Basic Security Concepts Threats and Attacks Computer Criminals Defense Techniques Security Planning

An Example School district employee uses disk with student names and SSNs in a student computer lab Student later removes information from the lab Anderson District 5 – T. L. Hanna HS The State, August 26, 2004 7/18/2019 CSCE 522 - Eastman - Fall 2006

Security Terminology Threat: potential occurrence that can have an undesired effect on the system Vulnerability: characteristics of the system that makes it possible for a threat to potentially occur Attack: action of malicious intruder that exploits vulnerabilities of the system Risk: measure of the possibility of security breaches and severity of the damage Control: protective measure that reduces a vulnerability 7/18/2019 CSCE 522 - Eastman - Fall 2006

Threat or Menace? Hackers: Threat or Menace? Instant Messaging: Threat or Menace? SUVs: Threat or Menace? Colons: Threat or Menace? Mary Worth: Threat or Menace? 7/18/2019 CSCE 522 - Eastman - Fall 2006

Superman Vulnerability Threat Attack Control Lead shielding Kryptonite Possible exposure to kryptonite Attack Use of kryptonite by villain Control Lead shielding 7/18/2019 CSCE 522 - Eastman - Fall 2006

Roadkill Vulnerability Threat Attack Control Various Animals on road Possible collision with animal Attack Unwise road crossing by animal Control Various 7/18/2019 CSCE 522 - Eastman - Fall 2006

Assessment of Risk Probability of Collision Damage to car/occupants Species of animal Location Time and date Damage to car/occupants Minor or none Total destruction/death Damage to animal Minor scratches Death 7/18/2019 CSCE 522 - Eastman - Fall 2006

Different Animals Moose Deer Frog Possible high damage to car/occupants Low probability in South Carolina Deer High probability in South Carolina Frog Little or no damage to car/occupants 7/18/2019 CSCE 522 - Eastman - Fall 2006

Possible Controls for Deer Defensive driving Knowledge of deer behavior Deer crossing signs Fences Diversionary feeding areas Expanded hunting seasons Roadside reflectors Whistles and other noisemakers Deer activated flashing lights 7/18/2019 CSCE 522 - Eastman - Fall 2006

Back to Computer Security And Now ... Back to Computer Security

Sources of Threats Errors of users Dishonest insider Disgruntled insider Outsiders Natural disasters Computer system failure 7/18/2019 CSCE 522 - Eastman - Fall 2006

Types of Threats Disclosure threat – dissemination of unauthorized information Alteration threat – incorrect modification of information Denial of service threat – access to a system resource is blocked 7/18/2019 CSCE 522 - Eastman - Fall 2006

Impact of Attack: What? Interruption – an asset is destroyed, unavailable or unusable (availability) Interception – unauthorized party gains access to an asset (confidentiality) Modification – unauthorized party tampers with asset (integrity) Fabrication – unauthorized party inserts counterfeit object into the system (integrity) 7/18/2019 CSCE 522 - Eastman - Fall 2006

Methods of Attack: How? Passive attacks: Active attacks: Eavesdropping Monitoring Active attacks: Masquerade – one entity pretends to be a different entity Replay – passive capture of information and its retransmission Modification of messages – legitimate message is altered Denial of service – prevents normal use of resources 7/18/2019 CSCE 522 - Eastman - Fall 2006

Computer Crime Any crime that involves computers or aided by the use of computers U.S. Federal Bureau of Investigation: reports uniform crime statistics 7/18/2019 CSCE 522 - Eastman - Fall 2006

Computer Criminals Amateurs: regular users, who exploit the vulnerabilities of the computer system Motivation: easy access to vulnerable resources Crackers: attempt to access computing facilities for which they do not have the authorization Motivation: enjoy challenge, curiosity Career criminals: professionals who understand the computer system and its vulnerabilities Motivation: personal gain (e.g., financial) 7/18/2019 CSCE 522 - Eastman - Fall 2006

Methods of Defense Prevent: block attack Deter: make the attack harder Deflect: make other targets more attractive Detect: identify misuse Tolerate: function under attack Recover: restore to correct state 7/18/2019 CSCE 522 - Eastman - Fall 2006

Information Security Planning Organization analysis Risk management Mitigation approaches and their costs Security policy Implementation and testing Security training and awareness 7/18/2019 CSCE 522 - Eastman - Fall 2006

System Security Engineering Specify System Architecture Identify and Install Safeguards Threats, Attacks, Vulnerabilities?? Prioritize Vulnerabilities Estimate Risk Risk is acceptably low 7/18/2019 CSCE 522 - Eastman - Fall 2006

Risk Management Risk analysis Risk avoidance Risk mitigation Risk acceptance Risk transference 7/18/2019 CSCE 522 - Eastman - Fall 2006

Risk Analysis Methods Risk Analysis Threats and relevance Potential for damage Likelihood of exploit 7/18/2019 CSCE 522 - Eastman - Fall 2006

Assets-Threat Model Threats compromise assets Threats have a probability of occurrence and severity of effect Assets have values Assets are vulnerable to threats Threats Assets 7/18/2019 CSCE 522 - Eastman - Fall 2006

Computing Risks Risk: expected loss from the threat against an asset ALE = AV*EF*ARO ALE – annualized loss expectancy AV -- value of asset EF -- exposure factor (fraction lost) ARO – annualized rate of occurrence 7/18/2019 CSCE 522 - Eastman - Fall 2006

A Simple Example Threat: Power surge Vulnerability: Power supply AV – computer valued at $1,000 EF – 10% loss if power surge SLE -- $100 (AV*EF) ARO – 2 (twice a year) ALE -- $200 (SLE*ARO) 7/18/2019 CSCE 522 - Eastman - Fall 2006

Cost/Benefit Analysis Benefit = (ALE * Life) - Cost Assume Surge protector costs $25 Surge protector lasts 5 years ALE = $200 Benefit = ($200 * 5) - $25 = $975 Buy the surge protector!!! 7/18/2019 CSCE 522 - Eastman - Fall 2006

System-Failure Model Estimate probability of highly undesirable events Risk: likelihood of undesirable outcome Threat Undesirable outcome System 7/18/2019 CSCE 522 - Eastman - Fall 2006

Risk Acceptance Certification Accreditation How well the system meets the security requirements (technical) Accreditation Management’s approval of automated system (administrative) 7/18/2019 CSCE 522 - Eastman - Fall 2006

Mitigation Approach Security safeguards Protection Assurance 7/18/2019 CSCE 522 - Eastman - Fall 2006

Access Control Methodologies Next Class Access Control Methodologies Who? What? When? How? 7/18/2019 CSCE 522 - Eastman - Fall 2006