Overview of Data Communications Security Concepts Version 1.0 March, 2003 Bill Woodcock Packet Clearing House

Context What to Protect What to Allow Types of Attacks What you can do

Mauritius on the World Stage SAFE cable system Connects to South Africa, India, and Malaysia STM768 total capacity, less than one year old Cyber-city initiative First-class IT hosting facility Regional center for banking and finance Prosperous economy, strong work ethic Already highly educated population New computer education programs

Risks, Costs, and Benefits As Mauritius comes to the world’s attention, both risks and potential benefit increase dramatically. The time to put your house in order is now, before it receives close scrutiny. A well-prepared country will attract business and investors.

What to Protect Physical security Cryptographic security Computing resources Storage (live and backups) Communications and remote access Support (power and cooling) Cryptographic security Hiding content Authenticating parties Protection against replays and man-in-the-middle Code execution and permissions Open source code (patches) Execution space and account structure Social engineering

What to Protect Define tight perimeters Compartmentalize Modularize Physical: secure rooms, not buildings People: delete old accounts, manage permissions Compartmentalize Firewalls: one per class of device Code: executes chroot with own uid Permissions: role accounts, sudo Modularize Code: auditable building-blocks, not monoliths People: cross-train and understand overall goals Physical: standard components, spares, images Firewalls: central management of rulesets, namespace

What to Allow Differential threshold of difficulty to authorized and unauthorized users How to authenticate? “Something you have and something you know.” Password, phrase, PIN, or challenge-response Key, token, modulator, or biometric property

What to Allow Permissions depend upon context Temporal: Physical: Some hours of the day or days of the week While they’re employed or contracted Physical: While they’re present in a facility Together with another user Complex: Depending upon pattern of prior actions

Types of Attacks Physical: Infrastructure destruction Theft of components Wiretapping and eavesdropping Vandalism

Types of Attacks Communications: Man-in-the-middle Denial of service Port scanning Stepping-stones and impersonation

Types of Attacks Code: Incompetence and DoS against labor Buffer overflows Permissions bootstrapping Worms and self-replication Viri and trojan horses Zombies and 0wn3rship

Types of Attacks People: Social engineering Co-option Moles or plants Inside jobs

What Can You Do? Define clear and specific policy 90% of security is human resources 9% is host configuration 1% is firewalls Only create policy which can be followed Only create policy which can be enforced

Why CEOs Must Lead Most serious security compromises come from within the organization. Most are failures of morale, alertness, or moral fiber on the part of employees. These problems can only be solved through good corporate culture. CEOs set the moral and ethical example which guide the corporation’s culture.

Bill Woodcock woody@pch.net www.pch.net/resources/papers/security-concepts