Computer &

Network Security

 Lecture 1: Security Fundamental

Computer Security - What is it?

2
 Computer Security
美国标准局
• The NIST Computer Security Handbook defines the term computer
~

security as:
完整性可 性
↑
“the protection afforded to an automated information system ↑
in order
to attain the applicable objectives of preserving the integrity, availability
and confidentiality of information system resources” (includes
Δ
hardware,
↓
software, firmware, information/data, and telecommunications)

{
通信
保密性 硬件
软件
1 防 墙信息
火
用
Computer Security Objectives
1 个体是不是 Guthorired )

Confidentiality 机密性
• Data confidentiality
对 公开揭露
个
体 { • Assures that private or confidential information is not made available or disclosed to
unauthorized individuals
• Privacy
未授权的
Δ 0

• Assures that individuals control or influence what information related to them, may be
0

collected and stored and by whom, and to whom that information may be disclosed

Integrity 完整性
• Data integrity 特定的
• Assures that information and programs are changed only in a specified and
Δ
authorized manner
• System integrity
• Assures that a system performs its intended function in an unimpaired manner, free
from deliberate or inadvertent unauthorized manipulation of the system ( denial of service )

Availability 可 性 DOS 攻击
• Assures that systems work promptly and service is not denied to authorized ↓
users
迅速地
0 0
拒绝 …
多个 户对
服务器进 访问 ,
用
用
行
CIA Triad
Lecture 1:
Security Fundamentals
• The OSI Security Architecture
• Security attacks
• Security services
• Security mechanism
• Methods of defense

6
The OSI Security Architecture

The International Telecommunication Union (ITU) Telecommunication

Standardization Sector (ITU-T) is a United Nations-sponsored agency
that develops standards, called Recommendations, relating to
telecommunications and to Open Systems Interconnection (OSI).

ITU-T Recommendation X.800, Security Architecture for OSI, defines

such a systematic approach. The OSI security architecture is useful to
managers as a way of organizing the task of providing security.

7
The OSI Security Architecture -
Attacks, Services and Mechanisms

• Security Attack: Any action that compromises the security of

information.

• Security Mechanism: A mechanism that is designed to detect,

prevent, or recover from a security attack.

• Security Service: A service that enhances the security of data

processing systems and information transfers. A security
service makes use of one or more security mechanisms.

8
Breach of Security
Levels of Impact

• The loss could be expected to have a severe or

High catastrophic adverse effect on organizational
operations, organizational assets, or individuals

• The loss could be expected to have a

Moderate serious adverse effect on

organizational operations,
organizational assets, or individuals

• The loss could be expected

to have a limited adverse

Low effect on organizational

operations, organizational
assets, or individuals
Lecture 1:
Security Fundamentals
• The OSI Security Architecture
• Security attacks
• Security services
• Security mechanism
• Methods of defense

10
Threats and Attacks (RFC 4949)
https://tools.ietf.org/html/rfc4949
Hacker / Hacktivists

• A person who uses computers to gain unauthorized access to data /

computer resources

• Why does he hack?

• Money?
• Political / military objectives?
• Fun? Revenge? …
• Easy to do, hard to catch, harder to prosecute?
• victimless crime?

• Good man? Bad guy?

12
Targets of Attack

• Data at rest, during transmission, …

13
Targets of Attack

• You yourselves
• Your e-Banking PIN was stolen?
• Your communication was monitored?
• Your machine got virus? Malware?
• …

14
Security Attacks

•A passive attack attempts to

learn or make use of information
from the system but does not
affect system resources
•An active attack attempts to
alter system resources or affect
their operation
Passive Attacks

• Are in the nature of

eavesdropping on, or
monitoring of, transmissions
• Goal of the opponent is to
obtain information that is
being transmitted
• Two types of passive
attacks are:
• The release of message
contents
• Traffic analysis
 Active Attacks
• Involve some modification of the
data stream or the creation of a • Takes place when one entity pretends
false stream to be a different entity
Masquerade • Usually includes one of the other
• Difficult to prevent because of the forms of active attack
wide variety of potential physical,
software, and network
vulnerabilities • Involves the passive capture of a data
unit and its subsequent
• Goal is to detect attacks and to Replay retransmission to produce an
recover from any disruption or unauthorized effect
delays caused by them
• Some portion of a legitimate message
Modification is altered, or messages are delayed or
of messages reordered to produce an
unauthorized effect

Denial of • Prevents or inhibits the normal use or

management of communications
service facilities
Security Attacks

• Interruption: This is an attack on availability

• Interception: This is an attack on confidentiality
• Modification: This is an attack on integrity
• Fabrication: This is an attack on authenticity
• additional data or activity are generated that would normally not exist.
• e.g., an intruder may attempt to add an entry into a password file

18
Security Attacks (Q&A Passive or Active?)

19
Attacks on Human

• Social Engineering

Social Engineering – because there’s no patch for

human stupidity.

20
 Attacks on Human
• Phishing
• Criminally fraudulent process of attempting to acquire sensitive
information such as usernames, passwords and credit card details by
masquerading as a trustworthy entity in an electronic communication.

21
Packet Sniffing

• Network packet analyzer

22
Security = Anti-virus software?

23
Viruses, Trojans, Worms

 A virus is an executable program that sticks to another

host program. This virus can replicate itself via files
and propagate via shared floppies or disks.
 A Trojan Horse is an executable program that slips into
a system under the guise of other program. Deception
is a key characteristic of all Trojan horses.
 A worm is very similar to a virus, but virus propagate
via floppies or other media, a worm needs an active
network connection.

24
Trojan

• anything a program can do

• display a message on a certain date
• slow performance, alter display
• backdoor (backorifice, netbus), remote command window access
• Zombie – lay dormant awaiting command to attack/spam
• keyboard/net sniffer (collect passwords, SSN, credit card #s)
• spyware
• alter files, crash system
• erase files .....

• Cost: disk cleanup, lost time ($55 billion/yr 2003)

25
Morris worm 1988 – The 1st worm
• The Morris Worm was a self-replicating computer program (worm) written
by Robert Tappan Morris, a student at Cornell University, and released from
MIT on November 2, 1988. According to Morris, the purpose of the worm
was to gauge the size of the precursor “Internet” of the time - ARPANET -
although it unintentionally caused denial-of-service (DoS) for around 10% of
the 60,000 machines connected to ARPANET in 1988. The worm spread by
exploiting vulnerabilities in UNIX send mail, finger, and rsh/rexec as well as
by guessing weak passwords.
• Before spreading to a new machine, the Morris Worm checked if the
machine had already been infected and was running a Morris Worm process.
If a target machine had already been infected, the Morris Worm would re-
infect it 1 in 7 times. This practice of “1-in-7 re-infection” ensured that a user
could not completely avoid a Morris Worm infection by creating a fake
Morris Worm process to pretend his or her machine was already infected. It
also, caused some users’ machines to be infected many times - once too
many Morris Worm processes were running on a target machine it would
run out of computing resources and begin to malfunction.
• The United States v. Morris (1991) court case resulted in the first conviction
under the 1986 Computer Fraud and Abuse Act, with Morris receiving a
sentence of three years in prison, 400 hours of community service and a
$10,000 fine.
26
Point, click, attack?

• Sophisticated attack tools designed by troubled genius

• deep understanding of OS (source files)
• look for known vulnerabilities (overflows)
• lots of time
• adaptable, avoids countermeasures

• Tools available on the net, cookbook attacks, …

• Google search
• Youtube
• http://www.securitytube.net/
• …

27
Trends of Attacks

• Attacks more sophisticated, less skill required

(point/click/attack)

28
Lecture 1:
Security Fundamentals
• The OSI Security Architecture
• Security attacks
• Security services
• Security mechanism
• Methods of defense

29
 Security Services
• Defined by X.800 as:
• A service provided by a protocol layer of communicating open systems and that
ensures adequate security of the systems or of data transfers

• Defined by RFC 4949 (Internet Security Glossary) as:

• A processing or communication service provided by a system to give a specific
kind of protection to system resources

Confidentiality

A Request for Comments (RFC) is a formal document from the Internet

Engineering Task Force that is the result of committee drafting and Integrity Avalaibility
subsequent review by interested parties. Some RFCs are informational
in nature. Of those that are intended to become Internet standards,
the final version of the RFC becomes the standard and no further
comments or changes are permitted.
X.800 Service Categories

• Authentication
• Access control
• Data confidentiality
• Data integrity
• Non-repudiation
Authentication

Concerned with assuring that a communication is authentic

• Peer Entity Authentication

• Used in association with a logical connection to provide
confidence in the identity of the entities connected.
• Data-Origin Authentication
• In a connectionless transfer, provides assurance that the source of received
data is as claimed.
Access Control

• The ability to limit and control the access to host systems and
applications via communications links

• To achieve this, each entity trying to gain access must first be

indentified, or authenticated, so that access rights can be tailored
0
to the individual 筛查
Data Confidentiality

• The protection of transmitted data from passive attacks

• Broadest service protects all user data transmitted between two users over a
period of time
• Narrower forms of service includes the protection of a single message or even
specific fields within a message

• The protection of traffic flow from analysis

• This requires that an attacker not be able to observe the source and destination,
frequency, length, or other characteristics of the traffic on a communications
facility
Data Integrity

• Can apply to a stream of messages, a single message, or selected

fields within a message

• Connection-oriented integrity service, one that deals with a stream of

messages, assures that messages are received as sent with no duplication,
insertion, modification, reordering, or replays

• A connectionless integrity service, one that deals with individual messages

without regard to any larger context, generally provides protection against
message modification
Non-repudiation

• Prevents either sender or receiver from denying a transmitted

message
• When a message is sent, the receiver can prove that the alleged
sender in fact sent the message
• When a message is received, the sender can prove that the alleged
receiver in fact received the message
 Security
Services
(X.800)

https://www.itu.int/rec/T-
REC-X.800-199103-I/en
Security Services - Summary

• Confidentiality (privacy)
• Authentication (who created or sent the data)
• Integrity (has not been altered)
• Non-repudiation (the order is final)
• Access control (prevent misuse of resources)
• Availability (permanence, non-erasure)
• Denial of Service Attacks
• Virus that deletes files

38
Lecture 1:
Security Fundamentals
• The OSI Security Architecture
• Security attacks
• Security services
• Security mechanism
• Methods of defense

39
 Security
Mechanisms
(X.800)

The mechanisms are divided

into those that are
implemented in a specific
protocol layer, such as TCP or an
application-layer protocol, and
those that are not specific to
any particular protocol layer or
security service.
Relationship Between Security Services and
Mechanisms
Lecture 1:
Security Fundamentals
• The OSI Security Architecture
• Security attacks
• Security services
• Security mechanism
• Methods of defense

42
Model for Network Security
Network Access Security Model
Methods of Defense

• Encryption
• Software Controls (access limitations in a data base, in operating
system protect each user from other users)
• Hardware Controls (smartcard)
• Policies (frequent changes of passwords)
• Physical Controls

45
Methods of Defense

• Prevention, detection, response

• Authentication
• Authorization
• Auditing (intrusion detection)
• …
• Education
• Physical protection

Threats/countermeasures -- a never ending cycle ...

The bad guy only has to find one hole.

You have the hard job, you need to defend all the holes!

46
Methods of Defense - Security Standards
• Standards have been developed to cover management practices and the
overall architecture of security mechanisms and services.

• Throughout this course, we describe the most important standards in use

or that are being developed for various aspects of cryptography and
network security.

• Various organizations have been involved in the development or

promotion of these standards:
• National Institute of Standards and Technology: NIST is a U.S. federal
agency that deals with measurement science, standards, and
technology.
• Internet Society: ISOC is a professional membership society with
worldwide organizational and individual membership.
• ITU-T: The International Telecommunication Union (ITU) is an
international organization within the United Nations.
• ISO: The International Organization for Standardization (ISO) is a
worldwide federation of national standards bodies
47
 Commercial Cryptography Scheme in China

Cryptography scheme published: SM2, SM3, SM4, ZUC

• SM2 (published in 2010)

• Elliptic Curve Cryptography (ECC) based asymmetric algorithm
• Public key 512 bits
• Private key 256 bits
• Competitor of ECDSA P-256

• SM4 (published in 2012)

• Block cipher symmetric algorithm
• Block size: 128 bits
• Key length: 128 bits
• Competitor of AES-128

48
Types of Cryptographic algorithms

Symmetric Ciphers - Secret Key Cryptography (SKC)

• Uses a single key for both encryption and decryption; also

called symmetric encryption. Primarily used for privacy and
confidentiality.

Asymmetric Ciphers - Public Key Cryptography (PKC)

• Uses one key for encryption and another for decryption; also
called asymmetric encryption. Primarily used for authentication, non-
repudiation, and key exchange.

Data Integrity Algorithms - Hash Functions

• Uses a mathematical transformation to irreversibly "encrypt"

information, providing a digital fingerprint. Primarily used for message
integrity.
 Assignment 1

cryptography-and-network-security_-principles-and-practice-7th-
global-edition.pdf

Review Questions->1.3 oro 写

Problems-> 1.4(a)(c)(e)

Named after A1_xxxxxxxx.pdf, only e-version accepted.

50
用
Summary

• Computer Security Objectives • Security services

• The OSI security architecture • Authentication
• Access control
• Security attacks • Data confidentiality
• Passive attacks • Data integrity
• Active attacks
• Nonrepudiation
• Availability service
• Interruption
• Interception • Security mechanisms
• Modification • Methods of defense
• Fabrication