1. Lecture 6 Networked Application Security IT 202—Internet Applications Based on notes developed by Morgan Benton

2. For Today What is security? What is being secured? What are the ways to do it? Physical Electronic Social

3. What is Security? Refers to our desire to restrict access to resources to only those people who are authorized to consume or handle them

4. Components of Any Security Architecture Includes: Authentication—the process of discovering that a person is who he/she says he/she is Authorization—the granting of privileges based on the identity of the person (which has been confirmed using Authentication above)

5. Components of Security Architectures (continued) Definition of what resources are being secured Establishing barriers to access for those resources, which may be: Physical—walls, guards, dogs, ID badges Electronic—encryption algorithms, passwords, firewalls, etc. Social—training in appropriate use of resources

6. Tradeoffs in Creating Security Architectures An important decision for application developers is choosing an appropriate level of security for the application Adding security mechanisms adds complexity, processing overhead, increased points of failure, and therefore increased costs to creating, operating, maintaining a system

7. The Cost of Security The goal is not to create the “perfect” system that will keep out any intruder, but mainly it’s to make the cost of accessing the resources higher than the value of the resources to those who might try to obtain them illegally Finding an appropriate balance between cost and security is the challenge you’ll face

8. The Goal for this Lecture To give you enough understanding of security architectures so that you can make your own decision about what levels of security are appropriate for systems that you will build

9. Question 1: What to secure? What resources do you possess? What is their value to you and to others? YouOthers Critical Important Unimportant

10. What to secure? For networked applications the primary resources you have are: Data Processing capacity Bandwidth What is the value to your operation of each of these resources?

11. Question 2: What could happen? It is important to have a good idea of what could happen to your resources so that you’ll know what to protect against. e.g you don’t wear kevlar at home (at least I hope!)

12. What could happen to your data? Stolen Corrupted Destroyed

13. What could happen to your processing capacity? ‘Evil’ processes such as viruses can take up processing capacity.

14. What could happen to your bandwidth? People can steal your bandwidth particularly with wireless networks.

15. How to implement your security Three main aspects: Physical Electronic Social

16. Physical Security Protection of: Servers Transmission systems Clients (as much as you can) Protection from Theft Break-ins Vandalism or destruction Natural Disasters

17. Electronic Security Data Encryption Authentication and Authorization of users Firewalls Protocol TCP/IP is the main protocol for networked applications. It by itself is not secure Run other secure protocols on top of TCP/IP such as SSL, TLS, and PCT.

18. Social Security People are the weakest link People have bad passwords Store passwords in poor locations Take data out of secure locations, i.e. home. Give out information to other people knowingly or unknowingly

19. Public Key Encryption E-mail is not secure PGP was developed in the early 90’s and since then many public key encryption technologies have been developed Here’s an example of the process…