Internet Security Terms and Techniques Chris Avram Faculty of Information Technology Monash University 1U-Cubed ‘99Chris Avram

Security is u Confidentiality – only those authorised have access to data u Authentication – the identity claimed can be verified u Availability – access is available as and when required u Integrity – information is modified only as it should be 2U-Cubed ‘99Chris Avram

Security is needed for u Legal and ethical need – OECD privacy guidelines – Australian privacy act and commission – OECD guidelines for security of information u Technical need – electronic commerce – public networks – packet switched networks 3U-Cubed ‘99Chris Avram

Internet strategy u Local area network u Wide area network u Internet - global network – customer/client access – inter-organisation systems u Intranet – Internet technology for WAN – Virtual Private Network 4U-Cubed ‘99Chris Avram

The networked organisation LAN Internet customers LAN SOHO Legend Another organisation Secure line Insecure 5U-Cubed ‘99Chris Avram

Current security measures u Passwords to identify users/clients – access restricted to logged on users – Netware, NT encrypt passwords – eaves dropping on other P/Ws possible u Physical access controls – guarantees server identity – reduces electronic eaves dropping 6U-Cubed ‘99Chris Avram

Threats u Impersonation – of clients – of servers u Passive electronic eaves dropping u Modification of information in transit u Traffic analysis u Denial of service 7U-Cubed ‘99Chris Avram

Solutions u Public key crypto-systems – allow electronic signature and verification – allow confidential exchange of information u Certificates – signed by a certificate authority (CA) – proof of identity » containing a public key u SSL (for WWW), S-Mime (for ) 8U-Cubed ‘99Chris Avram

Public key crypto-systems Send message Receive message Secret key Public key Public key directory Make Keys Eavesdropper 9U-Cubed ‘99Chris Avram

Public key signature-systems Sign message Check signature Secret key Public key Public key directory Make Keys Fraudster clear 10U-Cubed ‘99Chris Avram

Certificates Certificate Authority Client Server Signed server certificate Signed server certificate CA public key Source Certificate request 11U-Cubed ‘99Chris Avram Past Present

Secure links ClientServer Info. Request Certificate eg. Visa number time eg. fee for service info. 12U-Cubed ‘99Chris Avram

Certificate authorities - Public u Public CAs – Australia Post (product sales on hold) – VeriSign – UPS and others  Customers will get browsers with CA certificates included  $US350-1,300 per server per annum  13U-Cubed ‘99Chris Avram

Certificate authorities - Private u CA Software from » Netscape » X509.com » Microsoft u Organisation – chooses level of proof of identity – makes CA certificates available, manages revocation list   No ongoing fees 14U-Cubed ‘99Chris Avram

Recommendation u If an organisation plans to use the Internet for more than the distribution of public information – eg. selling, collecting $ or personals, customer confidential communications u Then it should consider running a private certificate authority: – 1. Create a secure version of your WWW server – 2. Install CA software – 3. Begin testing with selected mobile staff 15U-Cubed ‘99Chris Avram

Reference u VeriSign u CA demo u Secure WWW servers – Microsoft – Netscapehttp://home.netscape.com/ – Apache u SSL capable WWW client Netscape 2.02 or later, Microsoft Internet Explorer 3.0 or later u This file is 16U-Cubed ‘99Chris Avram