Network Security (the Internet Security) Kittiphan Techakittiroj engktc@au.ac.th

Goals of Security Ensure the only authorized individuals have access to information Preventing unauthorized creation, alteration, or destruction of data Ensuring that legimate users are not denied access to information Ensuring that resources are used in legitimate way

Classication of Security Communication security signal Computer security user permission file sharing access control

Classication of Security Classication of Security (secondary) Physical security: locks on doors, access badges, biometrics Personnel security: employee screening Administrative security: investigation of security breaches, policy Information/data security: controlling the reporduction of sensitive material Online security: controlling access to online data

Classication of Security Violation Cracking Spoofing Snooping Social Engineering Denial of Service

Classification of Security Violation Cracking Often called as “Hacking” Break through the security by using the knowledge of Software Engineer Computer Network Operating System etc.

Classification of Security Violation: Cracking Cracker few real crackers (super crackers) other cracker used asking expert public available information (WWW) protected by security report patches, updates and hot fixes

Classification of Security Violation Spoofing Act as the others, e.g. fake e-mail: e.g. sending an e-mail by pretending to be other (theoritical can be any name) fake IP: e.g. to gain accesses to the prohibit area http://www.data.com/roundups/images/vpn_servers_figure1.html

Classification of Security Violation Spoofing Starting point for other security violation False information protected by digital signature digital certification

Classification of Security Violation Snooping Steal information during transmission Hardware: Packet Sniffer usually need access to the physical network Software: capture keystroke

Classification of Security Violation Snooping cont. Other: Trashing (happened to credit card number) protected by: encryption security access control

Classification of Security Violation Social Engineering Talking between user and cracker Serious and Common protected by: policy knowledge of users

Classification of Security Violation Denial of Service attack the weakness of the network, e.g. spamming e-mail (mail bomb) spamming web request WinNuke protected by: hot fixes & patches firewall logging system

Benefit of Security Confidentiality Authentication (including access control) Message Digest (including data integrity) protect unknown modification, e.g. virus sampling keywords of the information and do the encryption Non-repudiation: digital signature & certification

Potential Security Risk Lack of safeguards poorly configured & administered systems basic security problems with communication protocol (IP, TCP, UDP) faulty service program basic security problem with service programs (WWW, FTP)

General rules for Protection software current & update fixed & patch & upgrade encrypt sensitive information train user & administrator password & security policy monitoring: 100% monitor --> 100% secure

Standard Technology on Security General rules for Protection Standard Technology on Security firewall: packet filtering & proxy encryption VPN (virtual private network) digital signature & certification SET S-HTTP

Emerging Technology on Security General rules for Protection Emerging Technology on Security encryption IPSec (IP Security Protocol) SSL or TLS (Transport Layer Security) CDSA (Common Data Security Architecture) XBSS (Baseline Security Services) XDAS (Distribute Audit Service) XSSO (Single Sign On)

Reference Books Developing Secure Commerce Applications by Online O’Reilly Web Development Courses (http://208.233.153.3/oreilly/security/westnet: 1999)