Information Security Tanachat Arayachutinan

Outline Background and Introduction Types of Cybersecurity Attacks Physical security Logical security

Introduction - The Internet has given firms access to customers and other business partners. - It also given criminals access to corporations and individuals. - In recent years, we can say that the number of cyber attacks has grown rapidly

Introduction (cont.)

What is Data Security? The protection of information and its critical elements Protecting data from unauthorized access and data corruption through out its lifecycle. Using various methods to make sure that data is kept confidential and safe as well as preventing the loss or corruption of data.

Security Goals Three widely accepted elements or areas of focus - Confidentiality - Integrity - Availability

Security Goals - Confidentiality Confidentiality is the ability to hide information from those people unauthorized to view it -people cannot read sensitive information

Security Goals - Integrity Integrity is about information stored in a database being consistent and un-modified. -Ensures that it is edited by only authorized persons

Security Goals - Availability Availability is important to ensure that the information concerned is readily accessible to the authorized viewer at all times. -Data and information systems are available when required.

Types of Cyber security Attacks

Type of Attack Malicious code: includes execution of viruses, worms, Trojan horses, and active Web scripts with which to destroy or steal information

Type of Attack Back door: gaining access to system or network using known discovered access mechanism Password crack: attempting to reverse calculate a password Brute force: trying every possible combination of options of a password

Type of Attack Denial-of-service (DoS): attacker sends large number of requests to a target. May result in system crash or inability to perform ordinary functions Distributed denial-of-service (DDoS): coordinated stream of requests is launched against target from many locations simultaneously

Prevent of Threats At a minimum, an organization’s security policy should cover the following: Physical security Personal security Operations security Communications security Network security Information security (Logical Security)

Physical security

Physical security - definition Physical security addresses design, implementation, and maintenance to protect physical resources of an organization This includes protection from fire, flood, natural disasters, burglary, theft, vandalism and terrorism.

Physical security - definition Purpose of Physical Security Deter - intruders Delay - intrusion Detect - activities Assess - situation Respond - situation

Controls for Protecting the Secure Facility Walls, fencing, and gates GuardsDogs Locks and keys Electronic monitoring Alarms and alarm systems Mantraps

Controls for Protecting the Secure Facility Mission impossible We must consider more security option to protect data

Logical Security

Logical Security “The use of mechanisms or software used to protect information against unauthorized access”

Logical Security Cryptography Handshaking Firewall Intrusion detection system Anti Virus software Access levels of data (read, write and execute)

Cryptography - definition cryptography refers to secure information and communication techniques derived from mathema tical concepts and algorithm

Cryptography - definition Plaintext = ordinary readable text E.g. “hello”, ” ”, ”meet at 5” Encryption = using algorithm to protect data Ciphertext = data which has been transformed to hide information content E.g. ”XVYY UVZ“

Types of Cryptographic Functions - Secret key functions - Public key functions - Hash functions

Secret key functions plaintext ciphertextplaintext ciphertext decryption encryption key Using a single key for encryption/decryption. The plaintext and the ciphertext having the same size. Also called symmetric key cryptography

Secret key functions - Caesar cipher The Caesar cipher is one of the earliest known and simplest ciphers. It is a type of substitute cipher in which each letter in the plaintext is 'shifted’ to a certain number of places down the alphabet.

Secret key functions - Caesar cipher Encryption Decryption

Secret key functions - Caesar cipher Encryption & Decryption shifted a certain number of places down the alphabet.

Secret key functions - Caesar cipher Key = N (14) Ciphertext = NGGN P Plain text = A T T A C K X A - Z =

Secret key functions - Caesar cipher It could be easily decrypted if you know the key Easy to decrypt by trying every possible alphabet from A-Z (1-26)

Secret key functions - Vigenère cipher A method of encrypting alphabetic text by using a series of interwoven Caesar ciphers, based on the letters of a keyword. It is a form of polyalphabetic substitution. Improve Caesar ciphers with longer set of key

Secret key functions - Vigenère cipher Encryption Decryption

Secret key functions - Vigenère cipher Plaintext = CALCUL Key = MATHSM Ciphertext = O A E J M X

Secret key functions Well known Symmetric algorithm - Data Encryption Standard DES Brute-forced - Triple Data Encryption Standard DES Unbreakable - Blowfish Unbreakable - Advance Encryption Standard (AES) Unbreakable

Secret key Public key functions Public key functions The encryption key is public, and it is different from the decryption key which is kept secret (private)encryption keydecryption key The decryption key is known only to authorized parties. It’s also call asymmetric encrypted.

Secret key Public key functions RSA (Rivest–Shamir–Adleman) is one of the first public-key cryptosystems and is widely used for secure data transmission -Handshaking process -Client and Server authentication process

Secret key Public key functions

Secret key Public key functions - RSA STEP 1 p = initial value, q = initial value, n = p x q,  (n) = (p-1)(q-1) p = 41, q = 61, n = 2501  (n) = 2400

Secret key Public key functions - RSA STEP 2 Choose d such that *(gcd) = greatest common divisor and compute By choosing d = 2087 we get e = 23

Secret key Public key functions - RSA STEP 2 Public key (n, e) = (2501,23) Private key (n, d) = (2501,2087)

Secret key Public key functions - RSA Public key (n, e) = (2501,23)

Secret key Public key functions - RSA STEP 4 Message = “ H E L L O” One common conversion process uses the ASCII alphabet:

Secret key Public key functions - RSA STEP 4 Message = “ H E L L O” W =

Secret key Public key functions - RSA Public key (n, e) = (2501,23)

Secret key Public key functions - RSA Public key (n, e) = (2501,23)

Secret key Public key functions - RSA Public key (n, e) = (2501,23) Private key (n, d) = (2501,2087)

Secret key Public key functions - RSA STEP 5 Decryption Message = Public key (n, e) = (2501,23) Private key (n, d) = (2501,2087) Message = “H E L L O”

public key (n, e) = (2501,23) Private key (n,d) = (2501,2087) Message = H E L L O Cipher = 599,024,1733,1733,519 Message = H E L L O

Hash Function -A hash function is any function that can be used to map data functiondata -The size of output is fixed -always maps the same input to the same output. -one-way property it is easy to generate a code given a message, but virtually impossible to generate a message given a code.

Hash Function Integrity check – Hash file/message - Error Detection - Prevent forgery, modification Authentication - Signature: hash data to shorten (for efficiency) then encrypt with public key algorithm

Real world application of cryptography Secret key functions / Symmetric functions - Open SSL - RAR, WinZip, UltraISO - WhatsApp

Real world application of cryptography Secret key functions / Symmetric functions - Open SSL - RAR, WinZip, UltraISO - WhatsApp

Real world application of cryptography Public key functions - Windows certification (RSA) - Digital key exchange

Real world application of cryptography Hash function - Authentication NOT SECURE

Real world application of cryptography Hash function - Authentication Tomorrow1996 MD5 3ab78ee9c03c1a12d1c35a216c06a1ae

Real world application of cryptography Hash function - Authentication SECURE

Hash function - Authentication

Conclusion In recent years, we can say that the number of cyber attacks has grown rapidly Data must be protecting all the time Physical security is as important as logical security Cryptography can protect data confidential and integrity

Reference Randall J. Boyle, “Corporate Computer Security Third Edition” 2013 Dorothy E. Denning “Cryptography and Data Security” 2011 Berkeley College “Data Security Policy” 2018

Thanks!