1. Security in Networks— Their design, development, usage… Barbara Endicott-Popovsky CSSE592/491 In collaboration with: Deborah Frincke, Ph.D. Director, Center for Secure and Dependable Systems University of Idaho

2.  Both broad survey and focused  Chapters 1-2 lay groundwork  Chapters 3 –7 Software Chapter 7 –Contrast to standalone environments –Threats –Controls –Tools: Firewalls, Intrusion detection, Secure e-mail  Chapter 9 Privacy, ethics, the law  Chapter 10 Cryptography – the how Text Book

3. In this section of the course we will look at…  Networks— their design, development, usage The Basics Threats Controls Tools Firewalls Intrusion Detection Secure e-mail Source: Pfleeger & Pfleeger

4. Agenda  I.The Basics  II. Threats  III. Controls  IV.Tools Source: Pfleeger & Pfleeger

5.  Terms Topology Media Analog/digital Protocols LAN/WAN Internet Distributed System API’s I. The Basics Source: Pfleeger & Pfleeger

6. ISO/OSI Model Source: Pfleeger & Pfleeger OSI Layer NameActivity 7Application User-level data 6Presentation Standardized data appearance 5Session Logical connection among parts 4Transport Flow control 3Network Routing 2Data Link Reliable data deliver6y 1Physical Actual communication across physical medium

7. TCP/IP vs. OSI Source: Pfleeger & Pfleeger OSI Layer NameActivity 7Application User-level data 6Presentation Standardized data appearance 5Session Logical connection among parts 4Transport Flow control 3Network Routing 2Data Link Reliable data deliver6y 1Physical Actual communication across physical medium

8. TCP/IP Source: Pfleeger & Pfleeger LayerActionResponsibilities Application Prepare messagesUser interaction, addressing Transport Convert messages to packets Sequencing, reliability, error connection Internet Convert messages to datagrams Flow control, routing Physical Transmit datagrams as bits Data communication

9. Issues  ISO/OSI: Slows things down  TCP/IP: More efficient Open  Results: TCP/IP used over Internet Introduces security issues Source: Pfleeger & Pfleeger NOTE: Study this part of the Chapter

10. II. Threats  Vulnerabilities  Attackers  Threats Precursors In transit Protocol flaws Impersonation Spoofing Message Confidentiality / Integrity threats Web Site Defacement Denial of Service (DOS) Distributed Denial of Service (DDOS) Active or Mobile Code Threats Complex Attacks Source: Pfleeger & Pfleeger

11. Vulnerabilities  Anonymity  Many points of attacks—targets and origins  Sharing  Complexity of system  Unknown perimeter  Unknown path Source: Pfleeger & Pfleeger

12. Attackers  Kiddiescripters  Industrial spies  Information warfare  Cyber terrorists  “Hactivists”  Wardrivers, etc. Profile—see Mittnick Source: Pfleeger & Pfleeger

13. Threat Spectrum Source: Deb Frincke

14. From CSI/FBI Report 2002 90% detected computer security breaches 80% acknowledged financial losses 44% (223) were willing / able to quantify losses: $455M Most serious losses: theft of proprietary information and fraud 26 respondents: $170M 25 respondents: $115M 74% cited Internet connection as a frequent point of attack 33% cited internal systems as a frequent point of attack 34% reported intrusions to law enforcement. (up from 16%-1996) Source: Deb Frincke

15. More from CSI/FBI 2002  40% detected external penetration  40% detected DOS attacks.  78% detected employee abuse of Internet  85% detected computer viruses.  38% suffered unauthorized access on Web sites  21% didn’t know.  12% reported theft of information.  6% reported financial fraud (up from 3%-- 2000). Source: Deb Frincke

16. Threats: Precursors  Port Scan  Social Engineering  Reconnaissance  OS Fingerprinting  Bulletin Boards / Chats  Available Documentation Source: Pfleeger & Pfleeger

17. Threats: In Transit  Packet Sniffing  Eavesdropping  Wiretapping  Microwaves  Satellites  Fiber  Wireless Source: Pfleeger & Pfleeger

18. Threats: Protocol Flaws Source: Pfleeger & Pfleeger  Public protocols  Flaws public  Human errors

19. Threats: Impersonation Source: Pfleeger & Pfleeger  Guessing  Stealing  Wiretapping  Eavesdropping  Avoid authentication  Nonexistent authentication  Known authentication  Trusted authentication  Delegation  MSN Passport

20. Threats: Spoofing Source: Pfleeger & Pfleeger  Masquerade  Session hijacking  Man-in-the Middle attack

21. Threats: Message Confidentiality/Integrity Source: Pfleeger & Pfleeger  Misdelivery  Exposure  Traffic flow analysis  Falsification of messages  Noise

22. Threats: Web Site Defacement Source: Pfleeger & Pfleeger  Buffer overflows  Dot-Dot and address problems  Server-Side include

23. Threats: Denial of Service (DOS) Source: Pfleeger & Pfleeger  Transmission failure  Connection flooding  Echo-chargen  Ping of death  Smurf attack  Syn flood  Traffic redirection  DNS attack  BIND Service

24. Threats: Distributed Denial of Service (DDOS) Source: Pfleeger & Pfleeger  Trojan horses planted  Zombies attack

25. Threats: Active/Mobile Code (Code Pushed to the Client) Source: Pfleeger & Pfleeger  Cookies  Per-session  Persistent  Scripts  Active code  Hostile applet  Auto Exec by type

26. Threats: Complex Attacks Source: Pfleeger & Pfleeger  Script Kiddies  Building Blocks

27. III. Controls  Design  Architecture Segmentation Redundancy Single points of failure  Encryptions Link encryption End-to-end encryption VPN’s PKI and Certificates SSH and SSL encryption IPSec Signed code Encrypted e-mail Source: Pfleeger & Pfleeger

28. Controls (cont’d.)  Content Integrity Error correcting codes Cryptographic Checksum  Strong Authentication One-time password Challenge-Response systems Digital distributed authentication Kerberos  Access controls ACL’s on routers Firewalls  Alarms and Alerts  Honeypots  Traffic Flow Security Onion routing Source: Pfleeger & Pfleeger

29. IV. Tools  Firewalls  Intrusion Detection Systems  Secure e-Mail Source: Pfleeger & Pfleeger

30. Firewalls  Packet filtering gateway  Stateful inspection firewall  Application proxy gateway  Guard  Personal firewalls Source: Pfleeger & Pfleeger

31. Intrusion Detection Systems  Signature-based IDS  Heuristic IDS  Stealth mode Source: Pfleeger & Pfleeger

32. IDS Characteristics  Goals Detect all attacks Little performance impacts  Alarm response Monitor and collect data Protect Call administrator  Limitations Avoidance strategies Sensitivity Only as good as the process/people Source: Pfleeger & Pfleeger

33. Secure e-Mail  Designs Confidentiality—encryption Message integrity checks  Examples PGP S/MIME Source: Pfleeger & Pfleeger