Intro and Overview

CYB 5272 SummaryIntro and Overview

We need to remember that the main goal of computer and information security is to protect assets such as hardware software or sensitive data, from hackers, criminals, malcontent employees, or even terrorists. Major costs can be incurred depending on the type of attack and the target of the attack. Tangible costs such as the cost of replacement and repair as well as intangible cost such as the company's reputation and its employee's both must be considered when referring to an attack occurrence. For these reasons alone, we need to think about security differently in order to prevent or at least reduce the risks of such an event from occurring. How should we think about security? I believe we should view it from the attacker's perspective. We should respect the fact that the attackers have the advantage. Attackers can choose both the time and place of the attack as well as how they are going to attack. Attackers can also identify software vulnerabilities in advance by getting a copy of it and looking at the common vulnearability database or analyzing the code itself. As in warfare attackers are the aggressors. On the other hand, we are the defenders which means we are going to have to work very hard to anticipate possible attacks and prevent them. In order to be effective at what we do we need to understand security risks. In most cases security risks are very difficult to understand. Knowing the difference the between threats ,vulnerabilities, and attacks can go a long ways in helping us to get a grasp on security risks. Threats are the potential source of an adverse event to do harm. Vulnerabilities are a weakness in a system, network, or an application through which that harm can occur therby making it subject to exploitation or misuse. Attacks basically carry out threats through malicious activities by collecting, disrupting, denying, or destroying IS resources. Once we fully understand these definitions we will have a better understanding of the security risks we are faced with. It is a well known fact that attackers usually target the three aspects of security known as confidentiality, integrity, and availability. Confidentiality in a nutshell is keeping our secrets secret. It is the property that sensitive information is not disclosed to unauthorized individuals, entities, or processes. Integrity is guarding against improper information modification or destruction, and includes ensuring information has not changed and therefore is authentic, and availability is ensuring timely and reliable access to and use of information. As defenders our goals should be to anticipate threats and control vulnerabilities as best as we can. In order to defend our systems we also need to understand the goals or motivations of attackers which in essence will give us not only the reasons for the attack but may even give us a hint as to the type of attack we can expect . As a result we can employ the use of hardware and software tools and techniques specifically designed to protect systems as well as detect and prevent attacks. Using tools and techniques such as firewalls, authetication, encryption, crytography, intrusion detection and intrusion prevention systems, along with other security controls and requirements, we can rest assured that we have everything we need for protecting assests. We can also set up policies and procedures to make systems more secure in order to recover from attacks more quickly.

Cryptography

What is Crytography? Cryptography comes from secret writing and it involves taking plaintext that is unencrypted text and converting it into ciphertext. Ciphertext is encrypted through the use of a secret piece of information kown as a key. This key is used to convert the plaintext into the ciphertext. Thus encryption is the conversion of plaintext to ciphertext through the use of a cryptographic algorithm. Encryption can by symmetric or asymmetric. There differences are very suddle. Basically symmetric uses the same key for encrypting and decrypting messages while asymmetric uses different keys for encrypting and decrypting. The process uses well-defined algorithms which today are easily broken by skilled attackers. Encryption unfortunately tends to foster security through obsecurity meaning that protection is achieved by keeping the algorithm secret. Basically, if know one knows how the encryption algorithm works then it can't be cracked. This gives a false sense of protection because eventually hidden encryption algorithms will be discovered. Using unbreakable encryption such as a one-time pad is a better option and ideal for ironclad protection. A one-time pad is where the key is the same length as the message and is used only once and is never repeated. Its difficult to break because it requires trying all possible combinations of key which could take years even centuries on long messages. Although the one-time pad isn't necesarily unbreakable, the time to break it is what keeps it safe. How do attackers reduce the difficulty of breaking encryption? In many cases they guess or steal the key. By using techniques like social engineering, espionage, and other means, most often attackers can get access to the key without even trying to break the encryption algorithm. for those attackers acting as code breakers, they look for common patterns in order to do a plaintext attack. By understanding that there are two common encryption approaches called substitution and transposition, attackers can map a strategy of how to pursue breaking the code. Substitution hides messages by replacing characters in the plaintext by other characters or symbols on a one-to-one basis. The basically attempts to confuse the reader by making the encrypted message look like a bunch of random characters; however this is not enough to safely encrypt messages. The solution to that problem is transposition which repositions the letters by following a specific algorithm. This produces a diffusion of the original letters spreading them out throughout the message and while at the same time hiding those combinations of double letters but because its a specific algorithm they can then be reconstructed later. Most modern encryption algorithms use a combination of substitution and transposition along with mathematical manipulations to further diffuse the contents of the plaintext. The best cryptographic algorithms security is based on sound mathematical principles and secret keys . Other uses of encryption include hash functions which are used to verify the integrity of a message, mixed-matched encrypt-decrypt techniques for passing secret keys back and forth between people and digital signatures for verifying a person's authentication as well a a messages integrity. Cryptography can also be used to protect software by issuing digital certificates to verify its authenticity. Program Security & Secure System Design

According to Jerome Saltzer and Michael Schroeder there are eight excellent design security principles. The first of those is called economy of mechanism that is make your programs simple and small. In essence, complexity is the enemy of security because it increase the risks of problems occurring. Keeping things simple and small can avoid problems. The second is fail-safe defaults the idea is to deny access to everyone and then allow access only to those who need it. In other words, security problems related to failure should be avoided at all costs. The third is called complete mediation every access requests should be checked for authentication every time. In other words, the access control system should be throrugh and constantly rechecked for system changes.The forth is open design the design of a system should not be secret. We cannot depend on the ignorance of potential attackers, but rather on possession of specific protection keys or passwords. Security through obsurity is always a bad idea. Then theres separation of privilege the idea that two separate keys are better than one. In other words keep privileges set apart. Two keys are more robust and flexible than one key. Next theres least privilege the idea that we should grant the minimum set of permissions to a user that is required for them to do their task. This limits the damage that can result from an accident or error and reduces the interactions among privileged programs. Also, we should have least common mechanism that is minimize the amount of shared code and data that is common to multiple users. Every shared mechanism represents a potential information path between users and must not unintentionally compromise security. Finally, we need to have psychological acceptability if the human user interface is not easy to understand and is not easy to use and users wont use it which means they wont use protection mechanisms that are built in your system. We should understand that attackers will find vulnerabilities in software and figure out a way to exploit them to attack or compromise the system. Software designers and programmers need to learn to avoid errors that can cause exploitable vulnerabilities by using secure software design principles in a a proven secure software development lifecycle. This will in essence help guide developers towards creating more secure software. Software that was designed without using secure software principes should perform security testing that focuses on finding errors in the software that might lead to security vulnerabilities. Software engineers can use something called secure software design patterns which are guidelines for how to build more secure systems. There re a number of simple but easily exploitable software errors. Things such as overly complicated designs, excessive access to data snd assumptions about the user or about valid input data, are all common errors that could be avoided with secure prctices. The most common vulnerabilities are listed on both OWASP and Mitre Corporation websites. Both of these resources allow you to get an idea of what the most common most recent vulnerabilities are and hopefully to prevent using those in your own software development. The intent of malicious code is to target the confidentiality integrity and availability of systems. In a nutshell they try to access secrets, modify or delete data, or deny access to users. Two common forms of malicious code are viruses and worms. A virus is a computer program that can replicate itself, infect a computer without permission or knowledge of the user, and then spread or propagate to another computer. A worm on the other hand is a self-replicating, self-propagating, self-contained program that uses networking mechanisms to spread itself. Both of them duplicate themselves and replicate across the network or across disk drives. Viruses require human interaction someone must open a file or start a program to activate the virus. Worms are self-activating therefore can spread much faster .we msut remember tat detection approach is perfect, It willeither miss some malicious software or or produce false alarms. There are two main approaches: the reactive approach detects known malicious software accurately by looking at its signature and the proactive approach whic looks for behavior thats suspicious but it may often be wrong and can threby trrgger a falsre alarm. Stealthy malicious code deliberately hides itself to avoid detection. Keystroke loggers are used for stealing private data such as passwords and transmiting them to the attacker. Root kits circumvent operating system protections by installing themselves places where they won't be noticed and then make changes to the system that will allow unauthorized access. Trapdoors and backdoors secretly give remote access to attackers across the network. Security controls such as good design and coding to prevent the creation of vulnerable software, security focus software testing to discover vulnerabilities in existing code, attack resilient system design and proper training to raise security awareness among employees and customers, can all be useful in detecting and preventing attacks.