The Need for Security Principles of Information Security Chapter 2

Chapter Objectives Explain the business need for security. Describe the responsibility of an organization's general management and IT management for a successful information security program. Identify threats to information security and common attacks associated with those threats. Differentiate between threats to information systems and attacks against the information systems. 2

Introduction The primary mission of information security is to ensure that systems and their contents remain the same. 3

4 Important Functions of Information Security Protect the ability to function. Enable the safe operation of applications. Protect data. Safeguard technology assets. 4

Protecting the Functionality of the Organization Shared responsibility between general management and IT managment ◦ Set security policy in compliance with legal requirements. ◦ Not really a technology issue Address information security in terms of ◦ Business impact ◦ Cost of business interruption 5

Enabling Safe Operation Organization requires integrated, efficient, and capable applications. ◦ Technologically complex. ◦ Must protect critical applications  Operating system platforms  Electronic mail  Instant messaging ◦ Infrastructure developed by  outsourcing to a service provider  develop internally ◦ Protection of the infrastructure must be overseen by management. 6

Protecting Data Data provides ◦ Record of transactions (e.g., banking) ◦ Ability to deliver value to customers ◦ Enable creation and movement of goods and services.  Data in motion (online transactions)  Data at rest (not online transaction) Information systems must support these transactions. 7

Safeguarding Technology Assets Must have secure infrastructure services based on the size and scope of the enterprise. ◦ Smaller businesses may require less protection.  and personal encryption. ◦ Additional services required for larger businesses.  Public Key Infrastructure (PKI) - more complex ◦ Needs change as network grows. 8

Threats Requirements to protect information ◦ Be familiar with  The information to be protected  The systems that store, transport and process it ◦ Know the threats you face An object, person, or entity that represents a constant danger to an asset. 9

12 General Categories of Threat 1. Acts of human error or failure – mistakes, sloppiness 2. Compromises to intellectual property - piracy, licensing 3. Deliberate acts of espionage or trespass ◦ shoulder surfing, hacking, script kiddies, cracker, phreaker 4. Deliberate acts of information extortion - demanding a ransom 5. Deliberate acts of sabotage or vandalism ◦ damage reputation, cyberactivist, cyberterrorism 6. Deliberate acts of theft - difficult to detect 7. Deliberate software attacks ◦ malware, virus, worm, trojan horses, back door, hoaxes 8. Forces of nature - fire, flood, earthquake, lightning, storms, etc. 9. Deviations in quality or service - service disruptions 10. Technical hardware failures or errors - hardware defects 11. Technical software failures or errors - accidental or intentional flaws 12. Technological obsolescence - unreliable and untrustworthy 10

The Endless Game of Cat and Mouse: Meet the Cast Hackers versus crackers White hats, black hats, all the shades of gray, and mysterious color changing Conferences? Web sites? Drills? s/Crackers.pdf s/Crackers.pdf 11

Meet the Players Top 10 And the othersothers ◦ From ws/hackers/ ws/hackers/ And where they congregate – do NOT go there unless you want to risk catching something …. 12

Attacks At act or action that takes advantage of a vulnerability to compromise a controlled system. Accomplished by a threat agent that damages or steals information or physical assets. Vulnerability ◦ an identified weakness in a controlled system, where controls are not present or no longer effective. Attacks exist when a specific action occurs that may cause a potential loss. Question: how will the attacker “identify weakness” and/or know what to attack? 13

Well-Known Types of Attack Against Controlled Systems Malicious Code Hoaxes Back Doors Password Crack Brute Force Dictionary Denial-of-Service (DoS) Distributed Denial-of- Service (DDoS) Spoofing Man-in-the-Middle Spam Mail Bombing Sniffers Social Engineering Buffer Overflow Timing Attack 14 Of course, any of these attacks can be distributed, and/or coming from a botnet.

Malicious Code Viruses, worms, Trojan horses, active web scripts. State-of-the-art ◦ Polymorphic or multivector worm ◦ CERT, Symantec, etc. warnings Known attack vectors ◦ IP scan and attack ◦ web browsing ◦ Virus ◦ unprotected shares ◦ mass mail ◦ SNMP 15

Hoaxes Transmit a virus hoax with a real virus attached. ◦ More readily transmitted by trusting users! 16

Back Doors Use known or previously discovered access mechanism to gain access to a system or network resource. ◦ May be left by system designers or maintenance staff. ◦ Referred to as trap doors. Hard to detect --- may be exempt from usual audit logging procedures. 17

Password Crack Reverse calculate a password. Component of many dictionary attacks. Security Account Manager (SAM) file is accessible ◦ contains hashed representation of the user's password. ◦ a guessed password can be hashed using the same algorithm and compared to the stored hash version of the real password. 18

Brute Force Attack AKA, password attack Try every possible combination of options for a password. Easier, if passwords are easy to guess or default passwords. Avoid using easy to guess passwords --- and don't use default passwords. Rarely used, if basic security precautions have been implemented (e.g., complex passwords) 19

Dictionary Attack Use a list of commonly used passwords (i.e., a dictionary) instead of random combinations. Takes less time to crack than a brute force attack. Use electronic dictionaries to enforce use of (more) complex passwords. 20

Denial of Service (DoS) Distributed Denial of Service (DDoS) Overload target with requests Many different flavors: ◦ TCP SYN flood attack: send many TCP connection requests. ◦ Send million s or faxes and clog the server DDoS ◦ Often uses compromised machines (called zombies, from a botnet) to attack the target system. ◦ The most difficult to defend against. ◦ No controls that any single organization can apply. ◦ Some cooperative efforts among service providers. ◦ MyDoom worm attack. 21

Spoofing Technique of sending messages to a computer using a source IP address that indicates the messages are coming from a trusted host. ◦ Must find an IP address for a trusted host. ◦ Must modify packet headers for the attack messages. Routers and firewalls can protect against spoofing attacks. 22

Man-in-the-Middle Attack AKA, TCP hijacking attack Attacker "sniffs" packets from the network, modifies them, then inserts them back into the network. ◦ Uses IP spoofing to impersonate another entity on the network. Allows the attacker to: ◦ eavesdrop, change, delete, reroute, add, forge, or divert data. Spoofing involves the interception of an encryption key exchange, which enables the hijacker to act as an eavesdropper (transparent to the network). 23

Spam Unsolicited commercial . ◦ Has been used as a vector for malicious code attacks. ◦ Wastes computer and human resources i.e. it is a DOS attack Methods to counteract spam ◦ Delete offending messages ◦ Use filtering technologies to stem the flow 24

Mail Bombing denial-of-service attack. ◦ Send large s with forged headers Mechanisms ◦ Social engineering ◦ SMTP flaws 25

Sniffers AKA, packet sniffers. A program or device that can monitor data traveling over a network. ◦ Use for legitimate network management functions or maliciously. Unauthorized sniffers are dangerous to security. ◦ Virtually impossible to detect. ◦ Can be inserted anywhere. 26

Social Engineering The process of using social skills to persuade people to reveal access credentials or other valuable information. ◦ Over the phone: “Hey, Joe, this is Andy from department C. Aaron (the boss) told me to ask you to give me the XYZ plans, the customers is demanding we fix the bugs by tomorrow. “ ◦ Over the phone or in person, to the secretarial support: “…” May involve impersonating someone higher in the organizational hierarchy (requesting information). ◦ “Hey, Joe, this is Aaron (the boss). What was the …. “ Tailgating, shoulder surfing, etc. May be a scam --- Nigerian banking, etc. 27

Physical (illegal) access War Driving: driving around trying to catch a signal ◦ Wireless without encryption ◦ Non-wireless el.magn. radiation Garbage Diving: looking through disposed documents Tapping: any cable that is not optical. Or, at exposed locations (switches, control panels, etc.) 28

Buffer Overflow “Buffer” is a term for data storage, on logical level (often called “queue” in networking) Buffers are used for many different reasons: for example, to temporarily store networking data when waiting to be processed, etc. Buffers are often implemented as “arrays” in code Arrays typically have fixed size A buffer overflow is a programming error that occurs when more data is sent to a buffer than it can handle AND the programmer did not specify what happens in that special case ◦ Attacker can take advantage of this programming error to cause unintended side effects. 29

Timing Attack Something bad happens when a certain time is reached Many different flavors. Examples: ◦ Explores web browser's cache.  Allows web designer to develop malicious cookie to be stored on user's system.  Could allow designer to collect information on how to access password-protected sites. 30

Port Scanning attacks/port-scan-attack Port scan sees which ports are available, which OS you are using, … attacks/port-scan-attack S/port_scan_detectors.shtml A view from the trenches S/port_scan_detectors.shtml A tool to detect port scans 31

Review NA-Security-Chapter-1-assessment NA-Security-Chapter-1-assessment Challenge: go through the PCWeek Hack on p.47 and try to understand each step the attacker took. 32