1. Overview of Data Communications Security Concepts
Version 1.0
March, 2003
Bill Woodcock
Packet Clearing House

2. Context
What to Protect
What to Allow
Types of Attacks
What you can do

3. Mauritius on the World Stage
SAFE cable system
Connects to South Africa, India, and Malaysia
STM768 total capacity, less than one year old
Cyber-city initiative
First-class IT hosting facility
Regional center for banking and finance
Prosperous economy, strong work ethic
Already highly educated population
New computer education programs

4. Risks, Costs, and Benefits
As Mauritius comes to the world’s attention, both risks and potential benefit increase dramatically.
The time to put your house in order is now, before it receives close scrutiny.
A well-prepared country will attract business and investors.

5. What to Protect Physical security Cryptographic security
Computing resources
Storage (live and backups)
Communications and remote access
Support (power and cooling)
Cryptographic security
Hiding content
Authenticating parties
Protection against replays and man-in-the-middle
Code execution and permissions
Open source code (patches)
Execution space and account structure
Social engineering

6. What to Protect Define tight perimeters Compartmentalize Modularize
Physical: secure rooms, not buildings
People: delete old accounts, manage permissions
Compartmentalize
Firewalls: one per class of device
Code: executes chroot with own uid
Permissions: role accounts, sudo
Modularize
Code: auditable building-blocks, not monoliths
People: cross-train and understand overall goals
Physical: standard components, spares, images
Firewalls: central management of rulesets, namespace

7. What to Allow
Differential threshold of difficulty to authorized and unauthorized users
How to authenticate?
“Something you have and something you know.”
Password, phrase, PIN, or challenge-response
Key, token, modulator, or biometric property

8. What to Allow Permissions depend upon context Temporal: Physical:
Some hours of the day or days of the week
While they’re employed or contracted
Physical:
While they’re present in a facility
Together with another user
Complex:
Depending upon pattern of prior actions

9. Types of Attacks Physical: Infrastructure destruction
Theft of components
Wiretapping and eavesdropping
Vandalism

10. Types of Attacks Communications: Man-in-the-middle Denial of service
Port scanning
Stepping-stones and impersonation

11. Types of Attacks Code: Incompetence and DoS against labor
Buffer overflows
Permissions bootstrapping
Worms and self-replication
Viri and trojan horses
Zombies and 0wn3rship

12. Types of Attacks People: Social engineering Co-option Moles or plants
Inside jobs

13. What Can You Do? Define clear and specific policy
90% of security is human resources
9% is host configuration
1% is firewalls
Only create policy which can be followed
Only create policy which can be enforced

14. Why CEOs Must Lead
Most serious security compromises come from within the organization.
Most are failures of morale, alertness, or moral fiber on the part of employees.
These problems can only be solved through good corporate culture.
CEOs set the moral and ethical example which guide the corporation’s culture.

15. Bill Woodcock