SECURITY Prepared By: Dr. Vipul Vekariya.

2 S ECURITY Secure system will control, through use of specific futures, access to information that only properly authorized individuals or processes operating on their behalf will have access to read, write, create or delete.

C OMPUTER S ECURITY T RIAD Three key objectives are at the heart of computer security Confidentiality Integrity Availability

S ECURITY THREATS The major threats to security in any computing environment. 1) Unauthorized use of service(tapping) 2) Unauthorized disclosure of information(disclosure) 3) Unauthorized alteration or deletion of information (amendment) 4) Unauthorized fabrication of information(Fabrication) 5) Denial of service to authorized user(Denial) 4

A TTACKS ON S ECURITY Authentication Trap doors Line tapping Improper access control Trojan horse Ordinary software bomb Timed software bomb Logical software bomb Worm virus 5

P RINCIPLE OF S ECURITY D ESIGN Public design: the design of security system should not be secret. Assume that penetrator will know about it. Least privilege: every process should be given the least privileges that are necessary for execution. Explicit demand: No access right should be granted to a process as a default. Each subject should have demand the access rights explicitly. Continuous verification: the access rights should be verified at every request from subject. Simple design: the design of the security should be simple and uniform. User acceptance: user should not have to spend most of time to protect their files. Multiple condition: system should design in such a fashion that access depends on fulfilling more than one condition.

A UTHENTICATION Authentication is a process of verifying whether person is valid user or not. There are two types of authentication that are possible. Verification of user logging in to centralized system. Authentication of computer that are required to cooperate in a network or distributed environment.

A UTHENTICATION Basis for most type of access control and accountability Two steps Identification Verification

M EANS OF A UTHENTICATION Traditionally listed as three factors Something you know Password, PIN Something you have Card, RFID badge Something you are Biometrics

P ASSWORD -B ASED A UTHENTICATION Determines if user is authorized to access the system Determines privileges for the user Choice of password Password length Salting technique is used for password Additional password Continuous challenge Force password change One time password Disable user

H ASHED P ASSWORDS Widely used technique for storing passwords Secure against a variety of cryptanalytic attacks

UNIX P ASSWORD S CHEME

T OKEN -B ASED A UTHENTICATION ( A RTIFACT BASE ) Objects that a user possesses for the purpose of user authentication are called tokens. Examples include Memory cards Smart cards

S TATIC B IOMETRIC A UTHENTICATION Includes Facial characteristics Fingerprints Hand geometry Retinal pattern Based on pattern recognition, technically complex and expensive.

D YNAMIC B IOMETRIC A UTHENTICATION Patterns may change Includes Iris Signature Voice Typing rhythm

A CCESS C ONTROL Dictates what types of access are permitted, under what circumstances, and by whom. Discretionary access control: control access based on the identity of requestor and on access rule. Mandatory access control: control access based on comparing security labels with security clearance. Role-based access control: control access based on the role that user have.

E XTENDED A CCESS C ONTROL M ATRIX

R OLE B ASED A CCESS C ONTROL Effective implementation of the principle of least privilege Each role should contain the minimum set of access rights needed for that role. A user is assigned to a role that enables him or her to perform what is required for that role. But only while they are performing that role

R OLES

A CCESS C ONTROL M ATRIX R EPRESENTATION OF RBAC