IS4463 Secure Electronic Commerce 5:30-6:45 PM Robert Kaufman –Background –Contact information Syllabus and Class Schedule Student Background Information –Send via to

Student Background Information Name Phone # (opt) and reliable address IS/CS background Security background Why you are taking this course What do you expect out of this course

Syllabus

Who relies on computers? Transportation Systems Personal and corporate financial records and systems Banking and financial institutions Hospitals and the medical community The public telephone network Air Traffic Control Power systems and other utilities The government and the military Just about everybody

Citibank Probably the largest and most famous publicly acknowledged theft Occurred in 1994 Vladimir Levin, a 30-year old Russian hacker stole more than $10M All but a few hundred thousand dollars recovered The actual dollar figure lost was minimal to an organization as large as Citibank, what was more important is how this affected people’s impression of the bank. How many accounts were lost as a result of this public incident?

Worcester Airport Occurred in early year old hacker broke into a NYNEX digital loop carrier system through a dial-in port The individual, who called himself “jester”, disrupted telephone service for over 600 residents of Rutland, Mass as well as communications at Worcester Airport Communication to the tower and emergency services was disrupted as well as the main radio transmitter and an electronic system which enables aircraft to send a signal to activate the runway lights

Omega Engineering Timothy Lloyd was convicted in May 2000 of causing an estimated $12 million in damages to his former employer. Back in 1996, Lloyd discovered he was about to be fired He planted a logic bomb that systematically erased all of Omega’s contracts and the proprietary software used by the company’s manufacturing tools. Lloyd’s act of insider cyberterrorism cost Omega its competitive position in the electronics manufacturing market. At Lloyd’s trial, plant manager Jim Ferguson said, “We will never recover.”

And probably the most widely known security problem… In March 1999, David Smith, a New Jersey resident, released the Melissa virus. The estimated damage it caused: $80 million. In May 2000, 23-year old college Philippine college student, Onel de Guzman, released the “Love Bug” virus which proceeded to cause an estimated $8 Billion in damages worldwide.

DISA VAAP Results PROTECTIONPROTECTION DETECTIONDETECTION REACTIONREACTION 38,000 Attacks 24,700 Succeed 13,300 Blocked 988 Detected 23,712 Undetected 267 Reported 721 Not Reported

To date, Chinese hackers already have unlawfully defaced a number of U.S. web sites, replacing existing content with pro-Chinese or anti-U.S. rhetoric. In addition, an Internet worm named "Lion" is infecting computers and installing distributed denial of service (DDOS) tools on various systems. Hack Attack: New Global Way Of War Washington Times April 23, 2001, Front Page “China Warns Of Hack Attack” Collateral Damage May Soon Have A New Definition ADVISORY Issued 04/26/2001

You have to have security, or else… 1999 CSI/FBI Computer Crime & Security Survey –521 security “practitioners” in the U.S. 30% reported system penetrations from outsiders, an increase for the third year in a row 55% reported unauthorized access from insiders, also an increase for the third year in a row Losses due to computer security breaches totaled (for the 163 respondents reporting a loss) $123,779,000 Average loss $759,380

You have to have security, or else… 2000 CSI/FBI Computer Crime and Security Survey –643 security “practitioners” in the U.S. 90% reported computer security breaches within the previous 12 months 70% reported unauthorized use 74% suffered financial losses due to breaches Losses due to computer security breaches totaled (for the 273 respondents reporting a loss) $265,589,940 Average loss $972,857

You have to have security, or else… 2001 CSI/FBI Computer Crime and Security Survey –538 security “practitioners” in the U.S. 91% reported computer security breaches within the previous 12 months 70% reported their Internet connection as a frequent point of attack (up from 59% in 2000) 64% suffered financial losses due to breaches, 35% could quantify this loss. Losses due to computer security breaches totaled (for the 186 respondents reporting a loss) $377,828,700 Average loss $2,031,337

You have to have security, or else… 2002 CSI/FBI Computer Crime & Security Survey –503 security “practitioners” in the U.S. 90% detected computer security breaches 40% detected penetrations from the outside 80% acknowledged financial losses due to breaches $455,848,000 in losses due to computer security breaches totaled (for the 223 respondents reporting a loss) 26 reported theft of proprietary info ($170,827,000) 25 reported financial fraud ($115,753,000) 34% reported intrusions to law enforcement 78% detected employee abuse of internet access privileges, i.e. pornography and inappropriate use Average loss $2,044,161

A sampling of activity from a security perspective March EBay gets hacked March Melissa virus hits Internet April Chernobyl Virus hits May Hackers shut down web sites of FBI, Senate, and DOE June Worm.Explore.Zip virus hits July Cult of the Dead Cow (CDC) releases Back Orifice Sept Hacker pleads guilty to attacking NATO and Gore web sites Oct teenage hacker admits to breaking into AOL Nov BubbleBoy virus hits Dec Babylonia virus spreads Feb several sites experience DOS attacks Feb Alaska Airlines site hacked May Love Bug virus ravages net

Internet Security Software Market $7.4 Billion est $4.2 Billion $3.1 Billion $2 Billion ’97 & ’98 figures based on a study released by market research firm International Data Corp. in Framingham, Mass. ’99 & ’02 figures from IDC study based on a survey of 300 companies with more than $100 million in annual revenues

What are our goals in Security? The “CIA” of security –Confidentiality –Integrity –Availability –(authentication) –(nonrepudiation)

The “root” of the problem Most security problems can be grouped into one of the following categories: –Network and host misconfigurations Lack of qualified people in the field –Operating system and application flaws Deficiencies in vendor quality assurance efforts Lack of qualified people in the field Lack of understanding of/concern for security

Computer Security Operational Model Protection = Prevention+ (Detection + Response) Access Controls Encryption Firewalls Intrusion Detection Incident Handling

Proactive –vs- Reactive Models “Most organizations only react to security threats, and, often times, those reactions come after the damage has already been done.” “The key to a successful information security program resides in taking a pro- active stance towards security threats, and attempting to eliminate vulnerability points before they can be used against you.”