Basic Security Concepts University of Sunderland CSEM02 Harry R Erwin, PhD

Analyzing Security (from Schneier, 2003, Beyond Fear) These are the questions we must usually answer. 1.What assets are you trying to protect? 2.What are the risks to those assets? 3.How are you trying to protect them? 4.How well does your solution work? 5.What other risks does your solution introduce? 6.What are the costs and trade-offs of your solution? (I have asked this as an exam question.)

Systems Security involves systems, and systems are not simple. They’re complex, elusive, and maddening. ‘A collection of simpler components that interact to form a greater whole.’ Hardware, software, people, and procedures. Systems also interact with other systems. Unexpected interactions are called ‘emergent properties’ or ‘unintended consequences.’ These are our concern.

Security Systems Most systems do something. Security systems are different—they prevent things from happening. You will care about how systems fail and how they can be made to fail. It’s ‘applied paranoia.’

The Roles of People in Security Decision-makers—choose what mechanisms and policies to follow, often to further their own agendas. Users—cooperative or uncooperative. Basic to making security work. Innocent bystanders—but still often affected. Attackers—sometimes not malicious, but usually intending to do what they did.

Bruce Schneier’s Three Rules of Understanding Security Schneier Risk Demystification: Numbers matter and are not that hard to understand. Schneier Secrecy Demystification: Secrecy is anathema to security: –It’s brittle –It conceals abuse –It prevents sensible trade-offs Schneier Agenda Demystification: Know the agendas of the people involved in a security decision. They usually drive the decision in certain directions.

Basic Terminology Vulnerability Threat Risk Trust Reliability Security Integrity (Know these definitions cold!)

Vulnerability ‘A weakness that may lead to undesirable consequences.’ Typical vulnerabilities include –Hardware –Software –Procedure –External or environmental

Threat ‘The danger that a vulnerability will actually occur.’ Describes how the vulnerability would be attacked: –E.g., buffer overflow is the vulnerability, and the threat would be transmission of a TCP/IP packet to cause buffer overflow. Should be quantified by a rate of attack—i.e., how frequently an effective attack can be expected to occur.

Risk ‘A potential problem’, consisting of a –Vulnerability –Threat (expected attack rate) –Expected extent of the consequences. Hence risk is cost per unit of time (although the elements may be very hard to estimate) This is what managers must evaluate against the cost of mitigating the risk.

Computing Risk We usually use a logarithmic or decibel scale. –1 translates to 0 –10 translates to 10 –100 translates to 20 –Etc. And the reverse. This is because the uncertainty in the components of risk (rate of attack and extent of consequences) is multiplicative. Log and decibel scales represent multiplication by addition.

An Example Hackers probe my office workstation about once every 10 minutes, or 144 times a day. This translates to a value of about 22 dB on a daily scale. 365 days per year increases this to 47 dB on a yearly scale. If they broke in, the cost could be the loss of about $10,000 of work. This translates to a value of 40 dB per attack. The raw risk rate is about = 87 dB, or about $500,000,000 per year. Note that a good firewall reduces this vulnerability by many orders of magnitude. I use a locked-down Macintosh dual G4 running BSD UNIX. This reduces my risk to perhaps $100/year. If I used a firewalled Wintel machine, my risk would be more like $1000/year.

Trust ‘A relationship between two entities where one entity allows the other to perform certain actions.’ In traditional security, based on need to know, and can be managed by security level and authorizations. In e-commerce, becomes very complex. Currently a leading-edge research area.

Reliability ‘The system performs functionally as expected.’ Related to availability. Availability (a fraction) can be computed numerically as time the system is actually functional divided by the time the system is supposed to be functional. Related terminology include: –MTTF—mean time to failure (time) –MTTR—mean time to repair (time)

Security ‘Freedom from undesirable events’—hence much broader than the usual concept. In the UK, there are three elements to security (in a narrow sense) often listed: –Confidentiality—‘protection of data from unauthorized access.’ –Integrity—‘protection of data from unauthorized modification.’ More generally, certain desirable conditions are maintained over time –Availability—‘the system is usable by authorized users.’

Summary A security analyst, a safety analyst, and a risk analyst have very similar job descriptions—all are concerned with managing risk. Risk is expensive. The distinctive character of the security analyst’s job reflects a primary concern with malicious and intelligent threats. The US security analysis community was unsurprised by the events of 11/9/2001—we had already thought about the scenario (and worse ones).