ITGS Security

Security Authentication Computer security –The process of protecting hardware, software and data from unauthorized access, while allowing authorized users to perform their work Authentication –requires users to prove their identity so a system knows they are genuine, authorized users Something you know –Passwords - must be chosen carefully so that they can’t be easily guessed

Authentication Something you have –Requires a user to have a physical object in order to authenticate Security token - using a physical object to enter a system Multifactor authentication - since security tokens can be stolen, another form of authentication in addition to them is used Something about you –Biometrics Using a part of a person’s body to identify them –Fingerprints, iris patterns, face shape, voice pattern –Biometrics are unique for each user »Not 100% accurate; a biometric system must attempt to make a good match rather than an exact match with the stored biometric data ( always a margin of error)

Biometric authentication »False negative - when the system fails to recognize an authorized user, and he/she must begin the authentication again »False positive-when an unauthorized user is mistakenly allowed access because the system mistakes their data for that of an authorized user Something you know –Passwords Computers do not store passwords as plain text –A one-way function is used to generate a cryptographic hash of a password »It is not possible to retrieve the original password from the hash, making it safe to store the hash. »When the user logs in, another hash is generated and is compared to the original hash value; if the two match, the user is authenticated »The password itself is never stored, nor is it sent across a network

Cryptographic Hash

Passwords Not all websites use the cryptographic hash method to store passwords securely If a website or system is able to send you a reminder of your password, it means it is stored in a way accessible to the system administrators If the forgotten password function sends you a new password, the system administrators don’t have access to your old password (cryptographic hash) Biometric enrollment Collecting biometric samples from users along with their identities

Passwords Example: fingerprints The computer analyzes the fingerprints, looking for the key features and measurements It produces a biometric template containing these values This template is stored for future use When the user tries to authenticate, another biometric sample is taken and used to produce a biometric template

Access privileges The new template is compared with the old, and if they match, its authenticated Most system administrators don’t want all authenticated users to have the same access privileges Most operating systems provide a way to grant access privileges to individuals or groups of users A series of rights can be assigned: The ability to read (view), write (modify) and delete material

Hacking These rights can be done on individual files, folders, drives and resources like printers Each user is assigned his own home directory The system administrator’s account has full access to all items Hacking –Gaining unauthorized access to computer systems A hacker exploits weaknesses in the target system’s security Once the hacker has compromised the system, information is usually stolen

Hacking Social engineering –Tricking people into giving away passwords Software tools for hacking: –Packet sniffer - a program that captures data as it travels over networks Legitimate use: helping diagnose network problems –Key loggers - plug into computer between keyboard and keyboard port Key loggers run in the background, silently recording keys pressed Can be detected by anti-virus software –Password cracker - program designed to guess passwords Dictionary attack - they try every word in a list of known English words until the password is found

Hacking Brute force method - try every single combination of characters until the right word is guessed –Brute force is slow at 10 million passwords per second, it would take years to guess a long password –END OF MONDAY’S NOTES

Hacking Preventing the use of password cracking tools –Limiting the number of times a user can try to log in before temporarily locking the account –Small delay between login attempts OS Fingerprinting tools –Used to give more information about a target system, such as versions of OS and webserver software The hacker can them investigate possible flaws

Security Updates Software vendors frequently release patches for their system –Downloading and applying these updates is important because new vulnerabilities are constantly being found Vulnerability scanner tools –Used by hackers to test a system for vulnerabilities which have not been patched, so they can exploit them

Hacking in action Zero day exploit –When hackers target a company using vulnerable security, acting on a newly reported and unfixed vulnerability Malicious software –Viruses Malicious programs designed to replicate themselves and cause damage to computer systems –Viruses usually attach to other programs or attachments, and are triggered when a user opens the program or attachment –When the virus spreads, at a given point, such as a certain date, viruses trigger their “payload”, which might be deleting or overwriting files or even wiping the hard disk

Macro viruses Macro virus - –Written using the macro programming languages designed in automated tasks in some software, such as word processors, spreadsheets and databases They can be configured to run automatically when a document is opened and quickly infect computers –Worms - similar to viruses, but sread without any user interaction Example: a user opens a worm infected attachment - the worm might immediately copy itself to other machines on the network or automatically forward to everyone in the user’s address book Worms consume large amounts of bandwidth as they propagate

Malicious software Trojan horses –Rely on tricking the user into downloading and running them, instead of spreading on their own They pretend to perform a useful task (pose as a game or even antivirus software) Once run, they deliver their payload, which is often spyware, turning the infected machine into a botnet. Spyware –A form of malware which monitors the user’s activities without their knowledge or permission Serves them with advertisements targeted to their behavior More sinister, such a stealing personal files or using a key logger to gauge passwords, usernames and credit card numbers –It is even possible to record the user’s screen Rootkits –A particularly hard to remove form of malware that generally infects a machine as the administrator (root) user

Malicious software –Rootkits hide their identity from the user and the OS and alter it –Difficult to detect –Usually can only be removed by installing a fresh operating system Backdoor infections - malware that is operated by an unauthorized remote user is becoming more common –A computer infected in this way is called a zombie –Botnets - when criminal computer gangs control hundreds or thousands of zombies at once They send out spam or phishing , or distribute malicious software DDOS attacks - bombarding a computer system with so many requests that it can’t keep up, becomes slow, or crashes Drive-by downloads –Programs which are downloaded or installed automatically, without the user’s consent, when he visits a webpage Usually either infect a system with malware or make money by tricking the user into buying unnecessary security software –JavaScript, ActiveX and Java - technologies that can be used to create enhanced, interactive webpages, but also can be misused to deliver driveby downloads END OF WEDNESDAY’S NOTES

Spam Spam - unwanted messages that are sent to many users at once. –Usually , but can also refer to phone text messages (SMS) –Usually advertise products, many illegal or unregulated, such as prescription drugs 419 Scams (also known as Nigerian Scams): scam messages which try to entice the user into sending money –Common spamming techniques: »A subject line which seems personal »Spam sent by a virus or worm may actually use the name of a sender you know –Large amounts of spam also slow down servers, consuming space and bandwidth –Employees in businesses waste valuable time dealing with spam minutes every week, adding up to $71 billion of lost productivity in the US Spam bot - software that scans through thousands of web pages looking for addresses –Searches through web pages for addresses, HTML code, mailto tags, and web forms filled in by users Some companies exist with the sole purpose of collecting and selling databases of addresses

Spam filters –Used by most providers to reduce the amount of spam you have Organizations can install their own spam filters on an server or client computer –SpamAssassin - an open source program Use Bayesian filtering to examine and determine how likely it is to be Spam, based on the words it uses Monitor global spam and make available the IP addresses or domain names of spam sources Many websites use CAPTCHAs or “scribble text” to prevent abuse by automated spam bots –CAPTCHAs create an image using distorted text, background noise, and disorienting lines, designed to be impossible for a spam bot program to decipher but easy for a human. Commonly used on websites to create accounts (especially systems) to prevent spammers writing software to automatically generate hundreds or thousands of false accounts Avoiding spam filters –Spammers use various techniques to avoid the filters Embed a paragraph of text from a website or book into the spam to fool the Bayesian filters into thinking the message is genuine –This works because the ‘normal’ text reduces the relative frequency of words associated with spam

Avoiding Spam Filters Image spam –Spammers try to avoid spam filters by including their message in an image file instead of text Since spam filter’s can’t read or understand the text in an image, such s may be passed through –Web bugs Links in spam messages to images stored on the spammer’s server –When you open the with the web bug, the image is fetched from the server, and your address is confirmed, encouraging the spammer to send you more spam »This can be avoided by switching off images in software Ways to avoid spam –Use BCC (blind carbon copy) to protect others’ addresses –Use disposable addresses when using on sites that may cause problems »Some web mail companies offer disposable addresses that temporarily point to your real address but expire after a time

Phishing –Impersonating a genuine organization in order to fool the user into providing sensitive personal data Such s usually contain a link to a web site which is an exact copy of the original site, but is operated by criminals –Some phishing sites display an ‘incorrect password’ error after details are entered and direct users to the real site, making you think you just made a typing mistake Smishing - using text messages to commit phishing attacks Vishing - using a phone call to commit a phishing attack –VoIP software allows inexpensive calls to be made, even from overseas, and they are very hard to trace

Phishing Pharming –Also known as DNS poisoning Another technique used by phishers to direct users to a fake website when they enter the URL of a genuine site –Criminals illegally access a DNS server and put the IP address of their fake site in lace of the IP address of the real site –When the user enters the compromised domain name in their browser, the DNS server returns the false IP address and takes them to the fake site –Identity theft Phishing is performed to commit identity theft - stealing personal data to impersonate them ***Don’t use links to get to banks - type in the URL manually to avoid phishing

Encryption Encryption - protects data from unauthorized access when it is sent over an untrusted network like the internet. –Encryption uses encryption keys to transform a plaintext message into a form that is not understandable to anyone who reads it (ciphertext) Secret key encryption –The same key is used for both encryption and decryption »Symmetric or single key encryption »The key must be kept secret

Encryption Public key encryption –Asymmetric key encryption - uses a key pair: Public key is used only for encryption Private key - used only for decryption –The keys work only when together »Once a message is encrypted with public key, only corresponding private key can decrypt it –An encrypted connection to a web site is indicated by https at the start of the URL This signifies SSL (secure socket layer) or TLS (Transport Layer Security) encryption is being used

Digital signing Digital certificate - used to authenticate the sender of a message –Using a private key to digitally sign your message to prove your identity Certificate authorities verify the owner of public keys and issue digital certificates (key pairs) to organizations after checking their identity END OF THURSDAY’S NOTES