Mumtaz Ali Rajput mumtaz.ali@superior.edu.pk +92 – 301- 4949 409 INFORMATION SECURITY – WEEK 2 Mumtaz Ali Rajput mumtaz.ali@superior.edu.pk +92 – 301- 4949 409

Information Security Aspects of Security Threat and attack Security Mechanisms Encryption and Decryption Caesar Cipher Information Security (IS)

Information Security (IS) Introduction 11/21/2018 Introduction Information Security (IS)

Information Security (IS) Aspects of Security Security attack Any action that compromises the security of information owned by an organization. Security mechanism A process that is designed to detect, prevent or recover from a security attack. Security service Services that enhances the security of the data processing systems and the information transfers of an organization. These services are intended to counter security attacks, and they make use of one or more security mechanisms to provide the service. The OSI security architecture focuses on security attacks,mechanisms,and services. Information Security (IS)

Information Security (IS) Threat and attack A threat is a possible potential danger that might exploit a vulnerability. Exploit is a sequence of commands that take advantage of a vulnerability in order to cause damage Vulnerability is applied to a weakness in a system which allows an attacker to violate the integrity of that system An attack is an unlawful attempt on a system security that drives from an intelligent threat. Information Security (IS)

Information Security (IS) Security Attacks Any action that compromises the security of information owned by an organization Information security is about how to prevent attacks, or failing that, to detect attacks on information-based systems have a wide range of attacks Classification according to X.800 Passive attack Active attack A threat is a possible potential danger that might exploit a vulnerability. Is a sequence of commands that take advantage of a vulnerability in order to cause vulnerability is applied to a weakness in a system which allows an attacker to violate the integrity of that system. Information Security (IS)

Information Security (IS) Passive attack Obtaining message content Traffic analysis Passive attacks attempt to learn or make use of information from the system but does not affect system resources. By eavesdropping on, or monitoring of, transmissions to: + obtain message contents or + monitor traffic flows ( … opponent could determine the frequency and length of messages being exchange this kind of information maybe helpful in determining the nature of communication that was taking place) Are difficult to detect because they do not involve any alteration of the data. Information Security (IS)

Information Security (IS) Active attack Masquerade Replay previous messages Modify messages in transit Denial of service Active attacks attempt to alter system resources or affect their operation. By modification of data stream to: + masquerade of one entity as some other + replay previous messages (as shown above in Stallings Figure 1.4b) + modify messages in transit + denial of service Active attacks present the opposite characteristics of passive attacks. Whereas passive attacks are difficult to detect, measures are available to prevent their success. On the other hand, it is quite difficult to prevent active attacks absolutely, because of the wide variety of potential physical,software,and network vulnerabilities. Instead, the goal is to detect active attacks and to recover from any disruption or delays caused by them. Information Security (IS)

Information Security (IS) Threats and Attacks Snooping: the interception(Capture) of information intended for someone else during its transmission over a communication channel. Alice Bob Eve Information Security (IS)

Communication channel Threats and Attacks Alteration: unauthorized modification of information. Example: the man-in-the-middle attack, where a network stream is intercepted, modified, and retransmitted. encrypt decrypt ciphertext C shared secret key plaintext M plaintext M′ Communication channel Sender Recipient Attacker (intercepting) ciphertext C′ Information Security (IS)

Information Security (IS) Threats and Attacks Denial-of-service: the interruption or degradation of a data service or information access. Example: email spam, to the degree that it is meant to simply fill up a mail queue and slow down an email server. Alice Information Security (IS)

Information Security (IS) Threats and Attacks Masquerading: the fabrication of information that is purported(suppose) to be from someone who is not actually the author. “From: Alice” (really is from Eve) Information Security (IS)

Information Security (IS) Threats and Attacks Repudiation: the denial of a commitment or data receipt. This involves an attempt to back out of a contract or a protocol that requires the different parties to provide receipts acknowledging that data has been received. Information Security (IS)

Information Security (IS) Threats and Attacks Correlation and traceback: the integration of multiple data sources and information flows to determine the source of a particular data stream or piece of information. Bob Information Security (IS)

Information Security (IS) Security Mechanisms Specific security mechanisms: Encipherment: use of mathematical algorithm to transform data into a form that is not understandable Digital signatures : use of cryptographic transformation on a data unit that allows a recipient of the data unit to prove that source and integrity of data unit Access controls: mechanisms that enforce access rights to resources Data integrity: Information Security (IS)

Information Security (IS) Cont. Authentication exchange mechanism used to ensure the integrity of an entity by mean of information exchange Traffic padding insertion of bits in a data stream to frustrate traffic analysis attempt Routing control enable selection of physically secure route for data transmission Notarization use of trusted third party to ensure certain properties of data exchange Information Security (IS)

Examples of Security Violations A transmit a file (containing sensitive information) to B. C, who is not authorized to read the file, is able monitor the transmission Administrator D sends a message to computer E for updating an authorization file. F intercept the message, alters its content to add or delete entries, and then forwards the message to E. E accept the message and update the authorization file Rather than intercept, F constructs its own message and send it to E Information Security (IS)

Information Security (IS) Cont. An employee X is fired. X is able to intercept the message that is send to invalidate the employee account. X is able to delay the message long enough to access the sensitive information from the server. X then forward the message and the action taken. This delay may go unnoticed A message is send from a customer to a stockbroker. Afterwards, investment loose value and customer denies the sending message. Information Security (IS)

Encryption and Decryption The message M is called the plaintext. Alice will convert plaintext M to an encrypted form using an encryption algorithm E that outputs a ciphertext C for M. encrypt decrypt ciphertext plaintext shared secret key Communication channel Sender Recipient Attacker (eavesdropping)

Encryption and Decryption As equations: C = E(k, M) M = D(k, C) The encryption and decryption algorithms are chosen so that it is infeasible for someone other than Alice and Bob to determine plaintext M from ciphertext C. Thus, ciphertext C can be transmitted over an insecure channel that can be eavesdropped by an adversary. Information Security (IS)

Information Security (IS) Cryptosystem The set of possible plaintexts The set of possible ciphertexts The set of encryption keys The set of decryption keys The correspondence between encryption keys and decryption keys The encryption algorithm to use The decryption algorithm to use Information Security (IS)

Information Security (IS) Caesar Cipher Replace each letter with the one “three over” in the alphabet. Information Security (IS) Public domain image from http://commons.wikimedia.org/wiki/File:Caesar3.svg

Information Security (IS) Caesar Cipher m e t a f r p y h w d i u s b For each plaintext p, substitute the ciphertext letter C as follows C = E(3, p) = (p + 3) mod 26 Generic form of Caesar algorithm is C = E(k, p) = (p + k) mod 26 p = D(k, C) = (C - k) mod 26 k ranges from 1 to 25 Involves replacing each letter of the alphabet with the letter standing three places further Information Security (IS)

Information Security (IS)

Cryptanalysis of Caesar Cipher Why cryptanalysis on Caesar cipher, because En/-decryption algorithm is known Only 25 keys to try Language is known and easily recognizable Mostly algorithm is known but the key set is very large, e.g. triple DES 3.7 x 1050 keys Information Security (IS)

Information Security (IS)