Download to read offline
InfoSecConcepts.ppt
- 1. Cpr E 531:Information Security Concepts Iowa State University Thomas E. (Tom) Daniels
- 2. Overview Administrivia Whatis Information? Goals of Information Security Group Session Computer and Information Assets Common Terms and Concepts Group Session
- 3. What is Information? Oxford Eng. Dict.: “Knowledge communicated concerning some particular fact, subject, or event; that of which one is apprised or told” Almost a philosophical question. But, here we are trying to protect it! Digital information Replication cost near $0
- 4. Why is InformationValuable? Competitive advantage It takes work to produce Disclosure/modification/loss could cost Lives Money Reputation Freedom Others
- 5. How do wemaintain Information’s Value? • Avoid • Prevent • Deter • Detect • Mitigate • Recover • Correct
- 6. Goals of InformationSecurity CIA model Confidentiality Integrity Availability Utility Authenticity Non-repudiation Access Control Auditability Privacy Copy protection/control Others?
- 7. Confidentiality Only authorizedsubjects should be able to read given data Also, “secrecy” Do not confuse with privacy Achieved by: Access control Cryptography
- 8. Confidentiality (cont.) Examples: Recipe for Coca-Cola Your password Business Plan “Attack at Dawn!” Source code Personnel Records Grade information
- 9. Integrity Information shouldbe modified in a controlled manner Examples of integrity policies: Only by authorized subjects In a consistent/meaningful fashion Never modify Only by a given method
- 10. Availability Applies todata and services Presence of object/service for use Enough of object/service to meet demand Sufficient speed/timeliness of access or response Fair use of shared object/service
- 11. Balancing C-I-A Situationallydependent Military values confidentiality above others Data dependent Web pages need integrity & availability Confidentiality Integrity Availability
- 12. Authenticity Confirmation ofthe identity (or other feature) of some object User authentication “I am who I say I am!” Document authorship/agreement “I wrote that document!” Group membership “I’m with the government, we’re here to help you.”
- 13. Authenticity vs. Integrity Overlap somewhat Integrity means an object doesn’t change An object is authentic if it is the same object as it claims So, if an object can change in some way and yet still retain its identity, it can be authentic but lack integrity.
- 14. Non-repudiation Example: certifiedmail Recipient must sign for a package Recipient can not deny receipt of item A subject can not later falsely deny some action Certified mail, online gaming, contracts, official orders, timestamps
- 15. Access Control “Whocan do What to Whom?” For each subject and object pair, specifies the operation (i.e. read, write) the subject can perform on the object. In theory, a giant Access Control matrix In practice, ad hoc file permission bits, access control lists, and others.
- 16. Access Control InTheory Objects Subjects password file User1’s Desktop User1 Priv.Key User1 read read,write read,write Admin read,write read,write null ...
- 17. Access Control vs.Authentication Access Control relies on authentication mechanisms Real subject? Real object? Are objects/subjects members of some group? But, they are distinct mechanisms!
- 18. Auditability Ability tostore logs (or audit trails) of transactions, and Later use those logs to detect mistakes, wrong doing, or recover from failures Often neglected or done in an ad hoc manner
- 19. Privacy Avoiding monitoring,not just of explicit content but of various behaviors as well. Not just confidentiality! Behavior tracking One approach: pseudonymous communication "The right to be left alone -- the most comprehensive of rights, and the right most valued by a free people." - Justice Louis Brandeis, Olmstead v. U.S. (1928).
- 20. Content Control/Protection Protectcopyrights on content May be software, text, music, images, video, … Prevention, deterrence, and detection techniques exist. “Trusted” hardware/software Watermarking
- 21. Review Value ofInformation What is information? Why is it valuable? Goals of Information Assurance and Security Varied and often conflicting Dependent on the data and situation
- 22. Exercise For eachof 3 given scenarios, rate the relative importance of Confidentiality, Integrity, Authentication, and Access Control, and give short reasons why you chose the ordering. Exchange results with a neighbor. Where do you disagree? Scenarios 1. Information collected/accessed via an Automatic Teller Machine 2. Semi-public web site advising stockholders 3. Control Programs on a 777 Jet
- 23. Exercise (cont.) Pick2-3 types of information that is dealt with in business and try to determine its value in some concrete way. What are the top security goal(s) for each type of information?
- 24. Computer and InformationAssets Hardware Software Data
- 25. Hardware Assets Computers,Network infrastructure, Removable media Physical Security Without physical security, you have nothing! Availability, Support, etc.
- 26. Hardware Assets: Trust Do you trust your hardware? Sources of hardware Repair of hardware Multipurpose hardware Emissions (TEMPEST)
- 27. Hardware Assets: Networking Outside Network Links Internal Network Access Points Wireless Networks Network Service Providers Firewalls Intrusion Detection Systems
- 28. Software Assets Homebrewor Legacy Do you have the source? What’s the platform? How is it supported? Is it stable? Is it stored securely?
- 29. Software Assets (cont.) Commercial Is it supported? Licensing issues Do you read them? Why this product? Quality vs. Following the herd Do you trust the vendor?
- 30. Data Assets Storedinformation owned by the organization Intellectual Property Trade Secrets Patents, Trademarks, Copyrights Intangibles Employee knowledge and training Public opinion Reputation
- 31. Common Terms andTheir Relations Threats Risk Analysis Cost-Benefit Analysis Vulnerabilities Attacks Exploits Controls
- 32. Threats • Events thatmay lead to losses Environmental (Earthquake,fires…) Traditional Miscreants • theft, vandalism, etc. “Cyber” • Viruses, network attacks, subversion of clients/servers, etc. Loss of utilities, And so on…
- 33. Risk Analysis Methodfor security planning and prioritization Quantify likelihood of a threat occurring (your risk) Estimates from industry pubs. Past Experience Your utility providers
- 34. Cost-Benefit Analysis Tryassessing costs to each risk Assess cost of measures that address each risk Consider lifetime of measures Result By reviewing the list, a prioritized list of actions may be inferred Recovery may be cheaper than prevention, deterrence may be sufficient, etc.
- 35. Vulnerability Property ofor error in a system that allow violation of expected system behavior or policy A weakness (or hole) in a system that allows some outside agent to reduce the value of the system Widely confused with attacks and exploits
- 36. Vulnerabilities Result fromerrors in Design Specification Implementation Configuration Note: if an error is in the design, no amount of correct specification, implementation, or configuration can fully eliminate it.
- 37. Vulnerabilities (cont.) Oftenoccur when people make assumptions about the environment in which their system will operate. Examples: Input length bounded Objects will not change during an operation Bandwidth/Memory will not run out
- 38. Vulnerability Examples Design Spoofability of network traffic Specification Typos in documents Implementation Buffer overflows, race conditions,… Configuration Anonymous ftp, Sendmail configurations Emergent: 2 ok systems fail when joined
- 39. Attacks Multiple levelsof definition Low level An action intended to break security policy using a supposed vulnerability High level A group of these low level attacks toward some higher goal
- 40. Exploits An exploitis a procedure that carries out a low-level attack. Often scripted Easily transferred between parties However, to exploit a vulnerability: Means to successfully attack a system by taking advantage of the vulnerability.
- 41. How are theserelated? There are often many distinct attacks on a single vulnerability Usually, only a few exploits get published The terms are not interchangeable! Attacks Vulnerabilities V Attacks On V
- 42. Controls “Countermeasures” Proceduresand/or objects put in place to prevent/ameliorate successful exploitation of vulnerabilities Training Encryption Firewalls Backup systems And many more….
- 43. Controls/Countermeasures • May helpyou Avoid Prevent Deter Detect Mitigate Recover Correct LOST
- 44. Exercises Apply the informationsecurity terms you learned above to a typical home. Briefly determine the most severe/effective vulnerabilities, threats, risks,...,controls in a typical home. Why do very few people have bars on their windows? Now, consider the home of the CEO of a fortune 500 company, and finally the White House. For each of Confidentiality, Integrity, Availability, Authenticity, and Access Control, write down a few controls that could be used. How can each be circumvented? How can the control be improved?