1. Security Chapter 9 Copyright 2004 Prentice-Hall Panko’s Business Data Networks and Telecommunications, 5 th edition

2. Trends in Computer and Network Security

3. 3 Figure 9-1: CSI/FBI Survey Survey conducted by the Computer Security Institute (www.gocsi.com). Based on replies from 530 U.S. Computer Security Professionals. If fewer than twenty firms reported quantified dollar losses, data for the threat are not shown.

4. 4 Figure 9-1: CSI/FBI Survey Had at Least One Security Incident in This Category (May Have Had Several) Percent Reporting an Incident in 1997 Percent Reporting an Incident in 2003 Number Reporting Quantified Losses in 2003 Average Reported Annual Loss Per Firm (1000s) in 1997 Average Reported Annual Loss Per Firm (1000s) in 2003 Viruses82% 254$76$200 Insider Abuse of Net Access Not Asked 80%180Not Asked $136

5. 5 Figure 9-1: CSI/FBI Survey Laptop Theft58%59%250$38$47 Unauthorized Access by Insiders 40%45%72Not Asked $31 Had at Least One Security Incident in This Category (May Have Had Several) Percent Reporting an Incident in 1997 Percent Reporting an Incident in 2003 Number Reporting Quantified Losses in 2003 Average Reported Annual Loss Per Firm (1000s) in 1997 Average Reported Annual Loss Per Firm (1000s) in 2003

6. 6 Figure 9-1: CSI/FBI Survey Denial of Service 24%42%111$77$1,427 System Penetration 20%36%88$132$56 Sabotage14%21%61$164$215 Had at Least One Security Incident in This Category (May Have Had Several) Percent Reporting an Incident in 1997 Percent Reporting an Incident in 2003 Number Reporting Quantified Losses in 2003 Average Reported Annual Loss Per Firm (1000s) in 1997 Average Reported Annual Loss Per Firm (1000s) in 2003

7. 7 Figure 9-1: CSI/FBI Survey Theft of Proprietary Information 20%21%61$954$2,700 Financial Fraud 12%15%61$958$329 Had at Least One Security Incident in This Category (May Have Had Several) Percent Reporting an Incident in 1997 Percent Reporting an Incident in 2003 Number Reporting Quantified Losses in 2003 Average Reported Annual Loss Per Firm (1000s) in 1997 Average Reported Annual Loss Per Firm (1000s) in 2003

8. 8 Figure 9-1: CSI/FBI Survey Telecom Fraud 27%10%34Not Asked $50 Telecom Eavesdropping 11%6%0Not Asked Not Asked Active Wiretap 3%1%0Not Asked Not Asked Had at Least One Security Incident in This Category (May Have Had Several) Percent Reporting an Incident in 1997 Percent Reporting an Incident in 2003 Number Reporting Quantified Losses in 2003 Average Reported Annual Loss Per Firm (1000s) in 1997 Average Reported Annual Loss Per Firm (1000s) in 2003

9. 9 Figure 9-1: CSI/FBI Survey Conclusion Attacks are like multiple poisons Several of them are fatal Defense is difficult

10. Major Attacks Viruses and Worms Human Hacking (Break-Ins) Denial-of-Service Attacks

11. 11 Figure 9-2: Viruses and Worms Viruses Pieces of code that attach to other programs Virus code executes when infected programs execute Infect other programs on the computer Spread to other computers by e-mail attachments, webpage downloads, etc.

12. 12 Figure 9-2: Viruses and Worms Viruses Many viruses spread themselves by sending fake e- mail messages with infected attachments Antivirus programs are needed to scan arriving files Users often fail to keep their computer antivirus programs up to date Antivirus filtering on the e-mail server works even if users are negligent

13. 13 Figure 9-2: Viruses and Worms Worms Complete programs Self-propagating worms identify victim hosts, jump to them, and install themselves Can do this because hosts have vulnerabilities Vendors develop patches for vulnerabilities but companies often fail to apply them

14. 14 Figure 9-2: Viruses and Worms Worms Worms take advantage of specific vulnerabilities Firewalls can stop many worms by forbidding access to most ports E-mail worms can get around antivirus filtering

15. 15 Figure 9-2: Viruses and Worms Blended Threats Combine the spreading characteristics of viruses and worms Payloads Programs that can do damage to infected hosts Erase hard disks, send users to pornography sites if they mistype a URL Trojan horses: exploitation programs disguise themselves as system files

16. 16 Figure 9-3: Human Break-Ins (Hacking) Human Break-Ins: Viruses and worms rely on one main attack method Humans can keep trying different approaches until they succeed Hacking Breaking into a computer Hacking is intentionally using a computer resource without authorization or in excess of authorization Prosecutable if do a certain amount of damage

17. 17 Figure 9-3: Human Break-Ins (Hacking) Scanning Phase Send attack probes to map the network and identify possible victim hosts Like a robber casing a neighborhood Finds active IP addresses Identifies type of computer at that address via open ports, etc. Nmap program is popular (Figure 9-4)

18. 18 Figure 9-4: Nmap Scanning Output IP Range to Scan Type of Scan Identified Host and Open Ports

19. 19 Figure 9-3: Human Break-Ins (Hacking) The Exploit The Term “Exploit” is Used in Two Ways The actual break-in Exploit is the program used to make the break-in Super user accounts (administrator and root) can do anything If application running with super user privileges is compromised, the attacker gains super user privileges

20. 20 Figure 9-3: Human Break-Ins (Hacking) After the Break-In Become invisible by deleting log files Create a backdoor (way to get back into the computer) Backdoor account—account with a known password and super user privileges Backdoor program—program to allow reentry; usually Trojanized Do damage at leisure

21. 21 Denial-of-Service (DoS) Attacks Make a computer or network unavailable to users An exploding threat Rarely: sending a single message to bring down a computer Usually: overload a victim with a flood of messages

22. 22 Figure 9-5: Distributed Denial-of-Service (DDoS) Flooding Attack Attacker 1.34.150.37 Attack Command Attack Command Handler Zombie Handler Zombie Victim 60.168.47.47 Attack Packet Zombie Attack Packet Attack Command Attack Command Attack Command Attack Packet

23. Attackers

24. 24 Figure 9-6: Types of Attackers Traditional attackers: Curious hackers Disgruntled employees and ex-employees Growing number of criminal attackers Potential for far more massive attacks Cyberterror attacks by terrorists Cyberwar by nations

25. Security Management

26. 26 Figure 9-7: Planning Principles Security is a Management Issue, Not a Technical Issue Without good management, technology cannot be effective. Like a car. If you don’t know how to drive, not likely to be able to use effectively. Soldiers are not just given weapons. Must be trained extensively in tactics, etc.

27. 27 Figure 9-7: Planning Principles Plan-Protect-Respond Cycle Three phases endlessly repeating Planning: preparing for defense Protecting: implementing planned protections Responding: stopping attacks and repairing damage when protections fail

28. 28 Figure 9-7: Planning Principles Risk Analysis Cost of protections should not exceed probable damage Annual probability of damage Damage from a successful incident (Say, $50,000) Times the annual probability of success (say 10%) Gives the probable annual loss ($5,000)

29. 29 Figure 9-7: Planning Principles Risk Analysis Cost of protection If a protection can reduce the annual probability of damage by a certain amount, up to this amount can be spent on the protection Example Protection A can reduce the annual probability of damage by 50% ($2,500) If Protection A costs $1,000 per year, use it. If Protection A costs $4,000 per year, don’t use it.

30. 30 Figure 9-7: Planning Principles Comprehensive Security Attacker is intelligent Attacker only has to find one weakness Firm needs comprehensive security to close all avenues of attack

31. 31 Figure 9-7: Planning Principles Defense in Depth Every protection breaks down sometimes Attacker should have to break through several lines of defense to succeed Providing this protection is called defense in depth Defense 2 Defense 1 (fails)

32. Authentication

33. 33 Figure 9-8: Authentication and Authorization Authentication Server Applicant 1. Credentials (Password, etc.) Verifier

34. 34 Figure 9-8: Authentication and Authorization 2. OK? Authentication Server Applicant Verifier

35. 35 Figure 9-8: Authentication and Authorization Authentication Server Applicant Verifier 3. OK and Authorizations

36. 36 Figure 9-8: Authentication and Authorization Authentication Server Applicant 4. Welcome Verifier

37. 37 Figure 9-9: Password Authentication Passwords Strings of characters Typed to authenticate use of a username (account) on a computer Benefits Ease of use for users (familiar) Inexpensive because built into operating systems

38. 38 Figure 9-9: Password Authentication Often weak (easy to crack) Word and name passwords are common Can be cracked quickly with dictionary attack Passwords should be complex Mix case, digits, and other keyboard characters ($, #, etc.) Can only be cracked with brute force attacks (trying all possibilities)

39. 39 Figure 9-9: Password Authentication Passwords should be long Six to eight characters minimum Each added character increases the brute force search time by a factor of up to 75

40. 40 Figure 9-10: Digital Certificate Authentication Digital Certificate User gets secret private key and non-secret public key Digital certificates give the name of a true party and his or her public key

41. 41 Figure 9-10: Digital Certificate Authentication Testing a Digital Signature Applicant performs a calculation with his or her private key Verifier tests calculation using the public key found in the true party’s digital certificate If the test succeeds, the applicant must be the true party

42. 42 Figure 9-11: Testing a Digital Signature Digital SignatureDigital Certificate Authentication Name of True Party Public Key of True Party Digital Signature Created with Private Key of Applicant. Added to each Message.

43. 43 Figure 9-10: Digital Certificate Authentication Strong Authentication The strongest method today Expensive and Time-Consuming to Implement Software must be added to clients and servers, and each computer must be configured Expensive because there are so many clients in a firm

44. 44 Figure 9-10: Digital Certificate Authentication Client Weaknesses Sometimes, only server gets digital certificate Client uses passwords or something else

45. 45 Figure 9-11: Testing a Digital Signature Verifier must test the digital signature with the public key of the true party. If the test succeeds, the applicant must have the true party’s private key. Only the true party should know this private key; so the applicant must be the true party.

46. 46 Figure 9-12: Biometric Authentication Biometric Authentication Based on bodily measurements Promises to dramatically simplify authentication

47. 47 Figure 9-12: Biometric Authentication Fingerprint Scanning Simple and inexpensive Substantial error rate (misidentification) Often can be fooled fairly easily by impostors Dominates biometrics today

48. 48 Figure 9-12: Biometric Authentication Iris Scanners Scan the iris (colored part of the eye) Irises are complex, so strong authentication Expensive (Do NOT shine light in your eyes; scanner is a camera.)

49. 49 Figure 9-12: Biometric Authentication Face Recognition Camera allows analysis of facial structure Can be done surreptitiously— without the knowledge or consent of person being scanned Very high error rate and easy to fool

50. 50 Figure 9-12: Biometric Authentication Error Rates and Deception Error and deception rates are higher than vendors claim Usefulness of biometrics is uncertain

51. Firewalls, IDSs, and IPSs

52. 52 Figure 9-13: Firewall Operation Corporate NetworkThe Internet Log File Arriving Packets Permit (Pass) Legitimate Packet Deny (Drop) Attack Packet Application Message ICMP MessageIP-H TCP-H UDP-H Static Packet Filter Firewall

53. 53 Figure 9-14: Access Control List (ACL) for a Packet Filter Firewall 1.If destination IP address = 60.47.3.9 AND TCP destination port = 80 OR 443, PASS [connection to a public webserver] 2.If ICMP Type = 0, PASS [allow incoming echo reply messages] 3.If TCP destination port = 49153 AND 65535, PASS [allow incoming packets to ephemeral TCP port numbers]

54. 54 Figure 9-14: Access Control List (ACL) for a Packet Filter Firewall 4.If UDP destination port = 49153 AND 65535, PASS [allow incoming packets to ephemeral UDP port numbers] 5.DENY ALL [deny all other packets]

55. 55 Figure 9-15: Stateful Firewall Default Operation Internal Host External Host Internally initiated communication is allowed. Externally initiated communication is stopped. X

56. 56 Figure 9-16: Application Firewalls Application Firewalls Examine application layer messages in packets Packet filter firewalls and stateful firewalls do not look at application messages at all This makes them vulnerable to certain attacks

57. 57 Figure 9-16: Application Firewalls Application Fidelity Requiring the application using a well-known port to be the application that is supposed to use that port For instance, if an application uses Port 80, application firewall requires it to be HTTP, not a peer-to-peer file transfer program or something else This is called enforcing application fidelity

58. 58 Figure 9-16: Application Firewalls Limited Content Filtering Allow FTP Get commands but stop FTP Put commands Do not allow HTTP connections to black-listed (banned) websites E-mail application server may delete all attachments

59. 59 Figure 9-16: Application Firewalls Antivirus Scanning Few application firewalls do antivirus filtering Packets also must be passed through separate antivirus filtering programs

60. 60 Figure 9-17: Defense in Depth with Firewalls Client with Host Firewall Software Internet Application Firewall e-mail, HTTP, etc. Main Firewall: Stateful Inspection Firewall Screening Border Router with Packet Filter Firewall Software Site

61. 61 Figure 9-18: Firewalls Log File Hardened Server IDS Hardened Client PC Network Management Console Internal Corporate Network Internet Firewall Allowed Legitimate Packet Legitimate Host Legitimate Packet Attacker

62. 62 Figure 9-18: Firewall Log File Hardened Server IDS Hardened Client PC Network Management Console Internal Corporate Network Internet Firewall Legitimate Host Attacker Attack Packet Denied Attack Packet

63. 63 Figure 9-18: Intrusion Detection System (IDS) Log File IDS Hardened Client PC Network Management Console Internal Corporate Network IDS Legitimate Host Attacker Alarm About Suspicious Packet Suspicious Packet Hardened Server Suspicious Packet

64. 64 Figure 9-18: Intrusion Prevention Systems (IPSs) Firewalls stop simple attacks IDSs can identify complex attacks involving multiple packets But many false positives (false alarms) Intrusion prevention systems (IPSs) Like IDSs, can identify complex attacks Unlike IDSs, also stop these attacks Only allowed to stop clearer complex attacks

65. 65 Figure 9-19: Cryptographic System (SSL/TLS) Applicant (Customer Client) without Digital Certificate Verifier (Merchant Webserver) with Digital Certificate Provides Protection at Transport Layer Protects all Application Traffic That is SSL/TLS-Aware (Mostly HTTP)

66. 66 Figure 9-19: Cryptographic System (SSL/TLS) Applicant (Customer Client) without Digital Certificate Verifier (Merchant Webserver) with Digital Certificate 1. Negotiation of Security Options (Brief) 2. Merchant Authenticates Self to Customer Uses a Digital Certificate Customer Authentication Is Optional and Uncommon

67. 67 Figure 9-19: Cryptographic System (SSL/TLS) Applicant (Customer Client) without Digital Certificate Verifier (Merchant Webserver) with Digital Certificate 3. Client Generates Random Session Key Client Sends to Server Encrypted by Merchant’s Public Key 4. Ongoing Communication with Confidentiality and Merchant Digital Signatures

68. 68 Figure 9-19: Cryptographic System (SSL/TLS) Perspective Initial Hand-Shaking Phases are Very Brief (Milliseconds) The Last Phase (Ongoing Communication) Is Almost All Total Communication

69. Encryption for Confidentiality

70. 70 Figure 9-20: Symmetric Key Encryption and Public Key Encryption Symmetric Key Encryption for Confidentiality Message “Hello” Encryption Method & Key Symmetric Key Party A Party B Interceptor Network Encrypted Message Encryption uses a non-secret encryption method and a secret key

71. 71 Figure 9-20: Symmetric Key Encryption and Public Key Encryption Symmetric Key Encryption for Confidentiality Encrypted Message Symmetric Key Party A Party B Interceptor Network Interceptor cannot read encrypted messages Encrypted Message

72. 72 Figure 9-20: Symmetric Key Encryption and Public Key Encryption Symmetric Key Encryption for Confidentiality Message “Hello” Encryption Method & Key Encrypted Message Message “Hello” Decryption Method & Key Symmetric Key Same Symmetric Key Party A Party B Interceptor Network Receiver decrypts the message Using the same encryption message And the same symmetric key Encrypted Message

73. 73 Figure 9-20: Symmetric Key Encryption and Public Key Encryption Public Key Encryption for Confidentiality Encrypted Message Encrypted Message Party A Party B Encrypt with Party B’s Public Key Decrypt with Party B’s Private Key Decrypt with Party A’s Private Key Encrypt with Party A’s Public Key Note: Four keys are used to encrypt and decrypt in both directions

74. 74 Figure 9-21: Other Aspects of Protection Hardening Servers and Client PCs Setting up computers to protect themselves Server Hardening Patch vulnerabilities Minimize applications running on each server Use host firewalls Backup so that restoration is possible

75. 75 Figure 9-21: Other Aspects of Protection Hardening Servers and Client PCs Client PC Hardening As with servers, patching vulnerabilities, minimizing applications, having a firewall, and implementing backup Also, a good antivirus program that is updated regularly Client PC users often make errors or sabotage hardening techniques

76. 76 Figure 9-21: Other Aspects of Protection Vulnerability Testing Protections are difficult to set up correctly Vulnerability testing is attacking your system yourself or through a consultant There must be follow-up to fix vulnerabilities that are discovered

77. Incident Response Dealing with attacks that succeed

78. 78 Figure 9-22: Incident Response Response Phases Detecting the attack If not detected, damage will continue unabated IDS or employee reports are common ways to detect attacks Stopping the attack Depends on the attack Reconfiguring firewalls may work

79. 79 Figure 9-22: Incident Response Response Phase Repairing the damage Sometimes as simple as running a cleanup utility Sometimes, must reformat a server disk and reinstall software Can be very expensive if the attacker has done much damage

80. 80 Figure 9-22: Incident Response Response Phase Punishing the attackers Easier to punish employees than remote attackers Forensic tools collect data in a manner suitable for legal proceedings

81. 81 Figure 9-22: Incident Response Major Attacks and CSIRTs Major attacks cannot be handled by the on-duty staff On-duty staff convenes the computer security incident response team (CSIRT) CSIRT has people from security, IT, functional departments, and the legal department

82. 82 Figure 9-22: Incident Response Disasters Natural and attacker-created disasters Can stop business continuity (operation) Data backup and recovery are crucial for disaster response Dedicated backup facilities versus real-time backup between different sites

83. 83 Figure 9-22: Incident Response Disasters Business continuity recovery is broader Protecting employees Maintaining or reestablishing communication Providing exact procedures to get the most crucial operations working again in correct order

84. Topics Covered

85. 85 Topics Covered A Wide Variety of Attacks Viruses and Worms Hacking (Break-in) Scanning Break-In Exploitation (delete log files, create backdoors, do damage) Denial-of-Service (DoS) Attacks Employee misuse of the Internet Growing in frequency (and viciousness)

86. 86 Topics Covered A Wide Variety of Attackers Traditional Attackers Wizard attackers Employees and Ex-Employees Criminals (Exploding) Cyberterrorists and National Governments

87. 87 Topics Covered A Management Issue, not a Technical Issue Technology does not work automatically Planning Risk analysis Comprehensive security Defense in depth

88. 88 Topics Covered Authentication and Authorization Authentication servers give consistency Passwords (weak) Digital signatures and digital certificates High security but difficult to implement Biometric authentication Could eliminate passwords Error rates and deception

89. 89 Topics Covered Firewalls Drop and log packets Packet filter firewalls and ACLs Stateful firewalls (dominate for main firewalls today) Application firewalls filter application content Usually do NOT provide antivirus filtering Defense in depth with multiple firewalls IDSs to detect complex attacks IPSs to stop some complex attacks

90. 90 Topics Covered Cryptographic Systems Negotiate security parameters Authentication Key exchange Ongoing communication (dominates) SSL/TLS Cryptographic system used in e-commerce Protects HTTP communication

91. 91 Topics Covered Encryption for Confidentiality Symmetric key encryption Both sides use the same symmetric key Dominates because fast and efficient Public key encryption Each side has a secret private key and a non- secret public key

92. 92 Topics Covered Hardening Servers and Client PCs Patching vulnerabilities Minimize applications Host firewalls Backup Clients: antivirus filtering (users may sabotage) Vulnerability Testing

93. 93 Topics Covered Incident Response Detection, stopping, repair, punishment CSIRTs for major attacks to big for the on-duty staff to handle Disaster response and business continuity recovery