.
0 Confidentiality: Preventing from unauthorized disclosure
0 Integrity: Preventing from unauthorized modification
0 Availability: Preventing denial of service
5/25/2017 11:30
13-4
Ten Major Modules of Cyber Security
0 Information Security and Risk Management
0 Access Control
0 Security Architecture and Design
0 Cryptography
0 Network Security
0 Applications Security (aka Data and Applications Security)
0 Legal Regulations, Compliance and Investigations (aka Digital
Forensics)
0 Physical and Environmental Security
0 Business Continuity Planning
0 Operations Security
5/25/2017 11:30
13-5
Information Security and Risk Management
0 Security Management
0 Security Administration
0 Organizational Security Model
0 Information Risk Management
0 Risk Analysis
0 Policies, Standards, Guidelines, Procedures
0 Information Classification
0 Layers of Responsibility
0 Security Awareness Training
5/25/2017 11:30
13-6
Access Control
0 Security Principles
0 Identification, Authentication, Authorization, Accountability
0 Access Control Models
0 Access Control techniques
0 Access Control Administration
0 Access Control Methods
0 Access Control Types
0 Accountability
0 Access Control practices
0 Access Control Monitoring
0 Threats to Access Control
5/25/2017 11:30
13-7
Security Architecture and Design
0 Computer Architecture
0 Systems Architecture
0 Security Models
0 Security Modes of Operation
0 Systems Evaluation Methods
0 Open vs. Closed Systems
0 Enterprise Architecture
0 Security Threats
5/25/2017 11:30
13-8
Physical and Environmental Security
0 What is Physical Security
0 Planning Process
0 Protecting assets
0 Internal Support Systems
0 Perimeter Security
0 Other aspects
5/25/2017 11:30
13-9
Telecommunications and Network Security
0 Open Systems Interconnection Reference Model
0 TCP/IP
0 Types of Transmission
0 LAN Networking
0 Routing Protocols
0 Networking Devices
0 Networking services and protocols
0 Intranets and Extranets
0 Metropolitan Area networks
0 Remote access
0 Wireless technologies
0 Rootkits
5/25/2017 11:30
13-10
Cryptography
0 History, Definitions and Concepts
0 Types of Ciphers
0 Methods of Encryption
0 Type of Asymmetric Systems
0 Message Integrity
0 PKI
0 Key Management
0 Link / End-to-end Encryption
0 Email standards
0 Internet security
0 Attacks
5/25/2017 11:30
13-11
Legal Regulation and Compliance Investigation
0 Cyber law and Cyber crime
0 Intellectual property law
0 Privacy
0 Liability and Ramifications
0 Digital Forensics and Investigations
0 Ethics
5/25/2017 11:30
13-12
Applications Security
0 Database Security
0 Software and applications security issues
0 Secure systems development
0 Application development and security
0 Object-oriented systems and security
0 Distributed computing and security
0 Expert systems and security
0 Web security
0 Mobile code
0 Patch management
5/25/2017 11:30
13-13
Business Continuity
0 Data Storage and Recovery
0 Storage Area Networks
0 Business Continuity Planning
0 Disaster Planning
5/25/2017 11:30
13-14
Operations Security
0 Role of the Operations Department
0 Administrative Management
0 Assurance Levels
0 Configuration management
0 Media Controls
0 Data Leakage
0 Network and Resource Availability
0 Mainframes
0 Email Security
0 Vulnerability testing
5/25/2017 11:30
13-15
Information Governance and Risk Management
0 Security Management, Administration and Governance
0 Policies, Standards, Guidelines, Procedures
0 Information Classification
0 Roles and Responsibilities
0 Risk Management and Analysis
0 Best Practices
5/25/2017 11:30
13-16
Security Management, Administration and
Governance
0 Develop the information security strategy in support of business
strategy and direction.
0 Obtain senior management commitment and support
0 Ensure that definitions of roles and responsibilities throughout the
enterprise include information security governance activities.
0 Establish reporting and communication channels that support
information security governance activities.
0 Identify current and potential legal and regulatory issues affecting
information security and assess their impact on the enterprise.
0 Establish and maintain information security policies that support
business goals and objectives.
0 Ensure the development of procedures and guidelines that support
information security policies.
0 Develop business case for information security program
investments.
5/25/2017 11:30
13-17
Security Management, Administration and
Governance
0 Information security (ISec) describes activities that relate to the
protection of information and information infrastructure assets
against the risks of loss, misuse, disclosure or damage. Information
security management (ISM) describes controls that an organization
needs to implement to ensure that it is sensibly managing these
risks.
0 The risks to these assets can be calculated by analysis of the
following issues:
0 Threats to your assets. These are unwanted events that could cause
the deliberate or accidental loss, damage or misuse of the assets
0 Vulnerabilities. How susceptible your assets are to attack
0 Impact. The magnitude of the potential loss or the seriousness of the
event.
5/25/2017 11:30
13-18
Risk Management and Analysis
0 Risk is the likelihood that something bad will happen that causes
harm to an informational asset (or the loss of the asset). A
vulnerability is a weakness that could be used to endanger or cause
harm to an informational asset. A threat is anything (man made or
act of nature) that has the potential to cause harm.
0 The likelihood that a threat will use a vulnerability to cause harm
creates a risk. When a threat does use a vulnerability to inflict harm,
it has an impact. In the context of information security, the impact is
a loss of availability, integrity, and confidentiality, and possibly other
losses (lost income, loss of life, loss of real property). It should be
pointed out that it is not possible to identify all risks, nor is it
possible to eliminate all risk. The remaining risk is called residual
risk.
5/25/2017 11:30
13-19
Risk Managementg and Analysis
0 A risk assessment is carried out by a team of people who have
knowledge of specific areas of the business. Membership of the
team may vary over time as different parts of the business are
assessed.
0 The assessment may use a subjective qualitative analysis based on
informed opinion (scenarios), or where reliable dollar figures and
historical information is available, the analysis may use quantitative
analysis
0 For any given risk, Executive Management can choose to accept the
risk based upon the relative low value of the asset, the relative low
frequency of occurrence, and the relative low impact on the
business. Or, leadership may choose to mitigate the risk by
selecting and implementing appropriate control measures to reduce
the risk. In some cases, the risk can be transferred to another
business by buying insurance or out-sourcing to another business.
5/25/2017 11:30
13-20
Roles and Responsibilities
0 Internal Roles
- Executive Management; Information System Security
Professionals; Owners: Data and System Owners; Custodians
- Operational Staff; Users; Legal, Compliance and Privacy
Officers; Internal Auditors; Physical Security Officers
0 External Roles
- Vendors and Supplies; Contractors; Temporary Employees;
Customers; Business Partners; Outsourced Relationships;
Outsourced Security
0 Human Resources
- Employee development and management; Hiring and
termination; Signed employee agreements; Education
5/25/2017 11:30
13-21
Information Classification
0 It is essential to classify information according to its actual value
and level of sensitivity in order to deploy the appropriate level of
security.
0
A system of classification should ideally be:
- simple to understand and to administer
- effective in order to determine the level of protection the
information is given.
- applied uniformly throughout the whole organization (note:
when in any doubt, the higher, more secure classification should
be employed).
5/25/2017 11:30
13-22
Information Classification
0 With the exception of information that is already in the public
domain, information should not be divulged to anyone who is not
authorized to access it or is not specifically authorized by the
information owner.
0 Violations of the Information Classification Policy should result in
disciplinary proceedings against the individual.
0 Number of information classification levels in an organization should
be a manageable number as having too many makes maintenance
and compliance difficult.
5/25/2017 11:30
13-23
Security Best Practices
0 Job Rotation
0 Separation of Duty
0 Security Awareness training
0 Ethics Education
5/25/2017 11:30
13-24
Security Architecture and Design
0 Computer Architecture
0 Operating System
0 System Architecture
0 Security Architecture
0 Security Models
0 Security Models of Operation
0 System Evaluation Methods
0 Open Vs Closed Systems
0 Some security threats
5/25/2017 11:30
13-25
System Architecture
0 The software components that make up the system
0 Middleware
0 Database management
0 Networks
0 Applications
5/25/2017 11:30
13-26
Security Architecture
0 Security critical components of the system
0 Trusted Computing Base
0 Reference Monitor and Security Kernel
0 Security Perimeter
0 Security Policy
0 Least Privilege
5/25/2017 11:30
13-27
Trusted Computing Base
0 The trusted computing base (TCB) of a computer system is the set of
all hardware, firmware, and/or software components that are critical
to its security, in the sense that bugs or vulnerabilities occurring
inside the TCB might jeopardize the security properties of the entire
system. By contrast, parts of a computer system outside the TCB
must not be able to misbehave in a way that would leak any more
privileges than are granted to them in accordance to the security
policy.
0 The careful design and implementation of a system's trusted
computing base is paramount to its overall security. Modern
operating systems strive to reduce the size of the TCB so that an
exhaustive examination of its code base (by means of manual or
computer-assisted software audit or program verification) becomes
feasible.
5/25/2017 11:30
13-28
Reference Monitor and Security Kernel
0 In operating systems architecture, a reference monitor is a
tamperproof, always-invoked, and small-enough-to-be-fully-testedand-analyzed module that controls all software access to data
objects or devices (verifiable).
0 The reference monitor verifies that the request is allowed by the
access control policy.
0 For example, Windows 3.x and 9x operating systems were not built
with a reference monitor, whereas the Windows NT line, which also
includes Windows 2000 and Windows XP, was designed to contain a
reference monitor, although it is not clear that its properties
(tamperproof, etc.) have ever been independently verified, or what
level of computer security it was intended to provide.
5/25/2017 11:30
13-29
Security Models
0 Bell and LaPadula (BLP) Confidentiality Model
0 Biba Integrity Model (opposite to BLP)
0 Clark Wilson Integrity Model
0 Other Models
- information Flow Model
- Non Interference Model
- Graham Denning Model
- Harrison-Ruzzo-Ullman Model
- Lattice Model
5/25/2017 11:30
13-30
Bell and LaPadula
0 A system state is defined to be "secure" if the only permitted access modes
of subjects to objects are in accordance with a security policy. To determine
whether a specific access mode is allowed, the clearance of a subject is
compared to the classification of the object (more precisely, to the
combination of classification and set of compartments, making up the
security level) to determine if the subject is authorized for the specific access
mode. The clearance/classification scheme is expressed in terms of a lattice.
The model defines two mandatory access control (MAC) rules and one
discretionary access control (DAC) rule with three security properties:
0 The Simple Security Property - a subject at a given security level may not
read an object at a higher security level (no read-up).
0 The *-property (read "star"-property) - a subject at a given security level must
not write to any object at a lower security level (no write-down). The *property is also known as the Confinement property.
0 The Discretionary Security Property - use of an access matrix to specify the
discretionary access control.
5/25/2017 11:30
13-31
Access Control
0 Access Control Overview
0 Identification, Authentication, Authorization, Accountability
0 Single Sign-on and Kerberos
0 Access Control Models
0 Access Control Techniques and Technologies
0 Access Control Administration
0 Access Control Monitoring: Intrusion Detection
0 Threats to Access Control
5/25/2017 11:30
13-32
Access Control Overview
0 Access control is a system which enables an authority to control
access to areas and resources in a given physical facility or
computer-based information system.
0 In computer security, access control includes authentication,
authorization and audit. It also includes measures such as physical
devices, including biometric scans and metal locks, hidden paths,
digital signatures, encryption, social barriers, and monitoring by
humans and automated systems.
0 In any access control model, the entities that can perform actions in
the system are called subjects, and the entities representing
resources to which access may need to be controlled are called
objects (see also Access Control Matrix). Subjects and objects
should both be considered as software entities and as human users
5/25/2017 11:30
13-33
Access Control
0 Access control models used by current systems tend to fall into one
of two classes: those based on capabilities and those based on
access control lists (ACLs).
0 In a capability-based model, holding an unforgeable reference or
capability to an object provides access to the object
0 Access is conveyed to another party by transmitting such a
capability over a secure channel.
0
In an ACL-based model, a subject's access to an object depends on
whether its identity is on a list associated with the object
5/25/2017 11:30
13-34
Identification, Authentication, Authorization
0 Access control systems provide the essential services of
identification and authentication (I&A), authorization, and
accountability where:
0 identification and authentication determine who can log on to a
system, and the association of users with the software subjects that
they are able to control as a result of logging in;
0 authorization determines what a subject can do;
0 accountability identifies what a subject (or all subjects associated
with a user) did.
5/25/2017 11:30
13-35
Single Sign-On
0 Single sign-on (SSO) is a property of access control of multiple,
related, but independent software systems.
0 With this property a user logs in once and gains access to all
systems without being prompted to log in again at each of them.
0 Single sign-off is the reverse property whereby a single action of
signing out terminates access to multiple software systems.
0 As different applications and resources support different
authentication mechanisms, single sign-on has to internally
translate to and store different credentials compared to what is used
for initial authentication.
5/25/2017 11:30
13-36
Single Sign-on Kerberos
0 Kerberos is a computer network authentication protocol, which
allows nodes communicating over a non-secure network to prove
their identity to one another in a secure manner.
0 It is also a suite of free software published by MIT that implements
this protocol. Its designers aimed primarily at a client–server model,
and it provides mutual authentication — both the user and the server
verify each other's identity. Kerberos protocol messages are
protected against eavesdropping and replay attacks.
0 Kerberos builds on symmetric key cryptography and requires a
trusted third party, and optionally may use public-key cryptography
by utilizing asymmetric key cryptography during certain phases of
authentication
5/25/2017 11:30
13-37
Access Control Techniques
0 Role based access control
0 Constrained user interfaces
0 Access control Matrix
0 Content dependent access control
0 Attribute-based access control
5/25/2017 11:30
13-38
Cryptography
0 Cryptography
- Mathematical manipulation of information that prevents the
information being disclosed or altered
0 Cryptanalysis
- Defeating the protected mechanisms of cryptography
0 Cryptology
0 Study of Cryptography and Cryptanalysis
0 Goals
- Confidentiality, Integrity, Authenticity, Non-repudiation, Access
Control, Make compromise difficult
5/25/2017 11:30
13-39
Process
0 Input (also called Plaintext or Clear Text)
0 Cryptosystem (device that performs encryption/decryption)
0 Cryptographic Algorithms (Mathematical functions)
0 Output (Cipher text or Cryptogram)
0 Key (Crypto variable)
5/25/2017 11:30
13-40
Symmetric Key Cryptography
0 Symmetric-key algorithms are a class of algorithms for cryptography
that use trivially related, often identical, cryptographic keys for both
decryption and encryption.
0 The encryption key is trivially related to the decryption key, in that
they may be identical or there is a simple transformation to go
between the two keys.
0 The keys, in practice, represent a shared secret between two or more
parties that can be used to maintain a private information link.
0 The disadvantage of symmetric cryptography is that it presumes two
parties have agreed on a key and been able to exchange that key in a
secure manner prior to communication.
0 This is a significant challenge. Symmetric algorithms are usually
mixed with public key algorithms to obtain a blend of security and
speed.
5/25/2017 11:30
13-41
Public Key Cryptography
0 Public-key cryptography is a cryptographic approach which involves
the use of asymmetric key algorithms instead of or in addition to
symmetric key algorithms.
0 Unlike symmetric key algorithms, it does not require a secure initial
exchange of one or more secret keys to both sender and receiver.
0 The asymmetric key algorithms are used to create a mathematically
related key pair: a secret private key and a published public key. Use
of these keys allows protection of the authenticity of a message by
creating a digital signature of a message using the private key,
which can be verified using the public key.
0 It also allows protection of the confidentiality and integrity of a
message, by public key encryption, encrypting the message using
the public key, which can only be decrypted using the private key.
5/25/2017 11:30
13-42
Public Key Cryptography
0 Public key cryptography is a fundamental and widely used
technology around the world. It is the approach which is employed
by many cryptographic algorithms and cryptosystems.
0
It underlies such Internet standards as Transport Layer Security
(TLS) (successor to SSL)
0 Uses asymmetric key algorithms, where the key used to encrypt a
message is not the same as the key used to decrypt it. Each user
has a pair of cryptographic keys—a public key and a private key.
0 The private key is kept secret, whilst the public key may be widely
distributed.
0 Messages are encrypted with the recipient's public key and can only
be decrypted with the corresponding private key. The keys are
related mathematically, but the private key cannot be feasibly
derived from the public key.
5/25/2017 11:30
13-43
Network Security
0 Network security consists of the provisions made in an
underlying computer network infrastructure, policies
adopted by the network administrator to protect the
network and the network-accessible resources from
unauthorized access, and consistent and continuous
monitoring and measurement of its effectiveness
0 Network security starts from authenticating the user,
commonly with a username and a password; Once
authenticated, a firewall enforces access policies such as
what services are allowed to be accessed by the network
users.
0 Though effective to prevent unauthorized access, this
component may fail to check potentially harmful content
such as computer worms or Trojans being transmitted over
the network.
5/25/2017 11:30
13-44
Network Security
0 Anti-virus software or an intrusion prevention system (IPS) help
detect and inhibit the action of such malware; An anomaly-based
intrusion detection system may also monitor the network and traffic
for unexpected (i.e. suspicious) content or behavior and other
anomalies to protect resources logged for audit purposes and for
later high level analysis.
0 Honeypots essentially decoy network-accessible resources, could
be deployed in a network as surveillance and early-warning tools.
Techniques used by the attackers that attempt to compromise these
decoy resources are studied during and after an attack to keep an
eye on new exploitation techniques.
0 A Botnet is a collection of software agents, or robots, that run
autonomously and automatically. The term is most commonly
associated with malicious software, but it can also refer to a network
of computers using distributed computing software.
5/25/2017 11:30
13-45
Digital Forensics
0 Digital forensics is about the investigation of crime including
using digital/computer methods
0 More formally: “Digital forensics, also known as computer
forensics, involved the preservation, identification, extraction,
and documentation of computer evidence stored as data or
magnetically encoded information”, by John Vacca
0 Digital evidence may be used to analyze cyber crime (e.g.
Worms and virus), physical crime (e.g., homicide) or crime
committed through the use of computers (e.g., child
pornography)
0 Computers are attacked (Cyber crime); Computers are used
to commit a crime (child predators, Embezzlement, Fraud);
Computers are used to solve a crime (Homicide)
5/25/2017 11:30
13-46
Steganography and Digital Watermarking
0 Steganography is about hiding information within other
information
- E.g., hidden information is the message that terrorist may
be sending to their pees in different parts of the worlds
- Information may be hidden in valid texts, images, films
etc.
- Difficult to be detected by the unsuspecting human
0 Steganalysis is about developing techniques that can analyze
text, images, video and detect hidden messages
- May use data mining techniques to detect hidden patters
0 Steganograophy makes the task of the Cyber crime expert
difficult as he/she ahs to analyze for hidden information
- Communication protocols are being developed
5/25/2017 11:30
13-47
Steganography and Digital Watermarking - II
0 Digital water marking is about inserting information without
being detected for valid purposes
- It has applications in copyright protection
- A manufacturer may use digital watermarking to copyright
a particular music or video without being noticed
- When music is copies and copyright is violated, one can
detect two the real owner is by examining the copyright
embedded in the music or video
5/25/2017 11:30
13-48
Summary
0 CIA
0 Overview of the 10 CISSP Cyber Security Modules
0 Some related topics