Chapter 5:-SECURITY IN NETWORK

Definition
-A computing network is a computing environment with more than one independent processors
-May be multiple users per system
-Distance between computing systems is not considered (a communications media problem)
-Size of computing systems is not relevant
Network resources
*Computers
*Operating system
*Programs
*Processes
*People
Basic terminology
*Node -Single computing system in a network.
*Host -A single computing system's processor.
*Link-A connection between two hosts.
*Topology-The pattern of links in a network.
Types of Network
*Transmission technology-Broadcast networks,Point-to-point networks
*Coverage/scale-MAN,WAN,LAN
Network Topology
*Bus Topology
-To provide a single communication network on which any node can place information and from which any code can retrieve information
-Attachments to the bus do not impact the other nodes on the bus

*Star Topology
-Has a central switch
-All nodes wishing to communicate do so through the central host
-The central host receives all messages, identifies the addresses, selects the link appropriate for that addresses and forwards the messages

*Ring Topology

-To connect a sequence of nodes in a loop or ring
-Can be implemented with minimum cabling
-Containing a token can control a “synchronous” loop

*Mesh Topology
-Each node can conceptually be connected directly to each other node
-Has integrity and routing advantages
-Not easily subject to destructive failures
-Routing logic can be used to select the most efficient route through multiple nodes

LAYER

Advantages of Computing Networks

*Resource sharing -Reduces maintenance and storage costs.

*Increased reliability (i.e. availability of service) -if one system fails users can shift to another.
*Distributing the workload -Workload can be shifted from a heavily loaded system to an underutilized one.
*Expandability -System is easily expanded by adding new nodes
Who cause security problem
#Hacker
#Spy
#Student
#Businessman
#Ex-employee
#Stockbroker
#Terrorist
Network security problem area
*Authentication-Deals with determining whom you are talking to before entering into a business deal or before revealing sensitive information
*Secrecy-What usually comes to mind when people think about network security
*Non-repudiation-Deals with signature
*Integrity control-Keeping information is not modified, add or delete by unauthorized user
Threats in Networks
  **Security Exposures
*Privacy -With many unknown users on a network, concealing sensitive data becomes more difficult.
*Data Integrity -Because more nodes and more users have potential access to a computing system, the risk of data corruption is higher.
*Authenticity -It is difficult to assure the identity of a user on a remote system.
*Covert channels -Networks offer more possibilities for construction of covert channels for data flow.
NETWORKS SECURITY CONTROL

• Encryption
• Strong Authentication
• IPSec,VPN,SSH
• Kerberos
• Firewall
• Intrusion Detection System (IDS)
• Intrusion Prevention System (IPS)
• Honeypot

Hacking and prevention
*Hacker Behavior Example

1. select target using IP lookup tools
2. map network for accessible services
3. identify potentially vulnerable services
4. brute force (guess) passwords
5. install remote administration tool
6. wait for admin to log on and capture password
7. use password to access remainder of network

BIOMETRIC TEHNOLOGY

EXAMPLE BIOMETRIC

BASIC PROCESS

BIOMETRIC SYSTEM

BIOMETRIC IMAGE IN FACE

BIOMETRIC FACT

TYPE

COMPARISSON

Chapter 4:-AUTHENTICATION & ACCES CONTROL

AUTHENTICATION

-Verification of identity of someone who generated some data.

-Relates to identity verification.

-classifications of identity verification:
#by something known e.g. password
#by something possessed e.g. smart card, passport
#by physical characteristics (biometrics) e.g. finger prints, palm prints, retina, voice
#by a result of involuntary action : signature

-Requirements – must be able to verify that:
¤Message came from apparent source or author
¤Contents have not been altered
¤Sometimes, it was sent at a certain time or sequence

-Protection against active attack (falsification of data and transactions)

PASSWORD
¨Protection of passwords ¤Don’t keep your password to anybody ¤Don’t write or login your password at everywhere ¤Etc. ¨Choosing a good password ¤Criteria: -Hard to guess and easy to remember ¤Characteristics of a good password -Not shorter than six characters -Not patterns from the keyboard -Etc. ¨Calculations on password ¤Password population, N =rs ¤Probability of guessing a password = 1/N ¤Probability of success, P=nt/N
***Support for password compliance reporting and strong authentication -OneSign gives organizations a variety of powerful tools for password authentication, including: *Automated password generation and changes, including the ability to generate strong random passwords on behalf of end-users. *Self-service password reset - enabling users to securely reset their own passwords. *Password authentication policy implementation. *Built-in support for strong authentication options such as fingerprint biometrics, smart cards. proximity cards, USB tokens, and more. *Pre-built and customized reports that track password authentication and access and provide data on who accessed what, how, when, and from where *Audit logs of access and password change activity, delivering the information IT departments need to enhance and enforce compliance across the enterprise. *Support for end-user workflow including shared workstations and fast user switching.
***Techniques for guessing passwords*** -Try default passwords. -Try all short words, 1 to 3 characters long. -Try all the words in an electronic dictionary(60,000). -Collect information about the user’s hobbies, family names, birthday, etc. -Try user’s phone number, social security number, street address, etc. -Try all license plate numbers -Use a Trojan horse -Tap the line between a remote user and the host system.

BIOMETRIC

¨The term is derived from the Greek words bio (= life) and metric (= to measure)
¨Biometrics is the measurement and statistical analysis of biological data
¨In IT, biometrics refers to technologies for measuring and analysing human body characteristics for authentication purposes
¨Definition by Biometrics Consortium – automatically recognising a person using distinguishing traits

#How does it works?
¨Each person is unique
¨What are the distinguishing traits that make each person unique?
¨How can these traits be measured?
¨How different are the measurements of these distinguishing traits for different people

#Biometric Technologies
¤Fingerprint biometrics – fingerprint recognition
¤Eye biometrics – iris and retinal scanning
¤Face biometrics – face recognition using visible or infrared light (called facial thermography)
¤Hand geometry biometrics – also finger geometry
¤Signature biometrics – signature recognition
¤Voice biometrics – speaker recognition
#Classification of biometric methods
¨Static
¤Fingerprint recognition
¤Retinal scan
¤Iris scan
¤Hand geometry
¨Dynamic
¤Signature recognition
¤Speaker recognition
¤Keystroke dynamics

#Biometric system architecture
¤Data collection
¤Signal processing
¤Matching
¤Decision
¤Storage
¤Transmission

#Biometric system model

ACCES CONTROL

¨“The prevention of unauthorized use of a resource, including the prevention of use of a resource in an unauthorized manner“
¤central element of computer security
¤assume have users and groups
nauthenticate to systemassigned access rights to certain resources on system

Requirements

¨reliable input
¨fine and coarse specifications
¨least privilege
¨separation of duty
¨open and closed policies
¨policy combinations, conflict resolution
¨administrative policies

Elements

¨subject - entity that can access objects

¤a process representing user/application

¤often have 3 classes: owner, group, world

¨• object - access controlled resource

¤e.g. files, directories, records, programs etc

¤number/type depend on environment

¨• access right - way in which subject accesses an object

¤e.g. read, write, execute, delete, create, search

ACCESS CONTROL MATRIX

-Access Control Matrix or Access Matrix is an abstract, formal security model of protection state in computer systems, that characterizes the rights of each subject with respect to every object in the system

-An Access Control Matrix is a table in which

*each row represents a subject,

*each column represents an object, and

*each entry is the set of access rights for that subject to that object.

-ACM entry can also be a function that determines rights.

*E.g. one subject may not be able to access an object when another subject is already writing modifying it

Access control List

In computer security, an access control list (ACL) is a list of permissions attached to an object. The list specifies who or what is allowed to access the object and what operations are allowed to be performed on the object. In a typical ACL, each entry in the list specifies a subject and an operation: for example, the entry (Alice, delete) on the ACL for file WXY gives Alice permission to delete file WXY.

UNIX File Concepts

-UNIX files administered using inodes

*control structure with key info on file

-attributes, permissions of a single file

*may have several names for same inode

*have inode table / list for all files on a disk

-copied to memory when disk mounted

-directories form a hierarchical tree

*may contain files or other directories

*are a file of names and inode numbers

UNIX File Access Control

*“set user ID”(SetUID) or “set group ID”(SetGID)

*system temporarily uses rights of the file owner / group in

*addition to the real user’s rights when making access

*control decisions-enables privileged programs to access files / resources not

*generally accessible

*sticky bit

on directory limits rename/move/delete to owner

*superuser-is exempt from usual access control restrictions

UNIX Access Control Lists

• modern UNIX systems support ACLs
• can specify any number of additional users / groups and associated rwx permissions
• ACLs are optional extensions to std perms
• group perms also set max ACL perms
• when access is required-select most appropriate ACL
• owner, named users, owning / named groups, others-check if have sufficient permissions for access

File Permissions
*files have two owners: a user & a group
*each with its own set of permissions
*with a third set of permissions for other
*permissions are to read/write/execute in order user/group/other, cf.
-rw-rw-r-- 1 maestro user 35414
Mar 25 01:38 baton.txt
*set using chmod command


Directory Permissions
*read = list contents
*write = create or delete files in directory
*execute = use anything in or change working directory to this directory
*e.g.
$ chmod g+rx extreme_casseroles
$ ls -l extreme_casseroles drwxr-x--- 8 biff drummers 288 Mar 25 01:38 extreme_casseroles

Numeric File Permision

Chapter 3:-MODERN CRYPTOGRAPHY

Modern Cryptography Algorithm

*The encryption algorithm may act on a bit-string in a number of ways.
-stream ciphers where the sequence is encrypted bit-by-bit.
-block ciphers, where the sequence is divided into blocks of a predetermined size.
-ASCII requires 8 bits to represent one character, and so for a block cipher that has 64-bit blocks, the encryption algorithm acts on eight characters at once.
*Since most modern algorithms operate on binary strings we need to be familiar with a method of combining two bits called Exclusive OR and often written as XOR or .
0  0 = 0, 0  1 =1,
1  0 = 1 and 1  1 = 0

#Stream ciphers
-they convert one symbol of plaintext immediately into a symbol of ciphertext
-depends on symbol, key and control information of encipherment algorithm


#Block ciphers
-encrypt a group of plaintext symbols as one block
-examples are transposition ciphers
e.g, in columnar transposition, the entire message is translated as one block, block size need not have any particular relationship to the size of the character


**DES Cryptography is a 64 bits Symmetric Key Algorithm. Initially, IBM developed 128 bit algorithm called "Lucifer".


**Later, NSA modified the algorithm and named the algorithm as DEA (Data Encryption Algorithm) and the Standard is known as DES.


DES Cryptography Basics
DES is a,
-64 bit,
-Symmetric Key,
- Block Cipher,
-Performing 16 rounds of Transposition and Substitution.


Typical steps of DES Encryption Process:


Step 1: Divide the message into 64 bit size blocks.
Step 2: Take one block at a time.
Step 3: Perform 16 rounds of transposition and substitution.
DES Key determines the order and type of the Transposition and Substitution functions.


DES Modes of Operation


There are different modes of operation. Let's see few of them.


1. Electronic Code book
2. Cipher block chaining
3. Cipher Feedback
4. Output Feedback


DES - Electronic Code Book

The picture shows exact functioning of the ECB mode

1. Same Key is used to encrypt all the (64 bits) blocks.

2. The key determines the order and type of Substitution and Transposition functions.
3. Suitable only for encrypting small messages.
4. Can be used to encrypt specific fields in the database.
5. This mode is faster than other DES modes. Because each block is encrypted independently.
6. Not suitable for Large messages as it uses same key for all blocks. Hackers may identify the Key easily using Frequency Analysis.


DES - Cipher Block Chaining
1. Divide the message into 64 bits block.
2. Use 64 bit Initialization Vector to modify (XOR) the first block.
3. Encrypt the first block using the Substitution and Transposition functions as specified in the Key.
4. Use the first cipher block to modify (XOR) the Second block.
5. Repeat the procedure from step 3 for other blocks.
6. Suitable for encrypting Large messages.

DES Cryptography - Cipher Feedback Mode


1. Divide the message into 8 bits block.
2. Algorithm generates keystream, using the Initialization Vector and the Key.

3. Use the Keystream to Encrypt (XOR) the Plain text.

4. Use the resulting Cipher text to create a Key stream for the next block.

5. Suitable for encrypting Small messages.

RSA

RSA is an asymmetric algorithm named after its inventors,

1. Ron Rivest,
2. Adi Shamir,
3. Leonard Adleman
In cryptography, this standard is used for,


1. Signing (used in Digital Signatures)
2. Encryption, and
3. Key Exchange
-The logic used here is very interesting one. If you would like to read the algorithm with an example refer Wikipedia.
-The main disadvantage of this asymmetric algoritm is Low Speed. It's slower than the other encryption standards.
-It has been implemented in NICs, OS (Windows, Sun and Novell) and various applications.
-It is also included in some of the security protocols like,
1. SSL,
2. S/WAN, and
3. S/MIME


Scenario 1 - Digital Signature
In case of digital signature, the message integrity is assured using the message digest value produced using the hashing algorithm (SHA). Then the message digest is encrypted using the Private key.


Let's see how the documents are digitally signed using Encryption and SHA.
1. Message Authentication is assured by encrypting the hash value with the sender's private Key.
2. Integrity is verified using the message digest value.



 
 
Scenario 2 - Encryption
Let's assume Mr. A wants to send a confidential message to Mr. B. Mr. A has to encrypt the message with public key of Mr. B.
Let's see how this asymmetric key algorithm can be used to encrypt the message.

Scenario 3 - Encryption for Key distribution

Let's assume Mr. A wants to send a LARGE confidential message to Mr. B. Mr. A encrypted the message with some symmetric key, say, AES.

RSA Security

*possible approaches to attacking RSA are:

*brute force key search (infeasible given size of numbers)
*mathematical attacks (based on difficulty of computing ø(n), by factoring modulus n)
*timing attacks (on running of decryption)
*chosen ciphertext attacks (given properties of RSA

RSA Use

**to encrypt a message M the sender:
-obtains public key of recipient PU={e,n}
-computes: C = Me mod n
**to decrypt the ciphertext C the owner:
-uses their private key PR={d,n}
-computes: M = Cd mod n
**note that the message M must be smaller than the modulus n (block if needed)

Key Setup

• Select primes: p=17 & q=11
• Compute n = pq =17 x 11=187
• Compute ø(n)=(p–1)(q-1)=16 x 10=160
• Select e: gcd(e,160)=1; choose e=7
• Determine d: de=1 mod 160 and d < 160 Value is d=23
• Publish public key PU={7,187}
• Keep secret private key PR={23,187}

En/Decryption

sample RSA encryption/decryption is:
-given message M = 88 (number 88<187)
-encryption:
C = Me mod n
C = 887 mod 187 = 11
-decryption:
M = Cd mod n
M = 1123 mod 187 = 88

Methods of Attack
*Four general attacks can be perform against encrypted information:
-Ciphertext-only attack:-guessing the plaintext or using frequency analysis
-Known Plaintext:-guess using known pliantext.
-Chosen-plaintext
-Chosen-ciphertext attack
*There are also specific attacks that can be launched against encryption systems.

-Brute-Force attack:-Exhaustive key search - trying every possible combination.
-Replay attacks:-Taking encrypted information and playing it back at a later point in time.
-Man-in-the-middle attacks
-Fault in Cryptosytem