THE NEED FOR NETWORK SECURITY Thanos Hatziapostolou
The Need for Web Security2 PRESENTATION OBJECTIVES Understand information security services Be aware of vulnerabilities and threats Realize why network security is necessary What are the elements of a comprehensive security program
The Need for Web Security3 TRENDS FOR INFORMATION More information is being created, stored, processed and communicated using computers and networks Computers are increasingly interconnected, creating new pathways to information assets The threats to information are becoming more widespread and more sophisticated Productivity, competitiveness, are tied to the first two trends Third trend makes it inevitable that we are increasingly vulnerable to the corruption or exploitation of information INFORMATION IS THE MOST VALUABLE ASSET
The Need for Web Security4 Information Security Services Confidentiality Integrity Authentication Nonrepudiation Access Control Availability
The Need for Web Security5 Information Security Services Confidentiality Maintaining the privacy of data Integrity Detecting that the data is not tampered with Authentication Establishing proof of identity Nonrepudiation Ability to prove that the sender actually sent the data Access Control Access to information resources are regulated Availability Computer assets are available to authorized parties when needed SERVICES
The Need for Web Security6 Collection of networks that communicate with a common set of protocols (TCP/IP) Collection of networks with no central control no central authority no common legal oversight or regulations no standard acceptable use policy “wild west” atmosphere What Is The Internet?
The Need for Web Security7 Why Is Internet Security a Problem? Security not a design consideration Implementing change is difficult Openness makes machines easy targets Increasing complexity
The Need for Web Security8 Common Network Security Problems Network eavesdropping Malicious Data Modification Address spoofing (impersonation) ‘Man in the Middle’ (interception) Denial of Service attacks Application layer attacks
The Need for Web Security9 Security Incidents are Increasing Sophistication of Hacker Tools 19901980 Technical Knowledge Required High Low 2000 -from Cisco Systems
The Need for Web Security10 HACKED WWW HOMEPAGES 11/29/96 CIA HOMEPAGE DOJ HOMEPAGE USAF HOMEPAGE
The Need for Web Security11 Problem is Worsening 60000 50000 40000 30000 20000 10000 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 Internet Security Violations Jerusalem Tequila Michelangelo Good Times Melissa & ILOVEYOU Anna Kournikova Code Red Nimba Badtrans Source: CERT® Coordination Center Carnegie Mellon
The Need for Web Security12 VIRUSES VIRUSES Risk ThreatDiscoveredProtection TROJ_SIRCAM.ANew !!Latest DAT W32.Navidad11/03/200011/06/2000 W95.MTX8/17/20008/28/2000 W32.HLLW.QAZ.A7/16/20007/18/2000 VBS.Stages.A6/16/20006/16/2000 VBS.LoveLetter5/04/20005/05/2000 VBS.Network2/18/20002/18/2000 Wscript.KakWorm12/27/199912/27/1999 W32.Funlove.409911/08/199911/11/1999 PrettyPark.Worm6/04/19996/04/1999 Happy99.Worm1/28/19991/28/1999
The Need for Web Security13 Consider that… 90% of companies detected computer security breaches in the last 12 months 59% cited the Internet as the most frequent origin of attack 74% acknowledged financial losses due to computer breaches 85% detected computer viruses Source: Computer Security Institute
The Need for Web Security14 WHO ARE THE OPPONENTS? 49% are inside employees on the internal network 17% come from dial-up (still inside people) 34% are from Internet or an external connection to another company of some sort HACKERS
The Need for Web Security15 HACKER MOTIVATIONS Money, profit Access to additional resources Experimentation and desire to learn “Gang” mentality Psychological needs Self-gratification Personal vengeance Emotional issues Desire to embarrass the target
The Need for Web Security16 Internet Security? Malicious Code Viruses Worms Buffer Overflows Session Hijacking Port Scanning Trojans Denial of Service Spoofing Replay Attack Man-in-the-middle
The Need for Web Security17 What Do People Do When They Hear All These? Take the risks! But there are solutions Ignoring the situation is not one of them
The Need for Web Security18 THE MOST COMMON EXCUSES So many people are on the Internet, I'm just a face in the crowd. No one would pick me out. I'm busy. I can't become a security expert--I don't have time, and it's not important enough No one could possibly be interested in my information Anti-virus software slows down my processor speed too much. I don't use anti-virus software because I never open viruses or e-mail attachments from people I don't know.
The Need for Web Security19 SANS Five Worst Security Mistakes End Users Make 1.Opening unsolicited e-mail attachments without verifying their source and checking their content first. 2.Failing to install security patches-especially for Microsoft Office, Microsoft Internet Explorer, and Netscape. 3.Installing screen savers or games from unknown sources. 4.Not making and testing backups. 5.Using a modem while connected through a local area network.
The Need for Web Security20 SECURITY COUNTERMEASURES THREE PHASE APPROACH PROTECTION DETECTION RESPONSE
The Need for Web Security21 ELEMENTS OF A COMPREHENSIVE SECURITY PROGRAM Have Good Passwords Use Good Antiviral Products Use Good Cryptography Have Good Firewalls Have a Backup System Audit and Monitor Systems and Networks Have Training and Awareness Programs Test Your Security Frequently Principles
The Need for Web Security22 CRYPTOGRAPHY Necessity is the mother of invention, and computer networks are the mother of modern cryptography. Ronald L. Rivest Symmetric Key Cryptography Public Key Cryptography Digital Signatures
The Need for Web Security23 Firewall Visible IP Address Internal Network PC Servers Host A system or group of systems that enforces an access control policy between two networks.