1. Chapter 10 Security On The Internet

2. Agenda Security Cryptography Privacy on Internet Virus & Worm Client-based Security Server-based Security

3. Security Security and trust requirements Threats on the Internet Sources of the threats Security policy

4. Security and Trust Requirements Confidentiality Integrity Availability Legitimate use Non-repudiation

5. Threats on the Internet Loss of data integrity Loss of data privacy Loss of service Loss of control

6. Sources of the Threats Hackers Cyber terrorists Employee error Missing procedures Wrongly configured software

7. Hackers Monitoring the communication –Private information & password Steal hardware & software –Smart card or database Intercept the output of a monitor screen Overloading the service Trojan horses – virus Masquerading (IP address spoofing) Dustbin

8. Hackers Bribe employee Information of internal network or internal DNS structure Social Engineering –Exploiting habits of employee –Pretending an employee –Organization chart –Phone book –Information gathering and social pressure

9. Hackers Counter measurements –Firewall –Two-factor authentication (know and have) –Audit log file –Digital certificate (user or server) –Message encryption

10. Cyber Terrorists Definition –Use computer resources to intimidate others Methods –Virus attack –Alteration of information –Cutting off Communication –Killing from a Distance –Spreading misinformation

11. Cyber Terrorists Counter measurements –Commission of Critical Infrastructure Protection –Disconnect mission critical systems from public network –Firewall to monitor communication –The eternity service concept (duplication and encryption)

12. Security Policy List of resources needed to be protected Catalogue the threats for every resource A risk analysis (cost and benefit) Centralized authorization –Physical access control (policy & procedure) –Logical access control (policy & procedure) Test, review and update

13. Agenda Security Cryptography Privacy on Internet Virus & Worm Client-based Security Server-based Security

14. Cryptography Secret key Public key Steganography Applications

15. Secret Key Symmetric cryptography A single key for encryption and decryption Use different medium for key and message Fast encryption and decryption Types –Stream ciphers: bit level –Block ciphers: pre-defined length into a block

16. Public Key Asymmetric key cryptography SRA algorithm: two distinct keys (private and public) for every users Public key decrypt messages encrypted with private key Long time to encrypt and decrypt message RSA to encrypt the symmetric key which encrypted the message

17. Public Key Usages –Communication between web server and web browsers for create session key –E-mail uses different public key for different recipients

18. Steganogrphy Hide information in the ordinary noise and digital systems of sounds and images Low quality of free software Higher quality for commercial software Law requirements for encryption and decryption

19. Applications Enforce privacy –Storing the hash value of password Encrypting e-mail –Pretty Good Privacy (PGP): unbreakable –Secure Multipurpose Internet Mail Extensions (S/MIME): ease to set up with less security –Separate the use of strong symmetric encryption algorithms and e-mail software –WinZip: for e-mail read by multiple person and password over the phone

20. Applications Digital Signatures –Digital hash or digital code for each message –Encrypt the digital code with private key –Decrypt the digital code with public key –Digital time stamp (time and date) encrypted with private key by third party

21. Agenda Security Cryptography Privacy on Internet Virus & Worm Client-based Security Server-based Security

22. Privacy on Internet Footprints on the Net TRUSTe The platform for privacy preferences Anonymity

23. Footprints on the Net Request a web site –The name of the browser –The operating systems –Preferred language –The last visited web site –IP address and domain name –The client location –The screen resolution and number of colors

24. Footprints on the Net Cookies –The password to open a site –A user name –An e-mail address –Purchasing information

25. TRUSTe An independent, non-profit privacy organization issues online seal called “trustmark” To certify an online business is trustworthy, safe and allow checking the privacy practice by a third- party Hard to understanding the privacy information by end user

26. The Platform for Privacy preferences Platform for Privacy Preference Project (P3P) by W3C Define a way for web site to inform the users of privacy practice before the first page

27. Anonymity Anonymous remailers to replace the header of original e-mail with remailer’s Anonymizer

28. Agenda Security Cryptography Privacy on Internet Virus & Worm Client-based Security Server-based Security

29. Virus Types of viruses Virus damage Virus strategy

30. Types of viruses Boot sector virus Executable virus Macro virus Hoax viruses and chain letter

31. Virus Damage Annoying Harmless Harmful Destructive

32. Virus Strategy Firewall Anti-virus program –Scanner –Shield –Cleaner Backup strategy Education of employee with a frequently asked questions (FAQ) page

33. Agenda Security Cryptography Privacy on Internet Virus & Worm Client-based Security Server-based Security

34. Client-based Security Digital certificates Smart card Biometric identification

35. Digital Certificates Personal information (name and address) file encrypted and password-protected with public key and certification authority (name and validity period) Types –Browser and server: SSL encryption –Customer and merchant: SET encryption –Two e-mail partners: S/MIME

36. Smart Cards Uses electronically erasable programmable red only memory (EEPROM) Types –Contact cards –Contactless cards –Combi cards Information Access –Read only –Add only –Modify or delete –Execution only

37. Biometric Identification Physical characteristics or behavioral traits Issues –Acceptance –Accuracy –Cost –Privacy

38. Agenda Security Cryptography Privacy on Internet Virus & Worm Client-based Security Server-based Security

39. Isolation of web server Application Proxies Multi-layered firewall A trusted operating systems (TOS) Backup Least privilege Balance of power A good audit system

40. Trusted Operating Systems Types –Virtual Vault by Hewlett Packard –Trusted Solaris by Sun Features –Firewall –Intranet –Internet –Distributed system: data and program –Least privilege –Peak usage management –Multi level security –Audit system

41. Audit System Adaptable Automated Configurable Dynamic Flexible Manageable System-wide

42. Points to Remeber Security Cryptography Privacy on Internet Virus & Worm Client-based Security Server-based Security