CS5038 The Electronic Society Lecture 12: Security and Crime Online Lecture Outline Types of Attacks Security Problems Major security issues in online systems Security Risk Management Security Technologies

Attack Sophistication Vs. Intruder Knowledge www.cert.org Go to presentations, overview, see trend Source: Special permission to reproduce the CERT ©/CC graphic © 2000 by Carnegie Melon University, in Electronic Commerce 2002 in Allen et al. (2000).

Types of Attacks Non-technical – phone or e-mail employee posing as administrator Buffer overflow – hide code at the end of a long entry DNS spoofing – change DNS tables or router maps Sniffing – listen to all packets on network Malicious code: Viruses – propagate locally Worms - propagate between systems Macro viruses and macro worms Trojan horses – e.g. posing as a game

Security Problems Example: Denial of service (DOS) – purchases are not made, ads are not seen Security and ease of use are antithetical to one another E.g. passwords, electronic wallets/credit card Security takes a back seat to market pressures E.g. trying to hurry the time to market Security systems are only as strong as their weakest points Security of a site depends on the security of the whole Internet – DOS, e-mail Knowledge of vulnerabilities is increasing faster than it can be combated - Hackers share secrets and write tools Flaws in ubiquitous applications – Outlook, Word Underreporting: in 1999 32%; in 2000 25% of organisations had serious attacks reported to law enforcement Why might a company not report a crime?

Security Concerns Filling a form at a simple marketing site: User’s perspective Is Web server owned and operated by legitimate company? Web page and form contain some malicious code content? Will Web server distribute user’s information to another party? (or allow to be stolen) Company’s perspective Will the user attempt to break into the Web server or alter the site? Will the user try to disrupt the server so it isn’t available to others? Both perspectives Is network connection free from eavesdropping? Has information sent back and forth between server and browser been altered?

Major security issues in online systems Privacy or Confidentiality trade secrets, business plans, health records, credit card numbers, records of web activity Authentication – for Web page, e-mail Something known – password Something possessed – smartcard Something unique – signature, biometrics Integrity – protect data from being altered or destroyed Financial transaction Non-repudiation – not denying that you bought something PAIN – for payment systems

Security Risk Management Definitions involved in risk management Assets—anything of value worth securing Threat—eventuality representing danger to an asset Vulnerability—weakness in a safeguard Risk Assessment Determine organizational objectives Cannot safeguard against everything – limit to satisfying objectives Example: if Web site is to service customer complaints then top priority is to ensure no disruption – rather than protect data Inventory assets – value and criticality of all assets on network Delineate threats – hackers, viruses, employees, system failure Identify vulnerabilities - http://www.cve.mitre.org/cve/ Quantify the value of each risk e.g. Risk = Asset x Threat x Vulnerability (Symantec.com)

Security Technologies Firewall: Like a bouncer, has rules to determine if data is allowed entry More in CS5401 (For eTech class) Virtual Private Network (VPN) Encryption—scramble communications Intrusion Detection Systems (IDS) Automatically review logs of file accesses and violations Analyse suspicious activity for known patterns of attack Quiz 13

Summary Attack Sophistication Vs. Intruder Knowledge Types of Attacks – non-technical, buffer overflow, malicious code Security Problems - ease of use, market pressure, weak links Security Concerns – e.g. filling a form Major security issues in online systems - PAIN Security Risk Management – assessment, planning, implementation, monitoring Security Technologies – firewall, VPN, IDS Quiz 14

QUIZ 13 hint for q. 5: look at q QUIZ 13 hint for q.5: look at q.7 question 7 - guess you can guess question 9 skip question 12 q.13 answer is stateful packet inspection skip question 15