CHAPTER 2

Laws of Security

Introduction Laws of security enable user make

the judgment about the security of a system.

Some of the “laws” are not really laws, but rather behaviors that happen so often that be regarded as laws

First Law Client-site Security Doesn’t Work What is client-site? The computer that the user (or attacker) has

control over. What is client-site security? Some sort of mechanism that is being enforced

solely on the client. Reason It not possible to keep software secure from the

person sitting in front the computer

First Law Exceptions Disk Encryption – the product must require the

user to enter a password for decryption when the machine is booted.

Problems 1. It doesn’t stop the user from being deprived of

the data. 2. It doesn’t stop replace the hardware. 3. It doesn’t stop the information from being

erased if the attacker want to format the hard drive.

First Law Defense 1. Always validate data at the server in a client-

site system. 2. Treat the information received as suspect.

Second Law User Can’t Exchange Encryption Keys

without Shared Piece of Information In life scenario: the telemarketer begins tell us

about product X. we would like to purchase the product and telemarketer need our credit card number. For verifying, we need some extra info. But how do we trust?

In Encryption scenario: how do we know what computer we exchanged keys with? It might be the right person or it might be an attacker.

Second Law Reasons It is difficult to make sure we are exchanging keys

with the right party and not falling victim to a man-in-the-middle (MITM) attack.

Exceptions Using SSL (Secure Socket Layer) – provide

nothing to go to a secure Web page. It is not really an exception but its really need “the

root certificate’s public key”. Defense We must have good key management.

Third Law Viruses and Trojans Cannot Be 100

Percent Protected Reasons 1. Even a slight change can be done in the virus

code, the antivirus software won’t be able to spot it any longer.

2. The most recent set of viruses propagate so much and more quickly. It can spread via any method – web pages, e-mail and downloads.

Third Law Exceptions Modifying our behavior. How? 1. We have to install software only from a

trusted vendor. 2. We must never exchange information with

anyone when using a network. 3. Our computer would have to be physically

secure.

Third Law Defense 1. Employing the standard antivirus tools at a

minimum. 2. Make sure we know how to configure mail

server, firewalls or IDS (Intrusion Detection System).

Fourth Law Firewalls Cannot Protect 100 Percent

from Attack Reasons 1. There are so many threats – malicious

employees, physical security, modems and infected floppies.

2. Firewall are designed to permit some types of traffic while denying other traffics.

3. What is permitted or denied should reflect a written security that exist in certain organization.

Fourth Law Exceptions No exceptions, only can defense. Defense Using IDS – designed to spot bad traffic through

some mechanisms: 1. Match against known bad pattern. 2. Check for compliance against written standards. 3. Profile normal traffic and flag it that varies. IDS also have key in collecting information about

new attacks.

Fifth Law In Order for A System To Be Secure, It

Must Undergo An Independent Security Audit

Reason Most programmers only doing functionally testing

but doesn’t doing security testing. Functionally Testing – to ensure that the users

will be able to use the product without complaining.

Security Testing – mush more in-depth analysis including checking the source code.

Fifth Law One of the most secure operating system is

OpenBSD. A couple of years, OpenBSD team have done

independent auditing: 1. Audit the source code for bugs and fixing

them. 2. Fixed any bugs that found whether security

related or not. 3. Search all source code to see whether that

type of bug had been made anywhere else.

Fifth Law Exceptions Using NSA rules – software have been rated as

A1 for designing secure computer systems, especially operating system.

Defense 1. Use purchasing dollars to encourage vendors

to do better work 2. Give training to employees to contribute

security reviews for the system.

End of Chapter 2Thank You