1. (c) 2006 Carnegie Mellon University95752:1-1 95-752 Introduction to Information Security Management Tim Shimeall, Ph.D. tjs@cert.org 412-268-7611 Office Hours by Appointment Course website: http://www.andrew.cmu.edu/course/95-752

2. (c) 2006 Carnegie Mellon University95752:1-2 Course Covers Introduction/Definitions Physical security Access control Data security Operating system security Application security Network security

3. (c) 2006 Carnegie Mellon University95752:1-3 Student Expectations Grading: –2 Homeworks –Midterm –Paper/project All submitted work is sole effort of student Students are interested in subject area Students have varied backgrounds

4. (c) 2006 Carnegie Mellon University95752:1-4 Why Should You Be Concerned Personal data Credit information Medical information Purchasing history Corporate information Political information Societal infrastructure

5. (c) 2006 Carnegie Mellon University95752:1-5 A Different Internet Armies may cease to march Stock may lose a hundred points Businesses may be bankrupted Individuals may lose their social identity Threats not from novice teenagers, but purposeful military, political, and criminal organizations

6. (c) 2006 Carnegie Mellon University95752:1-6 Computer Terms (1) Computer – A collection of the following: Central Processing Unit (CPU): Instruction- processing Memory(RAM) : Transient storage for data Disk: More permanent storage for data Monitor: Display device Printer: Hard copy production Network card: communication circuitry

7. (c) 2006 Carnegie Mellon University95752:1-7 Computer Terms (2) Software: Instructions for a computer Operating System: interaction among components of computer Application software: common tasks (e.g., email, word processing, program construction, etc.) API/Libraries: Support for common tasks

8. (c) 2006 Carnegie Mellon University95752:1-8 Vulnerability (2001) Out-of-the-box Linux PC hooked to Internet, not announced: [30 seconds] First service probes/scans detected [1 hour] First compromise attempts detected [12 hours] PC fully compromised: – Administrative access obtained – Event logging selectively disabled – System software modified to suit intruder – Attack software installed – PC actively probing for new hosts to intrude Clear the disk and try again!

9. (c) 2006 Carnegie Mellon University95752:1-9 Why is Security Difficult Managers unaware of value of computing resources Damage to public image Legal definitions often vague or non- existent Legal prosecution is difficult Many subtle technical issues

10. (c) 2006 Carnegie Mellon University95752:1-10 Objectives of Security Privacy – Information only available to authorized users Integrity – Information retains intended content and semantics Availability – Information retains access and presence Importance of these is shifting, depends on organization

11. (c) 2006 Carnegie Mellon University95752:1-11 Security Terms Exposure - “actual harm or possible harm” Vulnerability - “weakness that may be exploited” Attack - “human originated perpetration” Threat - “potential for exposure” Control - “preventative measure”

12. (c) 2006 Carnegie Mellon University95752:1-12 Classes of Threat Interception Modification Masquerade Interruption Most Security Problems Are People Related

13. (c) 2006 Carnegie Mellon University95752:1-13 Software Security Concerns Theft Modification Deletion Misplacement

14. (c) 2006 Carnegie Mellon University95752:1-14 Data Security Concerns Vector for attack Modification Disclosure Deletion “If you have a $50 head, buy a $50 helmet”

15. (c) 2006 Carnegie Mellon University95752:1-15 Network Security Concerns Basis for Attack Publicity Theft of Service Theft of Information Network is only as strong as its weakest link Problems multiply with number of nodes

16. (c) 2006 Carnegie Mellon University95752:1-16 Motivations to Violate Security Ego Curiosity Greed Revenge Competition Political/Idiological

17. (c) 2006 Carnegie Mellon University95752:1-17 People and Computer Crime Most damage not due to attacks “Oops!” “What was that?” No clear profile of computer criminal Law and ethics may be unclear “Attempting to apply established law in the fast developing world of the Internet is somewhat like trying to board a moving bus” (Second Circuit, US Court of Appeals, 1997)

18. (c) 2006 Carnegie Mellon University95752:1-18 Types of Attackers Script Kiddies Old-line hackers Disgruntled Employees Organized Crime Corporate Espionage Foreign Espionage Terrorists

19. (c) 2006 Carnegie Mellon University95752:1-19 Theory of Technology Law Jurisdiction: –subject matter – power to hear a type of case –Personal – power to enforce a judgment on a defendant Between states: Federal subject matter Within state: State/local subject matter Criminal or Civil –Privacy/obscenity covered now –intellectual property covered later

20. (c) 2006 Carnegie Mellon University95752:1-20 Privacy Law Common law: –Person’s name or likeness –Intrusion –Disclosure –False light State/Local law: Most states have computer crime laws, varying content International law: patchy, varying content

21. (c) 2006 Carnegie Mellon University95752:1-21 Federal Privacy Statutes ECPA (communication) Privacy Act of 1974 (Federal collection/use) Family Educational Rights & Privacy Act (school records) Fair Credit Reporting Act (credit information) Federal Cable Communications Privacy Act (cable subscriber info) Video Privacy Act (video rental information) HIPAA (health cared information) Sarbanes-Oxley Act (corporate accounting) Patriot Act (counter-terrorism)

22. (c) 2006 Carnegie Mellon University95752:1-22 Federal Obscenity Statues Miller tests (Miller v. California, 1973): –Average person applying contemporary community standards find appeals prurient interest –Sexual content –Lack of literary, artistic, political or scientific value Statues: –Communications Decency Act (struck down) –Child Online Protection Act (struck down) –Child Pornography Protection Act (struck down – virtual child porn; live children still protected)

23. (c) 2006 Carnegie Mellon University95752:1-23 Indian Trust Funds Large, developing, case: Cobell vs. Norton –http://www.indiantrust.com/ Insecure handling of entrusted funds Legal Internet disruption Criminal contempt proceedings Judicial overstepping

24. (c) 2006 Carnegie Mellon University95752:1-24 Methods of Defense Overlapping controls –Authentication –Encryption –Integrity control –Firewalls –Network configuration –Application configuration –Policy