THE NEED FOR NETWORK SECURITY Thanos Hatziapostolou

PRESENTATION OBJECTIVES Understand information security services Be aware of vulnerabilities and threats Realize why network security is necessary What are the elements of a comprehensive security program The Need for Web Security

TRENDS FOR INFORMATION More information is being created, stored, processed and communicated using computers and networks Computers are increasingly interconnected, creating new pathways to information assets The threats to information are becoming more widespread and more sophisticated Productivity, competitiveness, are tied to the first two trends Third trend makes it inevitable that we are increasingly vulnerable to the corruption or exploitation of information INFORMATION IS THE MOST VALUABLE ASSET The Need for Web Security

Information Security Services Confidentiality Integrity Authentication Nonrepudiation Access Control Availability The Need for Web Security

Information Security Services Confidentiality Maintaining the privacy of data Integrity Detecting that the data is not tampered with Authentication Establishing proof of identity Nonrepudiation Ability to prove that the sender actually sent the data Access Control Access to information resources are regulated Availability Computer assets are available to authorized parties when needed SERVICES Confidentiality Integrity Authentication Ensures that the origin of a message is correctly identified, with an assurance that the identity is not false Nonrepudiation Neither the sender nor the receiver of a message is able to deny the transmission Access Control Availability The Need for Web Security

The Need for Web Security What Is The Internet? Collection of networks that communicate with a common set of protocols (TCP/IP) Collection of networks with no central control no central authority no common legal oversight or regulations no standard acceptable use policy “wild west” atmosphere The Need for Web Security

Why Is Internet Security a Problem? updated 2000-08-07 Security not a design consideration Implementing change is difficult Openness makes machines easy targets Increasing complexity This sub-section addresses why Internet security is a problem and how it came to be that we are depending on an infrastructure with fundamental vulnerabilities. The Need for Web Security

Common Network Security Problems Network eavesdropping Malicious Data Modification Address spoofing (impersonation) ‘Man in the Middle’ (interception) Denial of Service attacks Application layer attacks The Need for Web Security

Security Incidents are Increasing High Sophistication of Hacker Tools Technical Knowledge Required Quote From Cisco System :” When most people read about Internet hacking incidents, they get the impression that these are highly complex, technical attacks that takes a genius to create. Reality is that the really smart people first come up with these highly complex, technical attacks, but they share the information and the tools required to pull off the attack on the Internet. The “open sharing” of hacking information and tools allows individuals with minimal technical knowledge to duplicate the attack. Often, it is as easy as downloading the attack tool from the Internet and launching it against targets. You don’t need to know anything other than how to run the attack tool. The bottom line is that it doesn’t take a genius to successfully attack systems and networks, it just takes someone downloading attack tools.” Low 1980 1990 2000 -from Cisco Systems The Need for Web Security

The Need for Web Security HACKED WWW HOMEPAGES CIA HOMEPAGE DOJ HOMEPAGE USAF HOMEPAGE The Need for Web Security 11/29/96

Problem is Worsening Code Red 60000 50000 40000 30000 20000 10000 Anna Kournikova 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 Melissa & ILOVEYOU Badtrans Tequila Nimba Internet Security Violations Good Times Jerusalem Michelangelo Source: CERT® Coordination Center Carnegie Mellon The Need for Web Security

The Need for Web Security VIRUSES Risk Threat Discovered Protection TROJ_SIRCAM.A New !! Latest DAT W32.Navidad 11/03/2000 11/06/2000 W95.MTX 8/17/2000 8/28/2000 W32.HLLW.QAZ.A 7/16/2000 7/18/2000 VBS.Stages.A 6/16/2000 6/16/2000 VBS.LoveLetter 5/04/2000 5/05/2000 VBS.Network 2/18/2000 2/18/2000 Wscript.KakWorm 12/27/1999 12/27/1999 W32.Funlove.4099 11/08/1999 11/11/1999 PrettyPark.Worm 6/04/1999 6/04/1999 Happy99.Worm 1/28/1999 1/28/1999 The Need for Web Security

The Need for Web Security Consider that… 90% of companies detected computer security breaches in the last 12 months 59% cited the Internet as the most frequent origin of attack 74% acknowledged financial losses due to computer breaches 85% detected computer viruses Source: Computer Security Institute The Need for Web Security

The Need for Web Security WHO ARE THE OPPONENTS? 49% are inside employees on the internal network 17% come from dial-up (still inside people) 34% are from Internet or an external connection to another company of some sort HACKERS The Need for Web Security

The Need for Web Security HACKER MOTIVATIONS Money, profit Access to additional resources Experimentation and desire to learn “Gang” mentality Psychological needs Self-gratification Personal vengeance Emotional issues Desire to embarrass the target The Need for Web Security

The Need for Web Security Internet Security? Malicious Code Session Hijacking Viruses Trojans Worms Replay Attack Port Scanning Buffer Overflows Denial of Service Man-in-the-middle Spoofing The Need for Web Security

What Do People Do When They Hear All These? Take the risks! But there are solutions Ignoring the situation is not one of them The Need for Web Security 6

THE MOST COMMON EXCUSES No one could possibly be interested in my information Anti-virus software slows down my processor speed too much. I don't use anti-virus software because I never open viruses or e-mail attachments from people I don't know. So many people are on the Internet, I'm just a face in the crowd. No one would pick me out. I'm busy. I can't become a security expert--I don't have time, and it's not important enough The Need for Web Security

SANS Five Worst Security Mistakes End Users Make Opening unsolicited e-mail attachments without verifying their source and checking their content first. Failing to install security patches-especially for Microsoft Office, Microsoft Internet Explorer, and Netscape. Installing screen savers or games from unknown sources. Not making and testing backups. Using a modem while connected through a local area network. The Need for Web Security

SECURITY COUNTERMEASURES THREE PHASE APPROACH PROTECTION DETECTION RESPONSE The Need for Web Security

ELEMENTS OF A COMPREHENSIVE SECURITY PROGRAM Principles Have Good Passwords Use Good Antiviral Products Use Good Cryptography Have Good Firewalls Have a Backup System Audit and Monitor Systems and Networks Have Training and Awareness Programs Test Your Security Frequently INTRUSION DETECTION SYSTEM Immediate alerts on security-relevant activities Statistical analyses to establish norms Alerts on variations from norms The Need for Web Security

The Need for Web Security CRYPTOGRAPHY Necessity is the mother of invention, and computer networks are the mother of modern cryptography. Ronald L. Rivest Symmetric Key Cryptography Public Key Cryptography Digital Signatures The Need for Web Security

The Need for Web Security Firewall A system or group of systems that enforces an access control policy between two networks. Visible IP Address Internal Network PC Servers Host The Need for Web Security

The Need for Web Security

The Need for Web Security THANK YOU I have questions… The Need for Web Security