CSI 315 Web Technology and Applications Internet Security

What Security means to people • Limit data disclosure to intended set • Monitor communications to catch terrorists • Keep data from being corrupted • Destroy computers with pirated content • Track down bad guys • Communicate anonymously

Definitions • Computer crime – Action that violates state or Federal laws • Cybercrime – Crime carried out by means of the Internet • Cyberlaw – New field of law developing to respond to rise of cybercrime • Computer security risk – Any event, action, or situation – intentional or not – that could lead to the loss or destruction of computer systems or the data they contain – Not backing up data regularly is considered a computer security risk

Cybercrime: Tools and Techniques • Security loophole programs • • – Packet Sniffers – Programs like SATAN and ANGEL – Port scanners Examples at http: //www. tinhat. com/internet_security/secu rity_hole_examples. html Computer viruses Time bombs Worms Trojan horses

• • • The Attackers Hackers Crackers (Black Hats) Cyber gangs Computer virus authors Disgruntled employees Spies Cyberstalkers Sexual predators Terrorists Information warfare

What’s at Stake? • • • Computer downtime Fraud and theft of computer resources Adverse publicity Vandalism – Especially of webpages Character assassination Loss of privacy Risk to public safety Denial of service (DOS) Eavesdropping--(compromise routers, links, routing algorithms, or DNS) arbitrary messages can be sent messages in transit can be modified

Sometimes goals conflict • privacy vs company (or govt) wants to be able to see what you’re doing • losing data vs disclosure (copies of keys) • denial of service vs preventing intrusion

• Security Measures/Protocols

Examples of Security Measures • Sharing files between users – File store must authenticate users – File store must know who is authorized to read and/or update the files – Information must be protected from disclosure and modification on the wire – Users must know it’s the genuine file store (so as not to give away secrets or read bad data)

Examples cont’d • Electronic Mail – Send private messages – Know who sent a message (and that it hasn’t been modified) – Non-repudiation - ability to forward in a way that the new recipient can know the original sender – Anonymity

Examples cont’d • Electronic Commerce – Pay for things without giving away my credit card number • to an eavesdropper • or phony merchant – Buy anonymously – Merchant wants to be able to prove I placed the order

Security Measures • • • Firewalls Anti-virus software File sharing Scripting Patches Security Protocols

Fire. Wall • A firewall is a computer system dedicated to protect a LAN from the Internet at large • All traffic from/to the LAN to/from any host on the Internet at large goes through a firewall. • A firewall is not always a single computer. For example, a firewall may consist of a pair of filtering routers and one or more proxy servers running on one or more bastion hosts • Assumptions

Firewall Applications • Security Policy : Every organization that uses LANs should have rules governing acceptable use of computing resources, security practices, and operational procedures • Access Control List (ACL). – Many routers now have the ability to selectively perform their duties, based on a number of facts about a packet that comes to it. This includes things like origination address, destination service port, and so on. These can be employed to limit the sorts of packets that are allowed to come in and go out of a given network.

Routers – A Screening Router is a router configured to permit or deny traffic based on a set of permission rules.

Packet Filter • – – filters packets based on certain rules E. g Block all incoming connections from systems outside the internal network, except for incoming SMTP connections (so that you can receive email). Block all connections to or from certain systems you distrust.

Demilitarized Zone (DMZ). The DMZ is a critical part of a firewall: it is a network that is neither part of the untrusted network, nor part of the trusted network.

Proxy Server/Application Gateway – This is the process of having one host act in behalf of another. A host that has the ability to fetch documents from the Internet might be configured as a proxy server , and host on the intranet might be configured to be proxy clients. ability to direct talk to the Internet.

Bastion Host • A system that has been hardened to resist attack, and which is installed on a network in such a way that it is expected to potentially come under attack. Bastion hosts are often components of firewalls.

Security Functional Elements • Confidentiality: Content is visible only to the intended receiver • Authentication: User identity is legitimate • Authorization: Only those allowed can access • Integrity protection: Content not altered during transmit ion • Non-repudiation: Sender cannot deny sending the message

Basic Confidentiality Techniques • Cryptography – secret key – public key • Hashing Algorithms – Most popular hash today SHA-1 (secure hash algorithm) – Older ones (MD 2, MD 4, MD 5) still around

Secret Key Crypto • Two operations (“encrypt”, “decrypt”) which are inverses of each other. Like multiplication/division • One parameter (“the key”) • Even the person who designed the algorithm can’t break it without the key • Ideally, a different key for each pair of users

Secret key crypto, Mike and Sam share secret S • • • encrypt=f(S, plaintext)=ciphertext decrypt=f(S, ciphertext)=plaintext authentication: send f(S, challenge) integrity check: f(S, msg)=X verify integrity check: f(S, X, msg)

Operational model of encryption x plaintext E Cryptographic primitives k encryption key Ek(x) ciphertext attacker D Dk’ (Ek(x)) = x k’ decryption key • assumption: – attacker knows E and D – attacker doesn’t know the (decryption) key • attacker’s goal: – to systematically recover plaintext from ciphertext – to deduce the (decryption) key • attack models: – ciphertext-only – known-plaintext – (adaptive) chosen-ciphertext

Popular Secret Key Algorithms • DES (Data Encryption Standard: old standard, 56 -bit key, slow) • 3 DES: fix key size but 3 times as slow • RC 4: variable length key, “stream cipher” • AES: replacement for DES, will probably take over

Public Key Crypto • Two keys per user, keys are inverses of each other • sender, receiver do not share secret key • public encryption key known to all • private decryption key known only to receiver – RSA – ECC (elliptic curve crypto): smaller keys, so faster than RSA (but not for public key ops).

Public key cryptography + Bob’s public B key K K plaintext message, m encryption ciphertext algorithm + K (m) B - Bob’s private B key decryption plaintext algorithm message + m = K B(K (m)) B

Digital Signatures • One of the best features of public key • An integrity check – calculated as f(priv key, data) – verified as f(public key, data, signature) • Verifiers don’t need to know secret • vs. secret key, where integrity check is generated and verified with same key, so verifiers can forge data • Provides authentication, data integrity, and non -repudiation • Prevents Public Key forgery • Private Key used to encrypt information • Issued by Certificate Authority (Verisign, Cybertrust etc. ) •

Basic Authentication Techniques • IP layer Authentication Mechanisms – Authentication Header (AH) – Encryption Security Payload (ESP) • Packet Filtering • User. ID and Password Methods -Password Authentication Protocol (PAP)

Basic Authorization Techniques • Access Control – Physical – User. ID and Password – Acess Control Lists • Demilitarized Zone (DMZ): a neutral zone between the private LAN and the public Internet. FTP servers, Web servers and the like are located in DMZ

Basic Message Integrity Techniques • Data link layer Virtual Private Networks • Tunneling Protocols, PPP, PPTP, • Authentication Protocols AH and ESP

Basic Non- Repudiation • • Digital Signatures Message Authentication Codes (MAC) Network Address Translator (NAT) Port Address Translator (PAT)

Internet Security Protocols • HTTPS Hypertext Transport Protocol Secure) • SSL Secure Socket Layer • TLS Transport Layer Security