Chapter 6 : Network Security Lecture #1-Week 10 Dr.Khalid Dr. Mohannad Information Security CIT 460 Information Security Dr.Khalid Dr. Mohannad 1

Outline:  Network Threats:  Eavesdropping ( تسلل )  Spoofing ( محاكاة )  Modification  Denial of Service  Malicious code  Network Security Techniques:  Firewalls  Virtual Private Networks  Antivirus  Intrusion Detection  Private PGP, S/MIME 2 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Network Threats - Eavesdropping  An Eavesdropping attack only passively observe messages.  Protocols defend against Eavesdropping attacks by using encryption for confidentiality.  The attacker is a passive outsider. 3 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Spoofing  What is spoofing?  Context and Security relevant decisions  Phishing  Web spoofing  Remedies 4 CIT 460 Information Security Dr.Khalid Dr. Mohannad

What is Spoofing?  spoofing attack is a situation in which one person or program successfully masquerades as another by falsifying data and thereby gaining an illegitimate advantage 5 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Context  The browser, text, and pictures  Names of objects  Timing of events 6 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Context Spoofing  Spoofed s have upwards of 20% success rates  Costs billions of dollars to the industry  Brand names attacked: 7.Bestbuy 8.Microsoft MSN 9.FBI 1.Citigroup 2.Wachovia 3.Bank of America 4.Yahoo! 5.Ebay 6.Paypal 7 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Consequences  Unauthorized Surveillance  Tampering ( العبث )  Identity theft 8 CIT 460 Information Security Dr.Khalid Dr. Mohannad

What is Web Spoofing?  Creating a shadow copy of the world wide web  Shadow copy is funneled ( تسرب ) through attackers machine  Data tampering ( العبث ) 9 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Chapter 6 : Network Security Lecture #2-Week 10 Dr.Khalid M.O Nahar Information Security 10 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Web Spoofing Attack  The physical world can also be spoofed  Security relevant decisions and context 11 CIT 460 Information Security Dr.Khalid Dr. Mohannad

How does the Attack Work?  Step : 1 Rewriting the URL:  Example:  home.netscape.com home.netscape.com  om 12 CIT 460 Information Security Dr.Khalid Dr. Mohannad

How does the Attack Work? 1. Request Spoof URL Request real URL 3. Real Page contents 4. Change page 5. Spoofed page 13 CIT 460 Information Security Dr.Khalid Dr. Mohannad

How does the Attack Work?  Once attacker server obtains the real URL, it modifies all links  Rewritten page is provided to victim’s browser  This funnels all information  Is it possible to spoof the whole web? 14 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Modification  A Modification attack alters or replaces some messages.  The attacker may change or delete existing information, or insert new information in a modification attack.  Modifying electronic information is easier than modifying information on paper.  Protocols often define against Modification attacks by using encryption for binding. 15 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Denial-of-Service Attacks  Denial-of-Service (DoS) attacks deny the use of resources, information, or capabilities of a system to legitimate users.  Denial of access to information causes the information to be unavailable.  The information may be destroyed, converted into an unusable form, or shifted to an inaccessible location. 16 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Denial-of-Service Attacks  The attacker may target the application that manipulates or displays information.  If an application is unavailable, the organization cannot perform the tasks done by that application.  A common type of DoS attack is bringing down computer systems. 17 CIT 460 Information Security Dr.Khalid Dr. Mohannad

18 What is a Firewall?  a choke point of control and monitoring  interconnects networks with differing trust  imposes restrictions on network services  only authorized traffic is allowed  auditing and controlling access  can implement alarms for abnormal behavior  is itself immune to penetration  provides perimeter defence CIT 460 Information Security Dr.Khalid Dr. Mohannad

19 The main design goals of Firewalls [BELL94]  All traffic from inside to outside and vice versa must pass through the firewall.  Only authorized traffic, as defined by the local security policy will be allowed to pass  The firewall itself is immune to penetration CIT 460 Information Security Dr.Khalid Dr. Mohannad

20 Firewall Limitations  cannot protect from attacks bypassing it  eg sneaker net, utility modems, trusted organisations, trusted services (eg SSL/SSH)  cannot protect against internal threats  eg disgruntled employee  cannot protect against transfer of all virus infected programs or files  because of huge range of O/S & file types CIT 460 Information Security Dr.Khalid Dr. Mohannad

21 Techniques for access control  Service Control Determines the types of Internet services that can be accessed.  Direction Control Determine the direction in which particular service requests may be initiated and allow to flow through the firewall.  User Control Controls access according to which user is attempting to access it.  Behavior Control Control how particular services are used. CIT 460 Information Security Dr.Khalid Dr. Mohannad

What do Firewalls Protect?  Data  Proprietary corporate information  Financial information  Sensitive employee or customer data  Resources  Computing resources  Time resources  Reputation  Loss of confidence in an organization  Intruder uses an organization’s network to attack other sites 22 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Who do Firewalls Guard Against? 23  Internal Users  Hackers  Corporate Espionage  Terrorists  Common Thieves CIT 460 Information Security Dr.Khalid Dr. Mohannad

Firewalls – Packet Filters CIT 460 Information Security Dr.Khalid Dr. Mohannad 24

Firewalls - Application Level Gateway (or Proxy) CIT 460 Information Security Dr.Khalid Dr. Mohannad 25

Firewalls - Circuit Level Gateway CIT 460 Information Security Dr.Khalid Dr. Mohannad 26

Firewall Configurations CIT 460 Information Security Dr.Khalid Dr. Mohannad 27

Virtual Private Networks 28 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Chapter 6 : Network Security Lecture #2-Week 11 Dr.Khalid Dr. Mohannad Information Security 29 CIT 460 Information Security Dr.Khalid Dr. Mohannad

What is VPN?  Virtual Private Network is a type of private network that uses public telecommunication, such as the Internet, instead of leased lines to communicate.  Became popular as more employees worked in remote locations.  Terminologies to understand how VPNs work. 30 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Private Networks vs. Virtual Private Networks  Employees can access the network (Intranet) from remote locations.  Secured networks.  The Internet is used as the backbone for VPNs  Saves cost tremendously from reduction of equipment and maintenance costs.  Scalability 31 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Remote Access Virtual Private Network 32 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Brief Overview of How it Works  Two connections – one is made to the Internet and the second is made to the VPN.  Datagrams – contains data, destination and source information.  Firewalls – VPNs allow authorized users to pass through the firewalls.  Protocols – protocols create the VPN tunnels. 33 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Four Critical Functions  Authentication – validates that the data was sent from the sender.  Access control – limiting unauthorized users from accessing the network.  Confidentiality – preventing the data to be read or copied as the data is being transported.  Data Integrity – ensuring that the data has not been altered 34 CIT 460 Information Security Dr.Khalid Dr. Mohannad

35 Intruders  significant issue for networked systems is hostile or unwanted access  either via network or local  varying levels of competence CIT 460 Information Security Dr.Khalid Dr. Mohannad

36 Intruders  clearly a growing publicized problem  from “Wily Hacker” in 1986/87  to clearly escalating CERT stats  may seem benign, but still cost resources  may use compromised system to launch other attacks CIT 460 Information Security Dr.Khalid Dr. Mohannad

37 Intrusion Techniques  aim to increase privileges on system  basic attack methodology  target acquisition and information gathering  initial access  privilege escalation  covering tracks  key goal often is to acquire passwords  so then exercise access rights of owner CIT 460 Information Security Dr.Khalid Dr. Mohannad

Password Guessing  one of the most common attacks  attacker knows a login (from /web page etc)  then attempts to guess password for it  try default passwords shipped with systems  try all short passwords  then try by searching dictionaries of common words  intelligent searches try passwords associated with the user (variations on names, birthday, phone, common words/interests)  before exhaustively searching all possible passwords  check by login attempt or against stolen password file  success depends on password chosen by user  surveys show many users choose poorly CIT 460 Information Security Dr.Khalid Dr. Mohannad 38

Password Capture  another attack involves password capture  watching over shoulder as password is entered  using a trojan horse program to collect  monitoring an insecure network login (eg. telnet, FTP, web, )  extracting recorded info after successful login (web history/cache, last number dialed etc)  using valid login/password can impersonate user  users need to be educated to use suitable precautions/countermeasures 39 CIT 460 Information Security Dr.Khalid Dr. Mohannad

40 What is the Intrusion Detection  Intrusions are the activities that violate the security policy of system.  Intrusion Detection is the process used to identify intrusions. CIT 460 Information Security Dr.Khalid Dr. Mohannad

Types of Intrusion Detection System(2)  Host-based IDSs  Get audit data from host audit trails.  Detect attacks against a single host  Distributed IDSs  Gather audit data from multiple host and possibly the network that connects the hosts  Detect attacks involving multiple hosts  Network-Based IDSs  Use network traffic as the audit data source, relieving the burden on the hosts that usually provide normal computing services  Detect attacks from network. 41 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Intrusion Detection Techniques  Misuse detection  Catch the intrusions in terms of the characteristics of known attacks or system vulnerabilities.  Anomaly detection  Detect any action that significantly deviates from the normal behavior. 42 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Intrusion Detection  inevitably will have security failures  so need also to detect intrusions so can  block if detected quickly  act as deterrent  collect info to improve security  assume intruder will behave differently to a legitimate user  but will have imperfect distinction between 43 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Audit Records  fundamental tool for intrusion detection  native audit records  part of all common multi-user O/S  already present for use  may not have info wanted in desired form  detection-specific audit records  created specifically to collect wanted info  at cost of additional overhead on system 44 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Statistical Anomaly Detection  threshold detection  count occurrences of specific event over time  if exceed reasonable value assume intrusion  alone is a crude & ineffective detector  profile based  characterize past behavior of users  detect significant deviations from this  profile usually multi-parameter 45 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Audit Record Analysis  foundation of statistical approaches  analyze records to get metrics over time  counter, gauge, interval timer, resource use  use various tests on these to determine if current behavior is acceptable  mean & standard deviation, multivariate, markov process, time series, operational  key advantage is no prior knowledge used 46 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Rule-Based Intrusion Detection  observe events on system & apply rules to decide if activity is suspicious or not  rule-based anomaly detection  analyze historical audit records to identify usage patterns & auto-generate rules for them  then observe current behavior & match against rules to see if conforms  like statistical anomaly detection does not require prior knowledge of security flaws 47 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Rule-Based Intrusion Detection  rule-based penetration identification  uses expert systems technology  with rules identifying known penetration, weakness patterns, or suspicious behavior  rules usually machine & O/S specific  rules are generated by experts who interview & codify knowledge of security admins  quality depends on how well this is done  compare audit records or states against rules 48 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Misuse Detection vs. Anomaly Detection AdvantageDisadvantage Misuse Detection Accurately and generate much fewer false alarm Cannot detect novel or unknown attacks Anomaly Detection Is able to detect unknown attacks based on audit High false-alarm and limited by training data. 49 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Password Guessing  one of the most common attacks  attacker knows a login (from /web page etc)  then attempts to guess password for it  try default passwords shipped with systems  try all short passwords  then try by searching dictionaries of common words  intelligent searches try passwords associated with the user (variations on names, birthday, phone, common words/interests)  before exhaustively searching all possible passwords  check by login attempt or against stolen password file  success depends on password chosen by user  surveys show many users choose poorly 50 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Password Capture  another attack involves password capture  watching over shoulder as password is entered  using a trojan horse program to collect  monitoring an insecure network login (eg. telnet, FTP, web, )  extracting recorded info after successful login (web history/cache, last number dialed etc)  using valid login/password can impersonate user  users need to be educated to use suitable precautions/countermeasures 51 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Password Management  front-line defense against intruders  users supply both:  login – determines privileges of that user  password – to identify them  passwords often stored encrypted  Unix uses multiple DES (variant with salt)  more recent systems use crypto hash function 52 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Managing Passwords  need policies and good user education  ensure every account has a default password  ensure users change the default passwords to something they can remember  protect password file from general access  set technical policies to enforce good passwords  minimum length (>6)  require a mix of upper & lower case letters, numbers, punctuation  block know dictionary words 53 CIT 460 Information Security Dr.Khalid Dr. Mohannad

Managing Passwords  may reactively run password guessing tools  note that good dictionaries exist for almost any language/interest group  may enforce periodic changing of passwords  have system monitor failed login attempts, & lockout account if see too many in a short period  do need to educate users and get support  balance requirements with user acceptance  be aware of social engineering attacks 54 CIT 460 Information Security Dr.Khalid Dr. Mohannad