INFO498 Information Security Fall 2004 Lesson 1 Barbara Endicott-Popovsky INFO498

Introductions and Overview of the Threat Spectrum

Theoretical Basis How should we think about security?…

Security Services Confidentiality Integrity Availability ƒ(context, needs, customs, laws)

CIA Implementation DefinitionToolsDependencies Confidentiality Concealment of info & resources Hide existence of info & resources Encryption Access control Reliance on system Assumptions & trust about reliance Integrity Trustworthiness of info & resources - Authentication Correctness of data - Data integrity Prevention - Block attempts - Unauth. actions Detection - Block attempts - Unauth. actions Assumptions about source Trust of source Availability Ability to use info & resources System design Statistical models of use Accuracy of statistical models ID anomalies

Security Design Threats Vulnerabilities Controls (Threats + Vulnerabilities  Controls)

Disclosure Unauthorized access to info Deception Acceptance of false data Disruption Interruptions/ prevention of correct action Usurpation Unauthorized control of system/part of system Snooping X Wiretapping X Modification/ Alteration XXX Man-in-the- middle XXX Masquerading/ spoofing XX Repudiation of origin X Denial of receipt X Delay SupportsX Denial of Service SupportsX Threats

Threat Spectrum

Vulnerabilities Software Engineering Traceability of requirements Design Programming Buffer overflow Compilers Networks Wi-Fi Anonymity Standards Others?

Controls Policies Statement of what is/ what is not allowed Document Algorithm Mathematical expression Mechanisms Method, tool, procedure for policy enforcement Technical Non-technical

Controls Software Engineering Applying disciplines Formal methods Programming Encryption Access control Networks Firewalls IDS Access control Others?

3 R Goals DefinitionTools Resistance Prevention Firewalls Authentication Recognition Detection IDS’s Internal integrity checks Recovery Assess & repair Essential services continue to function Incident response SNA analysis Active defense

Trusting Controls Each mechanism designed to implement policies Sum total of mechanisms implement all policy aspects Mechanisms are implemented correctly Mechanisms installed/administered correctly

Software Engineering to the Rescue! Information Assurance Develop detailed specifications of desired behavior Design conforms to specification Proofs that implementation produces desired behavior (procedures/maintenance) Requirements SpecificationDesignImplementation   Prove each line of code ?

Bottom line: You Will Never Own a Perfectly Secure System!!!

Operational View Looking at the practical issues…

What is “Security? Decide what “secure” means to you, Then identify the threats you care about. Virus Identity Theft Denial of Service Espionage Stolen Customer Data Modified Databases Cyberterrorism Equipment Theft Operational view

Costs: Solution Value of asset Potential losses Risks: Likelihood Potential impacts Balance Risk vs. Cost Operational view

Take into Account…. Laws and customs Organization issues Security-a non-earning asset Budget constraints Responsibility vs. power People issues Education & awareness Insider abuse Misuse Operational view

Current Concerns Dynamic nature of threats…

From CSI/FBI Report % detected computer security breaches within the last year 80% acknowledged financial losses 44% were willing and/or able to quantify their financial losses. These 223 respondents reported $455M in financial losses. The most serious financial losses occurred through theft of proprietary information and financial fraud 26 respondents: $170M 25 respondents: $115M For the fifth year in a row, more respondents (74%) cited their Internet connection as a frequent point of attack than cited their internal systems as a frequent point of attack (33%). 34% reported the intrusions to law enforcement. (In 1996, only 16% acknowledged reporting intrusions to law enforcement.)

More from CSI/FBI % detected external penetration 40% detected denial of service attacks. 78% detected employee abuse of Internet access privileges 85% percent detected computer viruses. 38% suffered unauthorized access or misuse on their Web sites within the last twelve months. 21% didn’t know. 12% reported theft of transaction information. 6% percent reported financial fraud (only 3% in 2000).

Legislation and Regulation Govt. Requirements for better security –HIPAA: Health Insurance Portability & Accountability Act –Sarbanes Oxley –US Patriot Act And more are coming….

Critical Infrastructure … gas and oil, telecommunications, water supply systems, emergency services, government services, electrical power systems, transportation, banking and finance.

Interdependence of Critical Infrastructure

Cyber Terrorism Internet Black Tigers’ successful DOS attack on Sri Lankan embassy servers Italian sympathizers of Mexican Zapatista rebels attacked Mexican bank web pages. Rise of “Hack-tivism” Freeh, Testimony before Senate, 2000.

Hacking Improvement High Technical Knowledge Required Sophistication of Hacker Tools Password Guessing Password Cracking Exploiting Known Vulnerabilities Disabling Audits TIME Self-Replicating Code Back Doors Hijacking Sessions Sweepers Sniffers Stealth Diagnotics DDOS Packet Forging & Spoofing New Internet Attacks

MALICIOUS CODE Backdoors Trojan Horses Bacterium Logic Bombs WormsVirus X Files

Warchalking, Wardriving, Warwalking, Originated in UK… Warchalking-- making series of chalk markings showing presence & vulnerabilities of wireless networks nearby. Ex: Circled "W" indicates WLAN protected by Wired Equivalent Privacy (WEP) Wardriving, Warwalking– driving/walking around with wireless notebook looking for unsecured wireless LANs.

Threats to Personal Privacy Buying / selling confidential Social Security info. Browsing IRS files. Buying / selling bank account name lists. E-commerce credit card #s, names, passwords House Ways and Means Committee, 102nd Congress, , Washington Post, S. Barr, 2 Aug (4) Freeh, Testimoney 2000

Identity Theft Fed Trade Com: Cases under “recent”: –$7M loss: cr cards stolen from Florida restaurants –Credit card skimmers plus drivers license, Florida –Fake soc security & INS cards $150-$250 –24 aliases –false id’s secures credit cards, open mail boxes & bank accounts, fraudulently obtained federal income tax refunds, & laundered proceeds –Bank Employee Indicted for Stealing Depositors' Information to Apply Over the Internet for LoansBank Employee Indicted for Stealing Depositors' Information to Apply Over the Internet for Loans