Lecture 6 Networked Application Security IT 202—Internet Applications Based on notes developed by Morgan Benton

For Today What is security? What is being secured? What are the ways to do it? Physical Electronic Social

What is Security? Refers to our desire to restrict access to resources to only those people who are authorized to consume or handle them

Components of Any Security Architecture Includes: Authentication—the process of discovering that a person is who he/she says he/she is Authorization—the granting of privileges based on the identity of the person (which has been confirmed using Authentication above)

Components of Security Architectures (continued) Definition of what resources are being secured Establishing barriers to access for those resources, which may be: Physical—walls, guards, dogs, ID badges Electronic—encryption algorithms, passwords, firewalls, etc. Social—training in appropriate use of resources

Tradeoffs in Creating Security Architectures An important decision for application developers is choosing an appropriate level of security for the application Adding security mechanisms adds complexity, processing overhead, increased points of failure, and therefore increased costs to creating, operating, maintaining a system

The Cost of Security The goal is not to create the “perfect” system that will keep out any intruder, but mainly it’s to make the cost of accessing the resources higher than the value of the resources to those who might try to obtain them illegally Finding an appropriate balance between cost and security is the challenge you’ll face

The Goal for this Lecture To give you enough understanding of security architectures so that you can make your own decision about what levels of security are appropriate for systems that you will build

Question 1: What to secure? What resources do you possess? What is their value to you and to others? YouOthers Critical Important Unimportant

What to secure? For networked applications the primary resources you have are: Data Processing capacity Bandwidth What is the value to your operation of each of these resources?

Question 2: What could happen? It is important to have a good idea of what could happen to your resources so that you’ll know what to protect against. e.g you don’t wear kevlar at home (at least I hope!)

What could happen to your data? Stolen Corrupted Destroyed

What could happen to your processing capacity? ‘Evil’ processes such as viruses can take up processing capacity.

What could happen to your bandwidth? People can steal your bandwidth particularly with wireless networks.

How to implement your security Three main aspects: Physical Electronic Social

Physical Security Protection of: Servers Transmission systems Clients (as much as you can) Protection from Theft Break-ins Vandalism or destruction Natural Disasters

Electronic Security Data Encryption Authentication and Authorization of users Firewalls Protocol TCP/IP is the main protocol for networked applications. It by itself is not secure Run other secure protocols on top of TCP/IP such as SSL, TLS, and PCT.

Social Security People are the weakest link People have bad passwords Store passwords in poor locations Take data out of secure locations, i.e. home. Give out information to other people knowingly or unknowingly

Public Key Encryption is not secure PGP was developed in the early 90’s and since then many public key encryption technologies have been developed Here’s an example of the process…