Chapter 10:-LEGAL AND ETHICAL ISSUES IN COMPUTER

LEGAL AND ETHICAL

*Law

- A rule of conduct or action prescribed or formally recognized as binding or enforced by a controlling authority

- Implies imposition by a sovereign authority and the obligation of obedience on the part of all subject to that authority

ETHICS

* A set of moral principles or values

* The principles of conduct governing an individual or a group

* An objectively defined standard of right and wrong

CATEGORIES OF LAW
* Civil law: represents a wide variety of laws that govern a nation or state
* Criminal law: addresses violations harmful to society and is actively enforced through prosecution by the state
* Tort law enables individuals to seek recourse against others in the event of personal, physical, or financial injury.
- Torts are enforced via individual lawsuits rather than criminal prosecutions by the state. When someone brings a legal action under tort law, personal attorneys present the evidence and argue the details rather than representatives of the state, who prosecute criminal cases.
* Private law regulates the relationship between the individual and the organization, and encompasses family law, commercial law, and labor law.
- Public law regulates the structure and administration of government agencies and their relationships with citizens, employees, and other governments, providing careful checks and balances. Examples of public law include criminal, administrative, and constitutional law

DIFFERENCES BETWEEN LEGAL AND ETHIC
*LAW
- Formal, documented
- Interpreted by courts
- Established by legislature representing everyone
- Applicable to everyone
- Priority determined by courts if two laws conflict
- Enforceable by police and courts
* ETHIC
- Described by unwritten principles
- Interpreted by individuals
- Presented by philosophers, religions, professional group
- Personal choice
- Priority determined by individual if two principles conflict


ETHICS CONCEPT IN INFORMATION SECURITY
* Ethical Differences Across Cultures
- Cultural differences can make it difficult to determine what is and is not ethical especially when considering the use of computers.
* Software License Infringement
- The individuals surveyed understood what software license infringement was but felt either that their use was not piracy, or that their society permitted this piracy in some way
* Illicit Use
- The individuals studied unilaterally condemned viruses, hacking, and other forms of system abuse as unacceptable behavior
* Misuse of Corporate Resources
- Individuals displayed a rather lenient view of personal use of company equipment.
* Ethics and Education
- Differences in the ethics of computer use are not exclusively international.
Differences are found among individuals within the same country, within the same social class, and within the same company
* Deterrence to Unethical and Illegal Behavior
- It is the responsibility of information security personnel to do everything in their power to deter these acts and to use policy, education and training, and technology to protect information and systems
- Three general categories of unethical and illegal behavior:
##Ignorance
## Accident
## Intent
* Three general categories of unethical and illegal behavior:
- Ignorance : Ignorance of the law is no excuse, however ignorance of policy and procedures is
- Accident : Individuals with authorization and privileges to manage information within the organization are most likely to cause harm or damage by accident
- Intent  :Intent is often the cornerstone of legal defense, when it becomes necessary to determine whether or not the offender acted out of ignorance, by accident, or with specific intent to cause harm or damage
* Deterrence
- Deterrence is the best method for preventing an illegal or unethical activity. - - However, it is generally agreed that laws and policies and their associated penalties only deter if three conditions are present
--Fear of penalty
-- Probability of being caught
--Probability of penalty being administered


PROTECTING PROGRAMS AND DATA
* Copyrights
- Designed to protect the expression of ideas
- Applies to a creative work such as a story and song.
- Intended to allow regular and free exchange of ideas
- Must apply to an original work and it must be in some tangible medium of expression
- To cover works in the arts, literature and written scholarship
* Patents
- Applies to the result of science, technology and engineering
- Can protect a “new and useful process, machine, manufacture or composition of matter”
- Designed to protect the device or process for carrying out an idea, not the idea itself
* Trade Secret
- Must be kept a secret
- The owner must protect the secret by any means, such as by storing it in a safe, encrypting it and by making employees sign a statement that they will not disclose the secret
- Trade secret protection can also vanish through reverse engineering


INFORMATION AND LAW
* Information as an Object
- Not depletable
- Can be replicated
- Minimal margin cost
- Value is timely
- Often transferred intangibly

Chapter 9:-INTRUSION DETECTION SYSTEM

SECURITY INTRUSION  and DETECTION

* Security Intrusion
- A security event, or combination of multiple security events, that constitutes a security incident in which an intruder gains, or attempts to gain, access to a system (or system resource) without having authorization to do.
* Intrusion Detection
- A security service that monitors and analyzes system events for the purpose of finding, and providing real-time or near real-time warning of attempts to access system resources in an unauthorized manner.


TYPES OF IDS
a)Host Based IDS (HIDS)

* Specialized software to monitor system activity to
* Detect suspicious behavior
- Primary purpose is to detect intrusions, log suspicious
- Events, and send alerts
- Can detect both external and internal intrusions
* Two approaches, often used in combination:
- Anomaly detection - defines normal/expected behavior
-- Threshold detection
--Profile based
- Signature detection - defines proper behavior
b)Network Based IDS (NIDS)

* Monitor traffic at selected points on a network
* In (near) real time to detect intrusion patterns
* May examine network, transport and/or application level protocol activity directed toward systems
* Comprises a number of sensors
- Inline (possibly as part of other net device)
- Passive (monitors copy of traffic)
c) Distributed Host Based IDS (DIDS)

IDS TECHNIQUES
* Signature detection
- At application, transport, network layers; unexpected application services, policy violations
* Anomaly detection
- Of denial of service attacks, scanning, worms
* When potential violation detected sensor sends an alert and logs information
- Used by analysis module to refine intrusion detection parameters and algorithms by security admin to improve protection

SNORT
Snort is an open source network intrusion prevention system (IPS) capable of performing real-time traffic analysis and packet-logging on IP networks. It can perform protocol analysis, content searching and; matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts and more.

* Snort rules
- Use a simple, flexible rule definition language
- With fixed header and zero or more options
- Header includes: action, protocol, source IP, source port, direction, dest IP, dest port
- Many options

HONEYPOTS

* Are decoy systems
- Filled with fabricated info
- Instrumented with monitors / event loggers
- Divert and hold attacker to collect activity info
- Without exposing production systems
* Initially were single systems
* More recently are/emulate entire networks

Chapter 8:-FIREWALL

What is Firewall?

A firewall is a dedicated appliance, or software running on another computer, which inspects network traffic passing through it, and denies or permits passage based on a set of rules.

Types of firewall

Packet Filter Rules

Firewall Basing

 Bastion host

A system that has been hardened to resist attack, and which is installed on a network in such a way that it is expected to potentially come under attack. Bastion hosts are often components of firewalls, or may be "outside" Web servers or public access systems. Generally, a bastion host is running some form of general purpose operating system (e.g., Linux, VMS, Windows) rather than a ROM-based or firmware operating system like commercial routers do. Bastion hosts are also referred to as ''gateway hosts.''

Bost-based firewall
-used to secure individual host
-available in/add-on for many O/S
-filter packet flows
-often used on servers
-advantages:
--taylored filter rules for specific host needs
--protection from both internal / external attacks
--additional layer of protection to org firewall

Personal firewall
- for providing protection to desktop PCs and small networks connected to the Internet.
- a software program used to guard and protect a computer or a network while they are connected to the Internet.
- Generally, home and small networks
-A personal firewall enforces the security policies of a computer or a network by intercepting and examining the data transportation (data packets) over the network.
- Either it allows all the data packets to enter the network except those meeting a specified criteria (restricted ones) or it deny all the data packets from entering except those that are allowed.

VPN
- a computer network that is implemented in an additional software layer (overlay) on top of an existing larger network for the purpose of creating a private scope of computer communications -
-One common application is to secure communications through the public Internet, but a VPN does not need to have explicit security features such as authentication or traffic encryption. For example, VPNs can also be used to separate the traffic of different user communities over an underlying network with strong security features, or to provide access to a network via customized or private routing mechanisms.

-VPNs are often installed by organizations to provide remote access to a secure organizational network.
-Generally, a VPN has a network topology more complex than a point-to-point connection.

Distributed Firewall

• A distributed firewall configuration involves standalone firewall devices plus host-based firewalls, personal firewall working together under a central administrative control.
• Administrators can configure host-resident firewalls on hundreds of servers and workstation as well as configuring personal firewalls on local and remote user systems. Tools let the network administrator set policies and monitor security across the entire network.

Chapter 7:-WIRELESS SECURITY

 Wireless LANs

-two or more devices using some wireless distribution method (typically spread-spectrum or OFDM radio),
-usually providing a connection through an access point to the wider internet.
This gives users the mobility to move around within a local coverage area and still be connected to the network.
The IEEE 802.11 group of standards specify the technologies for wireless LANs. 802.11 standards use the Ethernet protocol and CSMA/CA (carrier sense multiple access with collision avoidance) for path sharing and include an encryption method, the Wired Equivalent Privacy algorithm.

Comparisson

WLAN components and topologies

Types of WLAN components:

• Wireless network cards
• Wireless access points
• Wireless bridges

802.11 Components
*Two pieces of equipment defined:
-Wireless station:-A desktop or laptop PC or PDA with a wireless NIC.
-Access point:-A bridge between wireless and wired networks
:-Composed of Radio,Wired network interface (usually 802.3),Bridging software
-Aggregates access for multiple wireless stations to wired network.


The 802.11 operation modes
*Infrastructure mode
In infrastructure mode, the wireless network consists of at least one access point (AP) connected to the wired network infrastructure and a set of wireless end stations. An access point controls encryption on the network and may bridge or route the wireless traffic to a wired ethernet network (or the Internet). Access points that act as routers can also assign an IP address to your PC's using DHCP services. AP's can be compared with a basestation used in cellular networks.


This configuration is called a Basic Service Set (BSS). An Extended Service Set (ESS) consists of two or more BSSs forming a single subnetwork. Traffic is forwarded from one BSS to another to facilitate movement of wireless stations between BSSs. Almost always the distribution system which connects this networks is an Ethernet LAN. Since most corporate WLANs require access to the wired LAN for services (file servers, printers, Internet links) they will operate in infrastructure mode. This also is the case in our exercise: Wireless LAN access points in auditoria.
*Ad-Hoc Mode
Ad-Hoc mode is a set of 802.11 wireless stations that communicate directly with each other without using an access point or any connection to a wired network. This basic topology is useful in order to quickly and easily set up a wireless network anywhere a wireless infrastructure does not exist such as a hotel room, a convention center, our airport. Ad-Hoc Mode is also called peer-to-peer mode or an Independent Basic Service Set (IBSS)

802.11 Physical Layer

Originally three alternative physical layers

*Two incompatible spread-spectrum radio in 2.4Ghz ISM band:-Frequency Hopping Spread Spectrum (FHSS)-75 channels
:-Direct Sequence Spread Spectrum (DSSS)-14 channels (11 channels in US)
*One diffuse infrared layer
*802.11 speed-1 Mbps or 2 Mbps.

802.11 Data Link Layer
#Layer 2 split into:
--Logical Link Control (LLC).
--Media Access Control (MAC).
#LLC - same 48-bit addresses as 802.3.
#MAC - CSMA/CD not possible.:-Can’t listen for collision while transmitting.
#CSMA/CA – Collision Avoidance.
-Sender waits for clear air, waits random time, then sends data.
-Receiver sends explicit ACK when data arrives intact.Also handles interference.But adds overhead.
#802.11 always slower than equivalent 802.3

802.11b

##11Mbps in 2.4GHz range
##compatible

Open system authentication
##Service Set Identifier (SSID)
##Station must specify SSID to connect to the Interception
##signal week by 3 factor:
1. Wall
2. floor
3. interference

802.11
3 basic security service:
1. Authentication
2. Integrity - data will be encrypt by using WEP & WPA technique.
3. Confidential
* Some say WPA is much more secure than WEP but its actually depends on what type of shared key that actually base on ots library. the it use a simple library so it would be easy to crack and hack the network


RC4

* Ron’s Code number 4
- Symmetric key encryption
- RSA Security Inc.
- Designed in 1987.
- Trade secret until leak in 1994.
* RC4 can use key sizes from 1 bit to 2048 bits.
* RC4 generates a stream of pseudo random bits
- XORed with plaintext to create ciphertext.


WEP – SENDING
* Compute Integrity Check Vector (ICV).
- Provides integrity
- 32 bit Cyclic Redundancy Check.
- Appended to message to create plaintext.
* Plaintext encrypted via RC4
- Provides confidentiality.
- Plaintext XORed with long key stream of pseudo random bits.
- Key stream is function of
##40-bit secret key
##24 bit initialisation vector
* Ciphertext is transmitted.


WEP – RECEIVING
* Ciphertext is received.
* Ciphertext decrypted via RC4
- Ciphertext XORed with long key stream of pseudo random bits.
- Key stream is function of
## 40-bit secret key
## 24 bit initialisation vector (IV)
* Check ICV
- Separate ICV from message.
- Compute ICV for message
- Compare with received ICV


SHARED KEY AUTHENTICATION
* When station requests association with Access Point
- AP sends random number to station
- Station encrypts random number > Uses RC4, 40 bit shared secret key & 24 bit IV
- Encrypted random number sent to AP
- AP decrypts received message > Uses RC4, 40 bit shared secret key & 24 bit IV
- AP compares decrypted random number to transmitted random number
*If numbers match, station has shared secret key.


WEP SAFEGUARDS
* Shared secret key required for:
- Associating with an access point.
- Sending data.
- Receiving data.
* Messages are encrypted - Confidentiality.
* Messages have checksum - Integrity.
* But management traffic still broadcast in clear containing SSID.


PASSIVE WEP ATTACK
* If 24 bit IV is an ascending counter,
* If Access Point transmits at 11 Mbps,
* All IVs are exhausted in roughly 5 hours.
* Passive attack:
- Attacker collects all traffic
- Attacker could collect two messages:
## Encrypted with same key and same IV
##Statistical attacks to reveal plaintext
##Plaintext XOR Ciphertext = Keystream


ACTIVE WEP ATTACK
* If attacker knows plaintext and ciphertext pair
- Keystream is known.
- Attacker can create correctly encrypted messages.
- Access Point is deceived into accepting messages.
* Bitflipping
- Flip a bit in ciphertext
- Bit difference in CRC-32 can be computed


LIMITED WEP KEYS
* Some vendors allow limited WEP keys
- User types in a passphrase
- WEP key is generated from passphrase
- Passphrases creates only 21 bits of entropy in 40 bit key.
##Reduces key strength to 21 bits = 2,097,152
##Remaining 19 bits are predictable.
##21 bit key can be brute forced in minutes.

WEP Standard for Securing Wireless Networks

ACCESS POINT AUDITS
* Review security of access points.
* Are passwords and community strings secured?
* Use Firewalls & router ACLs
- Limit use of access point administration interfaces.
* Standard access point config:
- SSID
- WEP keys
- Community string & password policy


STATION PROTECTION
* Personal firewalls - Protect the station from attackers.
* VPN from station into Intranet
- End-to-end encryption into the trusted network.
- But consider roaming issues.
* Host intrusion detection - Provide early warning of intrusions onto a station.
* Configuration scanning - Check that stations are securely configured.


LOCATION OF ACCESS POINTS
* Ideally locate access points - In centre of buildings.
* Try to avoid access points
- By windows
- On external walls
- Line of sight to outside

Chapter 6:-SECURITY IN APPLICATION

Security in Email

 -SMIME

-PGP

Security in Web

-SSL

-SSH

-SET

-HTTPS

-SFTP

What is Email?

What is “Email Services”?
*Hosted Email: Lets you offer email service to your customers without the hassle. As the name implies, we host and maintain the email server, while you manage email accounts via a web interface or API. We take care of the headaches of running the system, so you can concentrate on taking care of your customers.
*Email Defense: Our anti-spam/anti-virus service, which you can use in conjuction with either our hosted email service or any other email service out there. As with hosted email, we run the system and maintain it, you provision the service and focus on customer service

What is Hosted Exchange?
-To stay competitive in today’s business environment, you need sophisticated messaging tools that provide rich and efficient access to email, calendars, contacts, and tasks. Now you can enjoy the benefits of business-class email in a pay-as-you-go model that enables you to scale up or down as needed, minimizing your financial risk.
-myhosting.com Hosted Exchange Email can help you free up valuable capital, IT staff, and other costly resources for more effective, strategic use within your organization.
-At myhosting.com, we operate your email server so you don’t have to. Based on Microsoft® Solution for Hosted Messaging and Collaboration, our infrastructure and provisioning systems enable us to offer our customers rich email, mobility, collaboration, and messaging services.

Security provided in E-mail

-Confidentiality
-Data origin authentication
-Message integrity
-Non-repudiation of origin
-Key management

MIME
**MIME = Multipurpose Internet Mail Extensions

-Extends the capabilities of RFC 822 to allow e-mail to carry non-textual content, non-ASCII character sets, long messages.
-Uses extra header fields in RFC 822 e-mails to specify form and content of extensions.
-Supports a variety of content types, but e-mail still ASCII-coded for compatibility.
-Specified in RFCs 2045-2049.

MIME Message
MIME-Version: 1.0

Content-Type: multipart/mixed; boundary="frontier"


This is a message with multiple parts in MIME format.
--frontier
Content-Type: text/plain


This is the body of the message.
--frontier
Content-Type: application/octet-stream


Content-Transfer-Encoding: base64
PGh0bWw+CiAgPGhlYWQ+CiAgPC9oZWFkPgogIDxib2R5PgogICAgPHA+VGhpcyBpcyB0aGUg
Ym9keSBvZiB0aGUgbWVzc2FnZS48L3A+CiAgPC9ib2R5Pgo8L2h0bWw+Cg==
--frontier--


E-mail Security Threats
*Two main group:
-Threats to the security of e-mail itself
-Threats to an organisation that are enabled by the use of e-mail.
*Loss of confidentiality.
-E-mails are sent in clear over open networks.
-E-mails stored on potentially insecure clients and mail servers.
-Ensuring confidentiality may be important for e-mails sent within an organisation.
*Loss of integrity.
-No integrity protection on e-mails; body can be altered in transit or on mail server.
*Lack of data origin authentication.
-Is this e-mail really from the person named in the From: field?
-How many Kenny.Paterson’s are there?
-Recall SMTP directly over telnet allows forgery of all e-mail fields!
-E-mail could also be altered in transit.
-Even if the From: field looks fine, who was logged in as Kenny.Paterson when the e-mail was composed?
-Sharing of e-mail passwords common.

S/MIME

-(Secure / Multipurpose Internet Mail Extensions) is a standard for public key encryption and signing of e-mail encapsulated in MIME.

-S/MIME is on an IETF standards track and defined in a number of documents, most importantly RFCs. S/MIME was originally developed by RSA Data Security Inc. The original specification used the recently developed IETF MIME specification with the de facto industry standard PKCS #7 secure message format.
-Change control to S/MIME has since been vested in the IETF and the specification is now layered on Cryptographic Message Syntax, an IETF specification that is identical in most respects with PKCS #7.


S/MIME support
*Enveloped Data-Encrypted content
*Signed Data-Digital signature
*Clear Signed Data-Can view content but signature must have the S/MIME capacbility
*Signed and Enveloped Data-Used both


Pretty Good Privacy
-Pretty Good Privacy (PGP) is a computer program that provides cryptographic privacy and authentication. PGP is often used for signing, encrypting and decrypting e-mails to increase the security of e-mail communications. It was originally created by Philip Zimmermann in 1991.
-PGP and other similar products follow the OpenPGP standard (RFC 4880) for encrypting and decrypting data.
-One level of processing only, so less flexible than S/MIME.
-Sign before encrypt, so signatures on unencrypted data.:-Sigs can be detached and stored separately.
PGP-processed data is base64 encoded and carried inside RFC822 message body

Web Security
-Web security includes:
*Security of server
*Security of client
*Network traffic security between a browser and a server
-SSL/TLS
#SSL/TLS widely used in Web browsers and servers to support ‘secure e-commerce’ over HTTP.
--Built into Microsoft IE, Netscape, Mozilla, Apache, IIS
--The (in)famous browser lock.
#SSL architecture provides two layers:
--SSL Record Protocol
-Provides secure, reliable channel to upper layer.
--Upper layer carrying:
-SSL Handshake Protocol, Change Cipher Spec. Protocol, Alert Protocol, HTTP, any other application protocols.
SSL/TLS Applications
*Secure e-commerce using SSL/TLS.
*Client authentication not needed until client decides to buy something.
*SSL provides secure channel for sending credit card information, personal details, etc.
*Client authenticated using credit card information, merchant bears (most of) risk.
*Very successful (amazon.com, on-line supermarkets, airlines,…)
-SSH
*SSH = Secure Shell.
--Initially designed to replace insecure rsh, telnet utilities.
--Secure remote administration (mostly of Unix systems).
--Extended to support secure file transfer and e-mail.
--Latterly, provide a general secure channel for network applications.
*SSH-1 flawed, SSH-2 better security (and different architecture).
--SSH provides security at Application layer.
--Only covers traffic explicitly protected.
--Applications need modification, but port-forwarding eases some of this (see later).
--Built on top of TCP, reliable transport layer protocol.


SSH Applications
*Anonymous ftp for software updates, patches...
-No client authentication needed, but clients want to be sure of origin and integrity of software.
*Secure ftp.
-E.g.upload of webpages to webserver using sftp.
-Server now needs to authenticate clients.
-Username and password may be sufficient, transmitted over secure SSH transport layer protocol.
*Secure remote administration.
-SysAdmin (client) sets up terminal on remote machine.
-SysAdmin password protected by SSH transport layer protocol.
-SysAdmin commands protected by SSH connection protocol.
*Guerilla Virtual Private Network.
-E.g. use SSH + port forwarding to secure e-mail communications.

-SET
*SET = an open encryption and security specification designed to protect credit card transactions on the internet
*Use SSL to secure the communication links
*Main requirements
-Confidentiality of payment and ordering information
-Integrity of all transmitted data
-Authentication of cardholder
-Authentication of merchant

How to secure  the web

*Authentication:

-Basic (username, password):-Can be used along with cookie
-Digest
*Access control via addresses
*Multi-layered:
-S-http (secure http), just for http:-Proposed by CommerceNet, pretty much dead
-SSL (TLS), generic for TCP :-https: http over SSL
-IPSec
Secure File Transfer Protocol (S/FTP)

*S/FTP is an interactive file transfer program

*Similar to ftp
*Performs all operations over an encrypted ssh transport
*Use many features of ssh such as public key authentication and compression
*S/FTP connects and logs into the specified host, then enters an interactive command mode