Session1 Security Goals

Security Goals
Stanford Foundations Computer Security Certificate Program

Course Goals
• Security Goals
• Security Design Principles
• Worms
• Buffer Overflows
• Client-State Manipulation
• Password Security
• Intro to SQL Injection
• Intro to Cross-Site Attacks
• Intro to Crypto
• Symmetric: block & stream ciphers, MACs
• Asymmetric: RSA, digital signatures, etc.
Foundations Computer Security Certificate Program

Copyright 2007 Daswani Enterprises, Inc. Licensed to SCPD. Stanford Center for Professional Development • 2
Security Goals:
Where we are going…
Security Is Holistic
Seven Key Concepts:

• Authentication
• Authorization
• Confidentiality
• Data / Message Integrity
• Accountability
• Availability
• Non-Repudiation
System Example: Web Client-Server Interaction

Security Is Holistic
Physical Security
Technological Security
• Application Security
• Operating System Security
• Network Security
Policies & Procedures
All Required!

Physical Security
• Limit access to a physical space

• Prevent asset theft and unauthorized entry
• Protect against information leakage
• Protect against document theft
Example:
Dumpster diving: gathering sensitive
information by sifting through the company’s
garbage

Application Security
Example Issues:
• Identity Verification. Only

let certain users download
valuable documents.
• Web Server Configuration:

• serve content from DB vs. files
• file types to serve?
• Web Browser Exploits

OS & Network Security
Applications like web servers rely on the operating system for

many functions
OS code likely contains vulnerabilities (e.g., buffer overflows)
OS patches eliminate vulnerabilities (e.g., Windows Update)
Network Security: prevent, detect, contain malicious traffic
Tools: Canaries, Firewalls, Intrusion Detection Systems

Policies & Procedures
• Guard sensitive corporate information

• Employees need to be aware, be educated to be somewhat
paranoid and vigilant
Example:
Social engineering attack: taking advantage of unsuspecting

employees (e.g., attacker gets an employee to divulge his
username and password)

Security Concepts
Authentication
Authorization
Confidentiality
Data / Message Integrity
Accountability
Availability
Non-Repudiation

Archetypal Characters
Alice & Bob – “good guys”

Eve – a “passive” eavesdropper
Mallory – an “active” eavesdropper
Trent – trusted by Alice & Bob
Alice Bob

Authentication
Identity Verification
How can Bob be sure that he is communicating with

Alice?
Three General Ways:

• Something you know (i.e., Passwords)
• Something you have (i.e., Tokens)
• Something you are (i.e., Biometrics)

Something you KNOW
Example: Passwords
• Pros:
Simple to implement
Simple for users to understand
• Cons:
Easy to crack (unless users choose strong ones)
Passwords are reused many times

Something you KNOW: More on Passwords
One-Time Passwords (OTP)

Honeypot passwords
Password Filtering
Aging Passwords
Pronouncable Passwords (e.g., “harciefy”)
Limited Login Attempts
Artificial Delays
Last Login
Image Authentication

Something you HAVE
OTP Cards (e.g., SecurID): generates

new password each time user logs in
Smart Card: tamper-resistant, stores

secret information, entered into a card-
reader
Token / Key (i.e., iButton)
ATM Card
Strength of authentication depends on

difficulty of copying
Something you ARE
Biometrics Technique Effectiveness Acceptance

Palm Scan 1 6
Iris Scan 2 1
Retinal Scan 3 7
Fingerprint 4 5
Voice Id 5 3
Facial Recognition 6 4
Pro: “raises the bar” Signature Dynamics 7 2
Cons: false negatives/positives, social

acceptance, key management
False positive: authentic user rejected

False negative: impostor accepted
Final Notes on Authentication
Two-factor Authentication: Methods can be

combined (i.e. ATM card)
Who is authenticating who?

• Person-to-computer?
• Computer-to-computer?
Three types (e.g. SSL):

• Client Authentication: server verifies client’s id
• Server Authentication: client verifies server’s id
• Mutual Authentication (Client & Server)
Authenticated user is a “Principal”

Authorization
Checking whether a user has

permission to conduct some action
Identity vs. Authority
Is a “subject” (Alice) allowed to access

an “object” (open a file)?
Access Control List: mechanism used

by many operating systems to
determine whether users are authorized
to conduct different actions

Access Control Lists (ACLs)
Set of three-tuples Table 1-1. A Simple ACL

• <User, Resource, User Resource Privilege
Privilege>
Alice /home/Alice/* Read, write,
• Specifies which users are execute
allowed to access which
resources with which
privileges
Bob /home/Bob /* Read, write,
Privileges can be execute
assigned based on
roles (e.g. admin)

Roles
Table 1-2. User-Role Mapping Table 1-3. Role-Based ACL

Role Resource Privilege Role Resource Privilege
Backup /home/* Read Backup /home/* Read

Operator Operator
Admin /* Read, write, Admin /* Read, write,

execute execute

Access Control Models
ACLs used to implement these models
Mandatory
• computer system decides exactly who has access to which
resources
Discretionary (e.g. UNIX)

• users are authorized to determine which other users can
access files or other resources that they create, use, or own
Role-Based (Non-Discretionary)
• User’s access & privileges determined by role

Bell-LaPadula Model
Classifications:
• Top Secret
• Secret
• Confidential
• Unclassified
3 Rules/Properties
• Simple property
• *-property
(confinement)
• Tranquility property

Confidentiality
Keep the contents of communication or data on

storage secret
Example: Alice and Bob want their

communications to be secret from Eve
Key – a secret shared between Alice & Bob
Usually accomplished with:

• Cryptography (Encryption plus more!)
• Steganography
• Access Controls
• Database Views

Message/Data Integrity
Data Integrity = No Corruption

Integrity Check: Add redundancy to data/messages
Man in the middle attack: Has Mallory tampered with the

message that Alice sends to Bob?
Techniques:
• Hashing (MD5, SHA-1, …)
• Checksums (CRC…)
• Message Authentication Codes (MACs)
Different than Confidentiality:

• A -> B: “The value of x is 1” (Ok if M sees the message)
• A -> M -> B: “The value of x is 10000” (BAD)
• A -> M -> B: “The value of y is 1” (BAD)

Accountability
Able to determine the attacker or principal
Logging & Audit Trails
Requirements:
• Secure Timestamping (OS vs. Network)
• Data integrity in logs & audit trails, must not be able to change
trails, or must be able to detect changes to logs
• Otherwise attacker can cover their tracks

Availability
Uptime, Free Storage

• Ex. Dial tone availability, System downtime limit, Web server
response time
Solutions:
• Add redundancy to remove single point of failure
• Impose “limits” that legitimate users can use
Goal of DoS (Denial of Service) attacks are to reduce

availability
• Malware used to send excessive traffic to victim site
• Overwhelmed servers can’t process legitimate traffic

Non-Repudiation
Undeniability of a transaction
Alice wants to prove to Trent that she did

communicate with Bob
Generate evidence / receipts (digitally signed

statements)
Often not implemented in practice, credit-card

companies become de facto third-party verifiers

Concepts at Work
B2B
Alice
PCs-R-US DVD- website
orders parts Factory
Is DVD-Factory Secure?

Concepts at Work
Availability:
• DVD-Factory, Inc. makes sure its web site is running 24 x 7
Authentication:
authenticates itself to Alice
(lock on bottom left of
browser)
Alice authenticates herself to DVD-Factory, Inc.
Confidentiality:
• Alice’s browser and DVD-Factory Inc. web server set up an
encrypted connection (lock on bottom left of browser)
Concepts at Work
Authorization:
• DVD-Factory, Inc. web site consults database to check if Alice
is authorized to order widgets on behalf of PCs-R-Us, Inc.
Message / Data Integrity:
• Checksums are sent as part of each TCP/IP packets
exchanged (+ SSL uses MACs)
Accountability:
• DVD-Factory, Inc. logs that Alice placed an order for Sony
DVD-R 1100
Non-Repudiation:
• Typically not provided with web sites since requires TTP.

Security Concepts: Summary
Technological Security In Context
Seven Key Security Goals
Example: Security Concepts at Work


Session1 Security Goals

Transféré par

Informations du document

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

Session1 Security Goals

Transféré par

Droits d'auteur :

Formats disponibles

Security Goals

Stanford Foundations Computer Security Certificate Program

Foundations Computer Security Certificate Program

Seven Key Concepts:

System Example: Web Client-Server Interaction

Foundations Computer Security Certificate Program

Policies & Procedures

Foundations Computer Security Certificate Program

• Limit access to a physical space

Foundations Computer Security Certificate Program

• Identity Verification. Only

• Web Server Configuration:

• Web Browser Exploits

Foundations Computer Security Certificate Program

Applications like web servers rely on the operating system for

OS code likely contains vulnerabilities (e.g., buffer overflows)

OS patches eliminate vulnerabilities (e.g., Windows Update)

Network Security: prevent, detect, contain malicious traffic

Tools: Canaries, Firewalls, Intrusion Detection Systems

Foundations Computer Security Certificate Program

• Guard sensitive corporate information

Social engineering attack: taking advantage of unsuspecting

Foundations Computer Security Certificate Program

Foundations Computer Security Certificate Program

Alice & Bob – “good guys”

Foundations Computer Security Certificate Program

How can Bob be sure that he is communicating with

Three General Ways:

Foundations Computer Security Certificate Program

Foundations Computer Security Certificate Program

One-Time Passwords (OTP)

Foundations Computer Security Certificate Program

OTP Cards (e.g., SecurID): generates

Smart Card: tamper-resistant, stores

Token / Key (i.e., iButton)

Strength of authentication depends on

Biometrics Technique Effectiveness Acceptance

Cons: false negatives/positives, social

False positive: authentic user rejected

Two-factor Authentication: Methods can be

Who is authenticating who?

Three types (e.g. SSL):

Authenticated user is a “Principal”

Checking whether a user has

Identity vs. Authority

Is a “subject” (Alice) allowed to access

Access Control List: mechanism used

Foundations Computer Security Certificate Program

Set of three-tuples Table 1-1. A Simple ACL

Foundations Computer Security Certificate Program

Table 1-2. User-Role Mapping Table 1-3. Role-Based ACL

Backup /home/* Read Backup /home/* Read

Admin /* Read, write, Admin /* Read, write,

Foundations Computer Security Certificate Program

ACLs used to implement these models

Discretionary (e.g. UNIX)

Foundations Computer Security Certificate Program

Foundations Computer Security Certificate Program

Keep the contents of communication or data on

Example: Alice and Bob want their

Key – a secret shared between Alice & Bob

Usually accomplished with:

Foundations Computer Security Certificate Program

Data Integrity = No Corruption