SECURITY +

CIA Triangle

• Confidentiality: assuming information is secure with access limited to appropriate persons
• Integrity: assuring information is not accidentally or maliciously altered or destroyed
• Availability: assuring information and communication services will be ready for use when expected.

MAC, DAC, RBAC

• MAC Mandatory Access Control (MAC): Highest level of Control. Permissions are explicitly denied unless otherwise changed. The OS is in control of the data. This model is used with highly confidential data, such as military or government.
• DAC Discretionary Access Control (DAC): Allows owners of data to specify what users can access data used most. Access control is based on discretion of data owners. Most common model. Users themselves can assign access to their own data.
• Role Based Access Control (RBAC): ( also called Non-discretionary access control ) Centrally controlled model allows access based on the role the user holds in the organization; often hierarchical. Access is given to a group of users that perform a similar function. Based on the separation of duties.

ACCESS Control

• A reference model is a system component that enforces access controls on an object. The security Kernel implements the concept.
• The reference model must mediate all processes, it must be protected from modification, it must be verifiable as correct.
• Type I: Something you know ( passwords, pins )
• Type II: Something you have ( Token, ATM card )
• Type III: Something you are ( Biometrics )
• Before a user can access a resource, several levels of security must be passed: 1. Identify, 2. Authenticate, 3. Authorize

Kerberos

• A trusted, third party authentication protocol developed under project Athena at MIT
• Rather than sharing a password, communication partners share a cryptographic key, and they use knowledge of this key to verify one another's identity. For the technique to work, the shared key must be symmetric—a single key must be capable of both encryption and decryption. One party proves knowledge of the key by encrypting a piece of information, the other by decrypting it.
• Kerberos uses SSO ( Single sign on )
• The KDC knows the secret keys of all clients on the network. The KDC initially exchanges information with the client and server using these secret keys.
• Kerberos authenticates a client to a requested service on a server via TGS and by issuing temporary symmetric keys for communication between the client and the KDC, the server and the KDC and the client and the server. Communication then takes places between the client and the server using those keys.
• For more information read Kerberos Security.

CHAP

• Challenge handshake authentication protocol uses a stronger authentication process
• Non-replayable challenge/response dialog that verifies the identity of the node of the node attempting the access
• PAP is clear text / username password

RADIUS, TACACS, TACACS+

• RADIUS is used to provide authentication, authorization, and accounting services (vulnerable to buffer overflow attacks)
• Radius supports PPP, PAP, CHAP
• Radius compares users password/name to a database
• Radius uses UDP
• TACACS offers authentication, authorization NO ACCOUNTING
• TACACS uses UDP
• TACACS+ uses TCP offers full aaa model, Cisco
• TACACS+ weakness include: Birthday attacks, buffer overflow, packet sniffing lack of integrity checking

PTPP, L2TP

• PTPP encrypts data being transmitted but does not encrypt information being exchanged during negotiation
• PTPP only works over IP, cannot use IPSEC
• PTPP does not work with RADIUS or TACACS
• L2TP requires IPSEC to offer encryption
• L2TP offers RADIUS, TACACS
• L2TP can be hardware solution
• L2TP works over IPX, IP, SNA
• Using L2TP with IPSEC provides: Per packet data origin authentication, Replay protection and Data confidentiality

IPSEC

• Provides two modes: 1 Transport mode, only the payload is encrypted, 2 Tunnel mode, both data and IP headers are encrypted
• IPSEC is made of two different protocols: AH and ESP
• AH Authentication header, responsible for authenticity and integrity
• ESP Encapsulating Security payload: Encrypts payload

EAP

• Extensible Authentication Protocol
• Sits inside PPP and provides generalized framework for many different authentication methods. By supporting EAP, the RAS server is no linger a middle man, it just hands packets to the Radius server

802.1x

• Standard for passing EAP over a wired or wireless LAN.
• 802.1x uses EAP for passing messages between supplicant and authenticator. Works w/o PPP
• Does Authentication only: Supplicant = client; Authentication server = Radius; Authenticator = WAP or Bridge

Biometrics

• Based on Type 3 authentication mechanism: something you are
• Biometrics are defined as an automated means of identifying or authenticating the identity of a living person based on psychological or behavioral characteristics.
• Process of enrollment: images are collected and features extracted, no comparison. The info is stored for later use.
• When a person need access a ONE to ONE comparison is used between the person and their stored samples.
• Biometric Characteristics include: Fingerprints, retina, iris, facial, palm scans, hand geometry, voice, handwritten signature and keystrokes pattern
• FINGERPRINT&PALM = Strongest / Handwriting = weakest

Smartcards / Tokens

• Used to supply static or dynamic passwords
• Type 2: Something you have. Smartcard is Encrypted with RSA or MD5
• Static password tokens: owner authenticates himself to the token, token authenticates owner to the IS
• Synchronous Dynamic password tokens: token generates a new unique password at fixed intervals. Password and pin entered into IS, time sent
• Asynchronous Dynamic Password Tokens: same as above without the timestamps
• Challenge Response Tokens: System generates a challenge string, owner puts string into token. Token generates response. That is entered in IS.

Accounts and Password Management

• Naming conventions: Never have a name the resembles a job position
• Limit Logon attempts
• Expiry Dates: Have your accounts expire
• Disable account when employee leaves company
• Time restrictions
• Machine restrictions
• PASSWORD POLICIES
• Minimum password length
• Password rotation: systems remember old passwords, cannot reuse
• Password aging: Force users to change password regularly

Attacks

• Birthday Attack: Probability of two different messages using the same hash function that produces a common message digest. Birthday comes from the fact that in a room of 23 people, the probability of two people having the same birthday is greater than 50%.
• Man-in-the-Middle attack: Intercepting messages and forwarding modified versions of the original message while attempting secure communications between the hosts.
• DoS Attack: common attacks include: filling up a targets hard drive by huge email attachments or file xfer. Sending a message which resets targets subnet mask. Using up all ports on a web server
• Buffer Overflow attack: occurs when a process receives much more data than expected: aka ping of death Use of 256 char email names
• SYN attack: occurs when an attacker exploits the buffer space during a TCP session handshake by not responding with a FIN
• Teardrop attack: consists of modifying the length and fragment offset in IP packets. Target systems become confused on re-ordering packets.
• Smurf Attack: uses a combo of IP spoofing and ICMP to saturate a target network with traffic. Smurf consists of three elements; source site, bounce site and target site. The attacker ( source site ) sends a modified ping to the broadcast address of a large network ( bounce site ). The modified packet contains a source address of the target site; everyone at the bounce site replies to the target site.
• Brute Force: trying every possible key/combo, longer the key, the longer this attack takes.
• Dictionary: A type of brute force that uses a program that tries common words.
• Replay: using a network capture; replay username/password

Thwarting Attacks

• DoS: Disable ICMP in your network
• Backdoor: use anti-virus, personal firewalls, no modems
• Spoofing: Router or Firewall needs to be set to disallow internal IP entering from outside
• Smurf or DDoS: Disable IP broadcast, IP re-directs
• TCP/IP hijacking: Use IPSEC
• Man-in-the-middle: Unique server host key / new SSL
• Replay: Use timestamps : Kerberos
• Birthday/Brute Force: Use long 128 bit keys
• Brute Force: Limit Logon attempts
• Password guessing: Use 6 to 8 upper/lower case letters and numbers
• Social Engineering: Educate Employees

Worms, T-Horses and Viruses

• Worm: parasitic self-contained computer program that replicate itself or smaller parts of itself, but unlike viruses do not infect computer files. Worms create copies of themselves on the same computer or send themselves to other computers via IRC, internet relay, email.
• Trojan Horse: Malicious program that pretends to be a benign application. Trojans do not replicate. Hides in computer until called on to perform a certain task.
• Virus: A computer program capable of attaching itself to disks or files and replicating itself without user knowledge or prevention. Polymorphic Viruses change each time a new infection occurs. Boot Sector, File Infector, Macro: ( attach to Word or Excel ), metamorphic, and stealth are the kinds of viruses present.

WEP, WAP, WTLS

• WEP: Wired Equivalency Protocol
• Uses RC4, a stream cipher operates by expanding a short key into a stream. The sender combines the key stream with the plain text to product the cipher text. Shared Key. Key changes on every packet.
• Weakness: If an eavesdropper intercepts two cipher text encrypted with the same keystream they can obtain the exclusive OR ( XOR ) of the two plain texts and find the key.
• WTLS: Wireless Transport Layer Security, The WTLS is designed to provide security in the Wireless Application Environment.
• The WTLS is based on the well known TLS v1.0 security layer used in Internet.
• WAP: Wireless Application Protocol; The WAP, by means of the WTLS, provides end-to-end security between the WAP protocol endpoints. Actually the end points are the mobile terminal and the WAP gateway. When the WAP gateway makes the request to the origin server, it will use the SSL below HTTP to secure the request. This means that the data is decrypted and again encrypted at the WAP gateway
• WAP defines a set of protocols in the transport, the session, and the application layers. It also specifies an application framework

Hashes

• Hash: Cryptographic hash is a one-way function that takes an input of a variable size and produces a fixed-size output which is commonly referenced to as "hash" or "digest". It is "one-way", which means that when given: ,an input, it is easy to compute its hash; a hash, it is hard to compute the corresponding input; a block of data as an input, it is hard to find another block of data with the same hash Another important requirement to hash functions in cryptography is the collision-resistance: it is hard to find two random inputs with the same hash.
• MD4 ( Message Digest 4 ) Produces 128 bit message digest, very fast and appropriate for medium security usage.
• MD5 Produces 128 message digest, fast ( not as fast as MD4 ) more secure. MD5 is a hash function designed by Ron Rivest and widely used in cryptographic applications. It is an improved version of MD4. However, there are some known problems with MD5 - in particular there is an attack that produces collisions using the compression function in MD5.
• SHA-1 160 bit MD ( standard for US GOVT ) slower than MD 5

Symmetric Encryption Algorithms

• In symmetric cryptosystems, the same key is used to encrypt and decrypt data and in symmetric authentication schemes the same key is used to sign and verify documents. This means that symmetric cryptography is based on the notion of "shared secret".
• Advantages: Speed & Strength Disadvantages: Poor Key distribution, Single key
• DES stands for Data Encryption Standard, the most popular symmetric encryption algorithm (block cipher) in the past years. It was designed by IBM and the U.S. government. Considered now WEAK, slow
• Triple DES ( 3DES ) is a symmetric encryption algorithm based on repeating encryption with DES. It uses 168-bit long keys which are considered as sets of three independent keys for triple encryption with DES. 3DES is more secure than DES but also considerably slower.
• Blowfish is a symmetric encryption algorithm (block cipher) with a variable-length (up to 448 bits) key. It operates on 64-bit data blocks. Blowfish was designed by Bruce Schneier and it is optimized for applications where the key does not change often.
• EAS Advanced Encryption standard for US GOVT; replaces DES The AES will specify three key sizes: 128, 192 and 256 bits.
• IDEA is the International Data Encryption Algorithm designed by Xuejia Lai and James Massey. IDEA is a symmetric encryption algorithm (block cipher) which uses 128-bit long keys and operates on 64-bit data blocks. IDEA is, on average, much faster than DES and it is considered to be quite secure.
• RC4 encryption algorithm is stream cipher, which can use variable length keys. The algorithm was developed in 1987 by Ron Rivest, for RSA Data Security, and was a propriety algorithm until 1994

Four goals of Cryptography

• Provide data Confidentiality
• Data integrity
• Identification and Authentication
• Non- repudiation
• Other facts:
  • Large amounts of data use shared-secret symmetric encryption to provide confidentiality.
  • Asymmetric Encryption can be used to generate a digital signature which can be attached to email to provide non-repudiation.

Asymmetric Algorithms

• Asymmetric systems and schemes use key pairs which consist of a public key and private key. The former is made public (for example, by publishing it in a directory) and the latter is kept secret. So the asymmetric cryptography does not involve shared secrets.
• Advantages: Provides a secure way to communicate; provides method of validation; non-repudiation Disadvantages: Slower than Symmetric
• RSA is the first full-fledged and most widely used public-key cryptographic algorithm designed by R. Rivest, A. Shamir, and L. Adleman. Its security is based on the factoring problem, which means that it is computationally unfeasible to factor large numbers.
• Diffie-Hellman key agreement protocol (also called exponential key agreement) was developed by Diffie and Hellman in 1976. The protocol allows two users to exchange a secret key over an insecure medium without any prior secrets. The Diffie-Hellman key exchange is vulnerable to a middleperson attack.
• Elliptic Curve PSEC--3 is a public-key encryption system that uses the elliptic curve El Gamal trapdoor function and two random functions (hash functions) as well as any semantically secure symmetric encryption scheme, such as the one-time pad, or any classical block-cipher. Too Slow

Digital Signatures

• Digital Signature is usually the encryption of a message or message digest with the sender's private key. To verify the digital signature, the recipient uses the sender's public key. Good digital signature scheme provides:
  • authentication
  • integrity
  • non-repudiation
• RSA algorithm can be used to produce and verify digital signatures; another public-key signature algorithm is DSA.

PKI Public Key Infrastructure

• A PKI uses asymmetric key pairs and combines software, encryption and services to provide a means of protecting security of business communication and transactions.
• PKCS ( Public Key Cryptography Standards ) Put in place by RSA to ensure uniform Certificate management throughout the internet.
• A Certificate is a digital representation of information that identifies you as a relevant entity by a trusted third party ( TTP )
• A CA ( Certification Authority ) is an entity trusted by one or more users to mange certificates.
• RA ( Registration Authority ) Used to take the burden off of a CA by handling verification prior to certificates being issued. RA acts as a proxy between user and CA. RA receives request, authenticates it and forwards it to the CA.
• CPA ( Certificate Practice Statement ) describes how the CA plans to manage the certificates it issues.
• CP ( Certificate Policy ) is a set of rules that defines how a certificate may be used.
• X.509 This is an international standard for the format and information contained in a digital certificate. X.509 is the most common type of digital certificate in the World. It is a digital document that contains a public key signed by the trusted third party which is known as a Certificate Authority, or CA.
• CRL ( Certificate Revocation List ) is a list of certificates issued by a CA that are no longer valid. CRLs are distributed in two main ways: PUSH model: CA automatically sends the CRL out a regular intervals. Pull model: The CRL is downloaded from the CA by those who want to see it to verify a certificate. End user is responsible.
• Status Checking: The concept of Status checking is to use a relying party to “real-time” check the validity of evidence supporting a high-value transaction. CRLs are created with specific lifetimes (possibly unbounded) they are not suitable for real-time status checks. The most prominent technology proposed for this type of verification within the PKIX infrastructure is the “Online Certificate Status Checking Protocol” [OCSP], and it is on track to become an Internet standard. OCSP has two important characteristics: first, OCSP depends upon the emergence of its own three-tier (Client - Certificate Authority – Designated Responder) infrastructure, and second, OCSP defines a new set of message formats extending beyond those contained in the base PKIX standard

PKI Trusts:

• Trusts are established between CAs by having each CA issue a certificate to the other CA
• MESH ( Web-of-trust ) trust architecture: All CA’s issue certificates for all other CA’s. This provides multiple trust paths that can be used for certificate validation.
• Hierarchical trusts establish a top level CA, known as the ROOT CA. Subordinate CAs can be created below. Certificates validate through the root.
• Browser Trust List model: ( Sometimes called a CA list ) Each user has public keys of all the Cas the user trusts. Different CA’s can be used for different applications.
• Policy Trust List Model: restricts access based on the policy under which the certificate is issued.
• Bridge model: Connects MESH and hierarchical models Bride. CAs only issues to other CAs and never end users.

Key and Certificate Management:

• M of N Control can be used for certificate revocation – two different entities are needed to agree to revoke a certificate. M of N also refers to a method of storing a private key, protected and encrypted with a separate unique key. The key used for recovery is split into two or more parts and distributed to various individuals. To recover the key, all the individuals must be present. Just like launching a nuclear missile.
• Key Escrow: Third party holds additional key ( on top of public/ private pair ). This third key is used to encrypt the private key; which is then stored. A common key escrow entity can be a CA.
• Key Life Cycle is broken into several stages: Certificate: Enrollment, Distribution, validation, revocation, renewal, destruction and auditing.
• Multiple Key Pairs: Dual purpose, multiple key pairs exist when forged digital signatures are a concern. Secondly, a dual key pair can be used to satisfy Security and Back-up requirements. One key pair can be used for encryption and decryption and the other key pair can be used for digital signatures and no-repudiation.
• Single Key: A single Key used for multiple purposes violates non-repudiation.

Email

• S/MIME: Secure Multi Purpose Internet Mail Extension was developed by RSA Data, it is based on PKCS data format for messages and the X.509v3 format for certificates. S/Mime is used for send confidential emails. Symmetric encryption, 3DES DES, and RC2. S/MIME looks to the headers to determine how data encryption and digital certificates are to be handled.
• PGP/MIME: based on PGP, distributed freely. Another great way to secure email. Unlike S/MIME, Individual users are responsible for exchanging their keys with each other and deciding they trust the public key Both use SHA-1 for hash. Key Ring held locally. Weakness is Chosen Cipher text. Uses combo of Public and private keys.

SSL

• SSL Secure Sockets Layer: Runs above TCP below Application layer of the OSI model. SSL/TLS is an encryption system used by most web pages to secure ecommerce.
• SSL Provides for mutual authentication using the public key digital signatures such as RSA
• SSL Server Authentication – SSL client enabled software uses a public key to check servers certificate and public ID against a CA.
• SSL contains two sub-protocols:
  • SSL RECORD protocol, it defines the format used to transmit data.
  • SSL HANDSHAKE PROTOCOL, it uses the SSL record protocol to exchange messages between SSL server & SSL client when they first establish a connection: this exchange of messages facilitates the flowing actions:
    • Authenticate Server to Client.
    • Allow server and client to select cryptography ciphers they both support
    • Optionally authenticate client to server
    • use public key encryption to generate shared secrets

TLS

• TLS ( Transport Layer security ) Transport Layer Protocol based on SSL. Not compatible with SSL 3.0. Unlike SSL, it IS application independent.
• An IETF-sponsored protocol intended to secure and authenticate communications across a public network through data encryption. It is designed as a successor to SSL.
• The protocol consists of two layers - a TLS Handshake Protocol and, below that, a TLS Record Protocol. The handshake protocol creates a "secret" used by the record protocol to encrypt messages. The record protocol also provides mechanisms for preventing a message from being altered.
• The overall protocol is designed to be application independent, so that application or higher-level protocol developers can choose the best way for initiating TLS handshaking and interpreting authentication certificates

Web

·  Active X is a Microsoft Technology for downloading miniature executable programs. Vulnerabilities: ActiveX: because active X has full access to a user’s hard drive, and will run under the right and privileges as the person currently logged in. ActiveX relies on digital signing to verify that trusted components are safe to run.

·  JavaScript: Created by Netscape. Allows executable content to be embedded in web pages. Vulnerabilities include malicious code, reading info on hard drive, retrieving data etc...

·  JAVA: Object-oriented platform independent programming language created by Sun. JAVA provides small programs called applets. Requires JAVA virtual machine to run., JAVA runs in a special area called a Sandbox, which restricts the program from moving to other areas of the computers. Hackers can bypass the sandbox routine.

·  CGI Common Gateway Interface: Means of executing an external script by sending to the web server a URL request of a program to start. Every time a new CGI script is executed, a new process is started. This can slow the server. CGI is prone to bugs. Scripts that utilize user input can be used against the client machine.

IPSEC / IKE / ISAKMP

• IPSEC IP Security: IPSEC has tow modes: 1) Transport mode where only the payload is encrypted 2) Tunnel mode where both the data and the IP headers are encrypted
• IPSEC is comprised of two different protocols AH & ESP
• AH: Authentication Header, responsible for authenticity and integrity. Authenticates packets by signing them.
• ESP Encapsulating Security Payload. Handles payload
• IKE: Internet Key Exchange is used to authenticate two ends of a secure tunnel by providing a secure exchange of a shared key before IPSEC transmissions begin.
• ISAKMP: Internet Security Association Key Management Protocol: A framework for establishing, negotiating, modifying and deleting security associations between to parties.
• A Security Association can be established manually or thru ISAKMP.

VPN / Tunnel

• There are two types of VPN:
  • Site to Site,
  • Remote Access
• Tunneling requires 3 Protocols:
  • Carrier Protocol, like IP
  • Encapsulating Protocol, PTPP, L2TP
  • Passenger Protocol, the data that is being tunneled.