Topic 10: Network Security Management - Chapter 18: Doing Business on the Internet - Chapter 20: Network Security

1. Topic 10: Network Security Management- Chapter 18: Doing Business on the Internet- Chapter 20: Network Security Business Data Communications, 4e

2. Why Networks Need Security In recent years, organizations have become increasingly dependent on the data communication networks for their daily business communications, database retrieval, distributed data processing, and the internetworking of LANs. The losses associated with security failures can be huge. More important than direct theft losses are the potential losses from the disruption of applications systems that run on computer networks. Business Data Communications, 4e

3. Loss from Hack Attacks The cost of cyberattacks to U.S. businesses doubled to $10 billion in 1999, according to estimates from the Computer Security Institute (CSI). The research group today is releasing the results of its survey of 643 large organizations, showing estimated losses of $266 million in 1999 from cybercrime, which is more than twice the amount lost in 1998. - Los Angeles Times (03/22/00) P. C1; Piller, Charles Business Data Communications, 4e

4. A Hacker’s Story • Kevin Mitnick - a famous hacker • arrested At 1:30 a.m., February 15, 1995 • released on January 21, 2000 • What has he done? • Broke into LA Unified School District’s main computers when he was in high school. • Accessed North American Air Defense Command computers • He is referred to as “electronic terrorist” for many computer break-ins he has committed. • More stories Business Data Communications, 4e

5. A True Story of Linux Hacking • How the hacker did? • Got the login for admin account • Delete netlog directory to prevent discovery • Load a DoS software bomb • Attack other computers using the bomb • How it is discovered? • When it attacks someone caught it • A complaint is sent to Tech Business Data Communications, 4e

6. A True Story of Linux Hacking From: roger rick [mailto:h4ker@hotmail.com] Sent: Sunday, February 04, 2001 2:32 PM To: J.Stalcup@ttu.edu; webmaster@ba.ttu.edu Subject: Compromised Box? I believe on of your systems on your subnet has been compromised and is now running a eggdrop on IRC EFnet. A eggdrop is a client that is always connected to the EFnet server and allows a user to get Operator status. This eggdrop could result in DoS attacks on your server if the user makes the right people angry. ÚÄÄÄÄÄ---Ä--ÄÄÄ-ÄÄÄÄÄÄ---Ä--ÄÄ-ÄÄÄÄÄÄÄÄÄ -- - | H20B0NG ( bong@geek.ba.ttu.edu <mailto:bong@geek.ba.ttu.edu> ) ³ ircname : ]real eyes realize real lies[ | channels : #shells ³ server : irc.stanford.edu ÀÄÄÄÄÄ---Ä--ÄÄÄ-ÄÄÄÄÄÄ---Ä--ÄÄ-ÄÄÄÄÄÄÄÄÄ -- - There is the bot and system information. If you are not concerned about this, sorry for wasting your time. But it could result in downtime in the long run. Look for a connection to a irc server on port 6667, It might reveal the persons IP that is using your box to connect. Thanks. Roger Business Data Communications, 4e

7. Security Threats • Passive attacks • Eavesdropping on, or monitoring, transmissions • Electronic mail, file transfers, and client/server exchanges are examples of transmissions that can be monitored • Active attacks • Modification of transmitted data • Attempts to gain unauthorized access to computer systems Business Data Communications, 4e

8. Security Threats - Type 1 Non-technical based threats and can be prevent and protected using managerial approaches. Typically, they are from disasters. • Nature disasters: flood, fire, earthquake, etc • Terror attacks • Criminal cases • Accidents by human error Direct consequences: • Destroying host computers or large sections of the network. • Damaging data storages Business Data Communications, 4e

9. How to prevent the losses from type 1 threats? • Discussion focus: If you were CIO for a large company what you should do to prevent the losses from a disaster from a managerial point of view? Business Data Communications, 4e

10. Security Threats - Type 2 These are technical attacks. Need both technical and managerial approaches to prevent and protect the attacks. • Destruction: Virus/Worm attacks • Disruption: DoS (Denial of Service) and DDoS (Distributed DoS) attack • Unauthorized access: often viewed as hackers gaining access to organizational data files and resources. • Most unauthorized access incidents involve employees. Serious intruders could change files to commit fraud or theft, or destroy information to injure the organization. • Story: Microsoft network was hacked in Oct. 2000 Business Data Communications, 4e

11. Attacks: Passive vs. Active • Passive Attacks • Eavesdropping • Monitoring • Active Attacks • Modification • Hacking • Software bombing • Disrupting Business Data Communications, 4e

12. Worm vs. Virus Business Data Communications, 4e

13. Red Alert Worm • "'Code Red' Unleashed on Web"Los Angeles Times (08/01/01) P. C3; Piller, Charles • A malicious computer worm is spreading over the Internet, causing infected computers to search the Web to find more victims. Eventually the Code Red worm, which only recently began its spread, will cause its host computers to deluge the White House Web site with a barrage of data. However, a previous version of the worm was released earlier last month against the same White House target. That version also defaced the Web sites hosted on the servers it infected with a message claiming "Hacked by Chinese," though the Chinese government has denied the worm originated in that country. Officials at the White House have since used an address-change technique to divert the data flow from Code Red computers, and the site will also remain safe from the current version. Code Red, however, will continue to spread, reaching its peak within 36 hours of its August 1st release date, according to Internet Security Systems researcher Chris Rouland. The worm is programmed to go dormant on August 28th. Business Data Communications, 4e

14. A True Story of Red Alert Attack • When: July 20, 2001 • Where: Dr. Lin’s Office • What computer: 129.118.49.94, Windows 2000 Advanced Server • How: Not known yet • Who discovered the attack: someone using DShield.org reported and they sent BACS an email • Symptoms: • When using asp scripts, the page displays: “Hacked by Chinese” • A malicious program scans ports of other computer Business Data Communications, 4e

15. Security Attacks Normal flow Interruption Interception Business Data Communications, 4e Modification Fabrication

16. Preventing Unauthorized Access Approaches to preventing unauthorized access: • Developing a security policy • Developing user profiles • Strengthen physical security and software security • Securing dial-in service system • Fix security holes • Using firewall • Using encryption A combination of all techniques is best to ensure strong security. Business Data Communications, 4e

17. Securing Network Access Points What is a firewall: A router, gateway, or special purpose computer that examines packets flowing into and out of a network and restricts access to the organization’s network. Why using firewall: With the increasing use of the Internet, it becomes important to prevent unauthorized access to your network from intruders on other networks. Case Study: Attack to a firewall Business Data Communications, 4e

18. Securing Network Access Points Packet-level firewall: • Examines the source and destination address of every network packet that passes through it and only allows packets that have acceptable source and destination addresses to pass. • Vulnerable to IP-level spoofing, accomplished by changing the source address on incoming packets from their real address to an address inside the organization’s network. • Many firewalls have had their security strengthened since the first documented case of IP spoofing in December 1994. Business Data Communications, 4e

19. *Spoof • "Spoof" was a game invented in 1933 by an English comedian, Arthur Roberts. Webster's defines the verb to mean (1) to deceive or hoax, and (2) to make good-natured fun of. On the Internet, "to spoof" can mean: • To deceive for the purpose of gaining access to someone else's resources (for example, to fake an Internet address so that one looks like a certain kind of Internet user) • To simulate a communications protocol by a program that is interjected into a normal sequence of processes for the purpose of adding some useful function • To playfully satirize a Web site. Business Data Communications, 4e

20. Application-level Firewall Application-level firewall • Acts as an intermediate host computer or gateway between the Internet and the rest of the organization’s network. • In many cases, needs special programming codes to permit the use of application software unique to the organization. Difference: • packet-level firewalling - prohibits only disabled accesses • application-level firewalling - permits only authorized accesses Business Data Communications, 4e

21. Proxy Server Proxy server - the technology for firewalls • Uses an address table to translate network addresses inside the organizations into fake addresses for use on the Internet (network address translation or address mapping). This way systems outside the organization never see the actual internal IP addresses. • Is becoming the application-level firewall of choice. Many organizations use a combination of packet-level and application-level firewalls. Business Data Communications, 4e

22. Network Address Translation (NAT) • The process of translating between one set of private addresses inside a network and a set of public address outside the network. • Transparent • A NAT proxy server uses an address table to translate the private IP addresses used inside the organization into proxy IP address used on the Internet. It uses the source port number in the TCP packet to a unique number that it uses as an index into its address table to find the IP address of the actual sending computer in the internal network. Business Data Communications, 4e

23. *Proxy Server Software There are numerous proxy server software products on the market, priced ranging $300 to $1000 currently. Examples are: • Microsoft Proxy Server [http://www.microsoft.com/proxy/default.asp], • Netscape Proxy Server [http://home.netscape.com/proxy/v3.5/], • Novell BorderManager [http://www.novell.com/bordermanager/] • Squid [http://squid.nlanr.net], • Harvest [http://harvest.transarc.com], • WinGate [http://www.wingate.com], • WinProxy [http://www.ositis.com/dloadfr.htm], etc. Business Data Communications, 4e

24. *Proxy Server Features • Reverse hosting. • Reverse proxy. • Multi-protocol support. • Virtual private networking ability. • Application-level proxy • Circuit level proxy with SOCKS 4 client support and SOCKS 5 logic policy support. • Secure Sockets Layer (SSL) tunneling. • Authentication. • Enterprise security management such as LDAP based user/group/password management for proxy authentication, Simple Network Management Protocol (SNMP) support, etc. Business Data Communications, 4e

25. (Demilitarized Zone) Business Data Communications, 4e

26. DMZ • Features: • Allows limited accesses to DMZ from the outside (Using a packet level firewall) • Prevent unauthorized accesses to departmental networks from the Internet (using a proxy server) • Allows full accesses to DMZ and the Internet from internal networks • Limits inter-departmental accesses (using the proxy server for each department) Business Data Communications, 4e

27. Network Eavesdropping Another way to gain unauthorized access, where the intruder inserts a listening device or computer into the organization’s network to record messages. Targets: • Network cables, • Network devices such as controllers, hubs, and bridges Certain types of cable can impair or increase security by making eavesdropping easier (i.e. wireless) or more difficult (i.e. fiber optic). Physical security of the network’s local loop and interexchange telephone circuits is the responsibility of the common carrier. Business Data Communications, 4e

28. Trojan Horse - A Malicious Sniffer A tiny program that runs on a workstation (PC or Macintosh). In its simplest form, it simply records every key pressed, including your username and password when logging onto any computer network. Trojan Horse may steal the important security information without awareness. Business Data Communications, 4e

29. Outline of Encryption • Symmetric key encryption • Public-key encryption • Key management • Digital signature • Digital certificate • Certificate authority Business Data Communications, 4e

30. Encryption Encryption: A means of disguising information by the use of mathematical rules known as algorithms to prevent unauthorized access. Five components to the algorithm • Plaintext: The original readable message or data • Ciphertext: encrypted message produced as output. • Encryption algorithm: Performs various substitutions and transformations on the plaintext. • Secret key: Input to the encryption algorithm. Substitutions and transformations performed depend on this key • Decryption algorithm: Encryption algorithm run in reverse. Uses ciphertext and the secret key to produce the original plaintext. Business Data Communications, 4e

31. Using Encryption Today, the U.S. government considers encryption to be a weapon, and regulates its export in the same way it regulates the export of machine guns or bombs. The government is also trying to develop a policy called key escrow (key recovery), requiring key registration with the government. Business Data Communications, 4e

32. Encryption Methods • The essential technology underlying virtually all automated network and computer security applications is cryptography • Two fundamental approaches are in use: • conventional encryption, also known as symmetric encryption • public-key encryption, also known as asymmetric encryption Business Data Communications, 4e

33. Conventional Encryption Operation Business Data Communications, 4e

34. Conventional Encryption Requirements & Weaknesses • Requirements • A strong encryption algorithm • Secure process for sender & receiver to obtain secret keys • Methods of Attack • Cryptanalysis • Brute force Business Data Communications, 4e

35. Symmetric Key Encryption - DES Data encryption standard (DES): • A commonly used encryption algorithm. • Symmetric (the key used to decrypt a particular bit stream is the same one used to encrypt it) Symmetric algorithms can cause problem with key management; keys must be dispersed and stored carefully. A 56-bit version of DES is the most commonly used encryption technique today. Business Data Communications, 4e

36. Data Encryption Standard (DES) • Adopted in 1977, reaffirmed for 5 years in 1994, by NBS/NIST • Plaintext is 64 bits (or blocks of 64 bits), key is 56 bits • Plaintext goes through 16 iterations, each producing an intermediate value that is used in the next iteration. • DES is now too easy to crack to be a useful encryption method Business Data Communications, 4e

37. Triple DEA (TDEA) • Alternative to DES, uses multiple encryption with DES and multiple keys • With three distinct keys, TDEA has an effective key length of 168 bits, so is essentially immune to brute force attacks • Principal drawback of TDEA is that the algorithm is relatively sluggish in software Business Data Communications, 4e

38. Public-Key Encryption • Based on mathematical functions rather than on simple operations on bit patterns • Asymmetric, involving the use of two separate keys • Misconceptions about public key encryption • it is more secure from cryptanalysis • it is a general-purpose technique that has made conventional encryption obsolete Business Data Communications, 4e

39. Public-Key Encryption Operation Business Data Communications, 4e

40. Public-Key Signature Operation Business Data Communications, 4e

41. Characteristics of Public-Key • Infeasible to determine the decryption key given knowledge of the cryptographic algorithm and the encryption key. • Either of the two related keys can be used for encryption, with the other used for decryption. • Slow, but provides tremendous flexibility to perform a number of security-related functions • Most widely used algorithm is RSA, invented by Ron Rivest, Adi Shamir and Len Adleman at MIT in 1977. Business Data Communications, 4e

42. Conventional EncryptionKey Distribution • Both parties must have the secret key • Key is changed frequently • Requires either manual delivery of keys, or a third-party encrypted channel • Most effective method is a Key Distribution Center (e.g. Kerberos) Business Data Communications, 4e

43. Public-Key EncryptionKey Distribution • Parties create a pair of keys; public key is broadly distributed, private key is not • To reduce computational overhead, the following process is then used: 1. Prepare a message. 2. Encrypt that message using conventional encryption with a one-time conventional session key. 3. Encrypt the session key using public-key encryption with recipient’s public key. 4. Attach the encrypted session key to the message and send it. Business Data Communications, 4e

44. Digital Signature • An electronic message that can be used by someone to authenticate the identity of the sender of a message or of the signer of a document. • Can also be used to ensure that the original content of the message or document that has been conveyed is unchanged. • Additional benefits: • Easy transportation, not easily repudiated, not imitated by someone else, and automatically time-stamped. Business Data Communications, 4e

45. Digital Signature Process Business Data Communications, 4e

46. Public Key Certificates 1. A public key is generated by the user and submitted to Agency X for certification. 2. X determines by some procedure, such as a face-to-face meeting, that this is authentically the user’s public key. 3. X appends a timestamp to the public key, generates the hash code of the result, and encrypts that result with X’s private key forming the signature. 4. The signature is attached to the public key. Business Data Communications, 4e

47. Certificate Authority A certificate authority is a trusted organization that can vouch for the authenticity of the person or organization using authentication. • A person wanting to use a CA registers with the CA and must provide some proof of identify. • The CA issues a digital certificate that is the requestor's public key encrypted using the CA's private key as proof of identify. • This certificate is then attached to the user's email or Web transactions in addition to the authentication information. • The receiver then verifies the certificate by decrypting it with the CA's public key -- and must also contact the CA to ensure that the user's certificate has not been revoked by the CA. • For higher level security certification, the CA requires that a unique “fingerprint” (key) be issued by the CA for each message sent by the user. Business Data Communications, 4e

48. *VeriSign, Inc • Headquartered in Mountain View, California, a leading provider of Internet trust services authentication, validation and payment - needed by Web sites, enterprises, and e-commerce service providers to conduct trusted and secure electronic commerce and communications over IP networks. • To date, VeriSign has issued over 215,000 Web site digital certificates and over 3.9 million digital certificates for individuals. Business Data Communications, 4e

49. *VeriSign "Group Approves VeriSign's Control Over Web Addresses” Wall Street Journal (04/03/01) P. B4; Bridis, Ted In a 12-3 vote, ICANN's board approved its new deal with VeriSign, allowing the company to retain control of the .com domain without divesting portions of its business. By Dec. 2002, VeriSign will give up the .org domain, and the .net domain will be surrendered at a later date, although VeriSign will have a chance to bid for control of the .net domain. There were a few changes made to the agreement. The $10,000 fee that registrars pay to VeriSign was dropped and VeriSign now has to spend $200 million toward the research necessary to create a directory of all domain names. Further, VeriSign must keep the registrar and registry portions of its business separate or it will face fines. The U.S. Commerce Department still has to approve the deal, and four members of Congress have suggested that the Commerce Department "fully analyze" competitive concerns stemming from the new deal. These suggestions, which were made by Reps. (http://www.washingtonpost.com/wp-dyn/articles/A35085-2001Apr3.html) Business Data Communications, 4e

50. Secure Transactions for E-Payment Secure transactions must have at least the following characteristics: Confidentiality: others cannot eavesdrop on an exchange. Integrity: the messages received are identical to the messages sent. Authenticity: you are assured of the persons with whom you are making an exchange. Non-Repudiation: none of the involved parties can deny that the exchange took place. Business Data Communications, 4e