Information Security

1. Information Security Rabie A. Ramadan GUC, Cairo Rabie.ramadan@guc.edu.eg Room C7 -310 Lecture 3

2. What do we need to avoid threats , vulnerability, risks and attacks ? • Access Control • Cryptography • Other Methods …..

3. Access Control Topics • Access control categories • Access control techniques • Access control administration • Access control models • Authentication methods • Data ownership • Vulnerabilities

4. Access Control • Definition of access control: • It is a collection of methods and components that supports • confidentiality • integrity • Goal: allow only authorized subjects to access permitted objects • Subject • The entity that requests access to a resource • Object • The resource a subject attempts to access

5. Access Control • Least privilege philosophy • A subject is granted permissions needed to accomplish required tasks and nothing more • Information leak • Lack of controls lets people without need to access data • E.g., physician needs data about the patient’s health and not about the insurance

6. Controls • Controls • Mechanisms put into place to allow or disallow object access • Controls organized into different categories • Administrative • enforce security rules through policies • E.g. security awareness training • Logical / technical controls • implement object access restrictions • E.g. password , encryption • Physical • limit physical access to hardware • E.g. Fences , Walls , locked doors

7. Access Control Techniques • Techniques are based on the organization’s needs and their impact to the users • Considerations include • Level of security required • User and environmental impact of security measures • Techniques differ in • The way objects and subjects are identified • How decisions are made to approve or deny access • Policies governing access

8. Access Control Designs • Access control designs define rules for users accessing files or devices • Three common access control designs • Mandatory access control • Discretionary access control • Task-based access control

9. Mandatory Access Control • Assigns a security label to each subject and object • Matches label of subject to label of object to determine when access should be granted • E.g Military Information classification • Top Secret (TS) • The highest level of classification of information on a national level. Such material would cause "exceptionally grave damage" to national security if publicly available. • Secret • Such material would cause "serious damage" to national security if publicly available.

10. Mandatory Access Control • Confidential • Such material would cause "damage“ to national security if publicly available. • Restricted • Such material would cause "undesirable effects" if publicly available. Some countries do not have such a classification. • Unclassified • Technically not a classification level, but is used for government documents that do not have a classification listed above. Such documents can sometimes be viewed by those without security clearance.

11. Discretionary Access Control • Uses identity of subject to decide when to grant an access request • All access to an object is defined by the object owner • Most common design in commercial operating systems • Generally less secure than mandatory control • Generally easier to implement and more flexible • Includes • Identity-based access control • Access control lists (ACLs)

12. Task-based Access Control or Nondiscretionary Access Control • Uses a subject’s role or task to grant or deny object access • Task objects or requirements will be granted to the user • Task-based access list may contain just one member, if necessary • Lattice-based control is a variation of non-discretionary control • Relationship between subject and object has a set of access boundaries that define rules and conditions for access

13. Access Control Administration • Once the access control technique is chosen , we need to decide on the way these techniques can be administrated • Implemented as centralized, decentralized, or hybrid • Centralized access control administration • All requests go through a central authority • Administration is relatively simple • Single point of failure, sometimes performance bottlenecks

14. Access Control Administration • Decentralized access control administration • Object access is controlled locally rather than centrally • Put the control administrator closer to the object in question • More difficult administration • Objects may need to be secured at multiple locations • More stable • Not a single point of failure • Usually implemented using security domains

15. Accountability • System auditing used by administrators to monitor • Who is using the system • What users are doing • Logs can trace events back to originating users • Process of auditing can have a negative effect on system performance • Must limit data collected in logs • Clipping levels set thresholds for when to start collecting data

16. Authentication Methods • Two-factor authentication uses two phases • Identification • Authentication • Security practices often require input from multiple categories of authentication techniques • Most complex authentication mechanism is biometrics (detection and classification of a subject’s physical attributes)

17. Authentication Methods

18. Authentication Methods • Type 1 -- What you know: • Password , PIN, and Challenge question • Password must be difficult to guess and easy to remember • At least 6 characters • Contains at least one number or any punctuation character • Do not use dictionary words • Do not use common personal data • Never write down your password • Type 2 -- What you have: • More complex than Type 1 but it is more secure since it uses special devices to read your cards for example

19. Authentication Methods • Type 3---What you are • Fingerprint, Hand geometry , Voice print, Retina/iris scan, or signature • Very complex system due to the imperfection of the nature of biometrics analysis • False Rejection rate (FRR) : the of filature of detection the right subject • False Acceptance Rate (FAR) : the rate of acceptance of invalid subjects • Crossover Error Rate (CER) : balance between FRR and FAR

20. Data Ownership • Different layers of responsibility for ensuring security of organization’s information • Data owner • Bears ultimate responsibility, sets classification levels • Data custodian • Enforces security policies, often a member of IT department • Data user • Accesses data on a day-to-day basis • responsible for following the organization’s security policies

21. Vulnerabilities • Brute force attack • Try all possible combinations of characters to satisfy Type 1 authentication (password guessing) • Dictionary attack • Subset of brute force • Instead of all possible combinations, uses a list of common passwords • Spoofing attack • Create fake login program, prompt for User ID, password • Return login failure message, store captured information

22. Policies for Vulnerability Handling • Log all data – login, transaction • Analyze data in real time • Set security alerts based on data analysis • Develop scenarios for system shut off • Disseminate policies related to vulnerability handling

23. What do we need to avoid threats , vulnerability, risks and attacks ? • Access Control • Cryptography • Other Methods …..

24. Cryptography

25. International Telecommunication Union Telecommunication Standardization (ITU-T) Provides: Services Mechanisms Security Services and Mechanisms

26. Authentication - assurance that the communicating entity is the one claimed Access Control - prevention of the unauthorized use of a resource Data Confidentiality –protection of data from unauthorized disclosure Data Integrity - assurance that data received is as sent by an authorized entity Non-Repudiation - protection against denial by one of the parties in a communication Security Services

27. Specific security mechanisms: Implemented on specific layer (OSI model) Encipherment, digital signatures, access controls, data integrity, authentication exchange, routing control, notarization Pervasive security mechanisms: Not related to a specific layer Trusted functionality, security labels, event detection Security Mechanisms

28. Model for Network Security

29. Using this model requires us to: Design a suitable algorithm for the security transformation. Generate the secret information (keys) used by the algorithm. Develop methods to distribute and share the secret information. Specify a protocol enabling the principals to use the transformation and secret information for a security service. Model for Network Security

30. Symmetric Cipher Model

31. Known as: Conventional Encryption Single-Key Encryption Plaintext Original text/msg Ciphertext Coded msg Enciphering/Encryption The process of converting the plaintext to ciphertext Deciphering/Decryption The process of converting the ciphertext to plaintext Symmetric Cipher Model

32. Cryptography The developed encryption schemes Cryptanalysis Techniques used to get the plaintext out of the ciphertext without prior knowledge to the encryption scheme (breaking the code) Cryptology Both the cryptography and cryptanalysis Symmetric Cipher Model (Cont.)

33. Unconditional Security The ciphertext provides insufficient information to uniquely determine the corresponding plaintext. Computational Security The time needed for calculations is greater than age of universe More Definitions

34. Symmetric Cipher Model (Cont.)

35. Requirements Strong Key  the opponent can not figure it out even if he/she has a number of ciphertexts The key must be exchanged through a secure channel Y = E(K,X) ~ Y = EK(X) X =D(K,Y) ~ X = DK(Y) Symmetric Cipher Model

36. Always possible to simply try every key Most basic attack, proportional to key size Brute Force Search

37. Substitution Ciphers

38. You are spying on your friend Ahmed while he is chatting with John, you received the following message: “Ygjcxgvqmnnvjgrgumfgpv” Can you decrypt this message? Lets have Fun

39. Ahmed is telling John: “Ygjcxgvqmnnvjgrgumfgpv” “We have to kill the president” Encryption Key: Replacement Table Plaintext ABCDEFGHIJKLMNOPQRSTUVWXYZ Ciphertext CDEFGHIJKLMNOPQRSTUVWXYZAB Encryption Technique Each letter is replaced by the second one after it Remove blanks Answer

40. Earliest known substitution cipher by Julius Caesar first attested use in military affairs replaces each letter by 3rd one after it E.g. meet me after the toga party PHHW PH DIWHU WKH WRJD SDUWB Caesar Cipher

41. Transformation : Mathematically give each letter a number a b c d e f g h i j k l m 0 1 2 3 4 5 6 7 8 9 10 11 12 n o p q r s t u v w x y Z 13 14 15 16 17 18 19 20 21 22 23 24 25 Then have Caesar cipher as: C = E(p) = (p + k) mod (26) p = D(C) = (C – k) mod (26) Caesar Cipher (Cont.)

42. Cryptanalysis Only have 26 possible ciphers A maps to A,B,..Z Could simply try each in turn Caesar Cipher (Cont.)

43. Rather than just shifting the alphabet Could shuffle (jumble) the letters arbitrarily Each plaintext letter maps to a different random ciphertext letter The key is 26 letters long Plain: abcdefghijklmnopqrstuvwxyz Cipher: DKVQFIBJWPESCXHTMYAUOLRGZN Plaintext: ifwewishtoreplaceletters Ciphertext: WIRFRWAJUHYFTSDVFSFUUFYA Monoalphabetic Cipher

44. now have a total of 26! = 4 x 1026 keys with so many keys, might think is secure but would be !!!WRONG!!! Language Characteristics Problem Using the occurrence frequency of each letter , we can deduce the letters in the ciphertext Monoalphabetic Cipher Security

45. English Letter Frequencies

46. Invented by Charles Wheatstone in 1854, but named after his friend Baron Playfair. Encrypts multiple letters Uses Playfair Matrix Uses some of the rules to interpret the matrix Playfair Cipher

47. A 5X5 matrix of letters based on a keyword Fill in letters of keyword (Avoid repetition) Fill rest of matrix with other letters E.g. using the keyword MONARCHY Playfair Key Matrix

48. Plaintext encrypted two letters at a time: if a pair is a repeated letter, insert a filler like 'X', eg. "balloon" encrypts as "ba lx lo on" If both letters fall in the same row, replace each with letter to right (wrapping back to start from end), eg. “ar" encrypts as "RM" If both letters fall in the same column, replace each with the letter below it(again wrapping to top from bottom), eg. “mu" encrypts to "CM" Otherwiseeach letter is replaced by the one in its row in the column of the other letter of the pair, eg. “hs" encrypts to "BP", and “ea" to "IM" or "JM" (as desired) Playfair Rules

49. Based on Playfair encryption, encrypt the word “Hello” Key : Note: The key is an arrangement of all of the alphabetic letters Group Activity

50. Step 1: Group the letters He ll o 1st rule  repeated letters ll He lx lo Step 2: find the corresponding text in the key He  EC - rule 2 H and e on the same row (replace each with letter to right)  EC Lx  QZ -- rule 3 L and x at the same column (replace each with the letter below it)  QZ loBX -- rule 4 l and o at different rows and columns (replaced by the one in its row in the column of the other letter of the pair) E (Hello) “ECQZBX” Answer