Security Protecting information data confidentiality - protect unauthorized reads data integrity - protect unauthorized writes (change) removes or additions system availability - prevent denial of service (DoS) Policy, OS flaws

Security Intruders - read info (email, trade secrets, confidential data) - or make changes (change grades or salary) - DoS - elite hackers - script kiddies

Security Need a backup policy as part of security policy. - accidental data loss (hardware, software, human error) - malicious destruction - multiple copies at another location (earthquake, fire, terrorists)

Cryptography Encrypt data for confidentiality and integrity. Also use for authentication. Key Plaintext Encrypt Alg Ciphertext Ciphertext Decryption Alg Plaintext Key

Cryptography Use known, strong algorithms with a good key. Avoid relying on security by obscurity. Mono alphabetic substitutions are fairly easy to break cryptograms. Symmetric encryption – one key Asymmetric encryption – two keys - also called public key

Symmetric Encryption Uses the same key for encryption and decryption. Usually used to provide confidentiality. Key must be shared by two parties. Algorithms: DES, 3DES, AES Blowfish and others Key length is important. Keeping the key private is important.

Asymmetric Encryption Uses two keys (public and private) The two keys are related. One can be used for encryption with the other for decryption. Based on mathematics – factoring large numbers. Often used for key exchange, and crypto signatures. Slower than symmetric. Algorithms: RSA, DSA

Digital fingerprints - hashes Take a message and produce a hash of it. MD5, SHA-1, others Hope the hash is unique. If message is changed will generate a different hash. Combine with public key for signatures.

Crypto applications SSH – Secure shell - confidentiality - authentication/integrity SSL/TLS – https and other protocols - confidentiality, auth/integrity PGP/GPG – for files and email

More security topics User authentication – username/password Cracking passwords – choose good ones Smartcards, biometrics Sniffing – why encryption important open ports – finding vulnerabilities Trojan Horses, worms, virus Buffer Overflows Firewalls, IDS, IPS