Computer Security Set of slides 1 Dr Alexei Vernitski

Information security In this module, we concentrate on information security We speak less about physical security – for example: (Millfields Primary School laptop thefts) We do not speak about bugs in computer software – for example: (Bug in Post Office computer system)

Example from a web site Your password is stored securely using RSA Encryption with a 1024-bit key, which is the standard used for secure online bank account access. We use industry-standard 128 bit secure socket layer SSL encryption to protect data transmissions between your browser and our servers, such as your personal information.

Questions Your password is stored securely using RSA Encryption with a 1024-bit key, which is the standard used for secure online bank account access. We use industry-standard 128 bit secure socket layer SSL encryption to protect data transmissions between your browser and our servers, such as your personal information. What is more secure: 1024 bits or 128 bits? Is either of these two encodings secure? Or are they both secure? In this case, why use both? What is RSA? Which security goals are achieved by these measures?

Security goals Confidentiality Integrity Availability Some others, such as non-repudiation (read more in the textbooks)

Example: electronic voting system

For discussion Confidentiality Integrity Availability Some others, such as non-repudiation Consider an electronic voting system How can these goals be achieved or not achieved?

Questions Your password is stored securely using RSA Encryption with a 1024-bit key, which is the standard used for secure online bank account access. We use industry-standard 128 bit secure socket layer SSL encryption to protect data transmissions between your browser and our servers, such as your personal information. What is more secure: 1024 bits or 128 bits? Is either of these two encodings secure? Or are they both secure? In this case, why use both? What is RSA? Which security goals are achieved by these measures?

Example from a web site We have industry standard and proprietary network monitoring tools constantly running in our system in order to prevent security breaches and protect the security of your data. In addition, our secure page employs industry standard encryption.

Questions We have industry standard and proprietary network monitoring tools constantly running in our system in order to prevent security breaches and protect the security of your data. In addition, our secure page employs industry standard encryption. Which security goals are important for Facebook? Which security goals are achieved by the described measures?

Example from a news item Sony has admitted that the personal data of PSN users, which may have been illegally accessed in a recent attack on the system, was not encrypted. Thankfully, credit card information was stored separately to the personal data and was encrypted.

Questions Sony has admitted that the personal data of PSN users, which may have been illegally accessed in a recent attack on the system, was not encrypted. Thankfully, credit card information was stored separately to the personal data and was encrypted. Which security goals were not achieved by Sony? Would encryption help to achieve these goals?

From recent research Firms using encryption software are more careless about controlling internal access to encrypted data and their employees are more careless about computer equipment containing encrypted data.

For discussion Firms using encryption software are more careless about controlling internal access to encrypted data and their employees are more careless about computer equipment containing encrypted data. Do you agree with these research findings? Does this mean that encryption should not be used?

Example from a web site iCloud is built with industry-standard security practices and employs strict policies to protect your data. Apple takes precautions — including administrative, technical and physical measures — to safeguard your personal information against loss, theft and misuse, as well as against unauthorised access, disclosure, alteration and destruction.

Attack analysis Threat Vulnerability Attack Control (read more in the textbooks)

Attack analysis It is important to remember that in this context, words such as ‘threat’ and ‘control’ are used in special meanings A threat describes what can be stolen or damaged A control describes how a vulnerability can be stopped or repaired

An informal example

For discussion Sony has admitted that the personal data of PSN users, which may have been illegally accessed in a recent attack on the system, was not encrypted. Analyse this news item using the terms – Threat – Vulnerability – Attack – Control

Example from a news item MI6 and the CIA have been warned that intelligence may have been compromised by an agent in Switzerland who downloaded vast quantities of data onto portable hard drives and carried it out of a secure building. data.html The sources say that he downloaded "terabytes" of classified material from the Swiss intelligence service's servers onto portable hard drives. He then left the government building with a backpack containing the hard drives.

For discussion MI6 and the CIA have been warned that intelligence may have been compromised by an agent in Switzerland who downloaded vast quantities of data onto portable hard drives and carried it out of a secure building. The sources say that he downloaded "terabytes" of classified material from the Swiss intelligence service's servers onto portable hard drives. He then left the government building with a backpack containing the hard drives. Analyse this news item using the terms – Threat – Vulnerability – Attack – Control

Defence against attack: types of control You may use the following verbs to describe the action of controls: Preempt Prevent Deter Detect Deflect Recover (read more in the textbooks)

For discussion Student Rachel Hyndman, 20, from Glasgow, believes she was the victim of webcam hacking. She spotted the camera on her laptop had switched itself on while she was watching a DVD in the bath. She says: "I was sitting in the bath, trying to relax, and suddenly someone potentially has access to me in this incredibly private moment and it's horrifying. To have it happen to you without your consent is horribly violating.“

For discussion She spotted the camera on her laptop had switched itself on while she was watching a DVD in the bath. She says: "I was sitting in the bath, trying to relax, and suddenly someone potentially has access to me in this incredibly private moment and it's horrifying. Discuss which types of control could have been used to defend against the attack – Preemption – Prevention – Deterrence – Detection – Deflection – Recovery

For discussion Sony has admitted that the personal data of PSN users, which may have been illegally accessed in a recent attack on the system, was not encrypted. Discuss which types of control could have been used to defend against the attack – Preemption – Prevention – Deterrence – Detection – Deflection – Recovery

Example: online shop

For discussion: online shop Confidentiality Integrity Availability (also non-repudiation) Threat Vulnerability Attack Control – Preemption – Prevention – Deterrence – Detection – Deflection – Recovery

Security policy Example: an excerpt from Amazon security policy We work to protect the security of your information during transmission by using Secure Sockets Layer (SSL) software, which encrypts information you input. We reveal only the last four digits of your credit card numbers when confirming an order. Of course, we transmit the entire credit card number to the appropriate credit card company during order processing. We maintain physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of personally identifiable customer information. Our security procedures mean that we may occasionally request proof of identity before we disclose personal information to you. It is important for you to protect against unauthorised access to your password and to your computer. Be sure to sign off when you finish using a shared computer.

Homework Find the security policy of the University of Essex. Read it, paying attention to security goals, attack analysis and controls.

Sample exam questions List three main types of security goals Apple’s security policy says that Apple takes measures ‘against unauthorised access, disclosure, alteration and destruction’. Explain precisely which security goals would be compromised by each of the following: unauthorised access, disclosure, alteration and destruction.

Sample exam questions Read the news item: – A former Sun newspaper reporter Ben Ashford has been charged with an offence of unauthorised access to computer material. The charge alleges that he "caused a computer to perform a function with intent to secure unauthorised access to a program or data held in a computer, knowing that such access was unauthorised". Explain precisely which security goals could be compromised by Ben Ashford’s alleged actions

Sample exam questions Explain in your own words what the terms threat and vulnerability mean Read the news item: Social networking website LinkedIn has said some of its members' passwords have been "compromised" after reports that more than six million passwords had been leaked onto the internet. Comment on this news item using all the necessary terms for attack analysis

Sample exam questions Read the news item: – Sony has admitted that the personal data of PSN users, which may have been illegally accessed in a recent attack on the system, was not encrypted. – Thankfully, credit card information was stored separately to the personal data and was encrypted. Comment on this news item using your knowledge of the types of controls

Sample exam questions Read the news item: – MI6 and the CIA have been warned that intelligence may have been compromised by an agent in Switzerland who downloaded vast quantities of data onto portable hard drives and carried it out of a secure building. – The sources say that he downloaded "terabytes" of classified material from the Swiss intelligence service's servers onto portable hard drives. He then left the government building with a backpack containing the hard drives. Comment on this news item, using the correct terms related to security goals, attack analysis and control types.

Sample exam questions The web site of a company claims: – We have industry standard and proprietary network monitoring tools constantly running in our system in order to prevent security breaches and protect the security of your data. – In addition, our secure page employs industry standard encryption. Improve this fragment of the company’s security policy, using the correct terms related to security goals, attack analysis and control types.

Sample exam questions The web site of a company claims: – Your password is stored securely using RSA Encryption with a 1024-bit key – We use industry-standard 128 bit secure socket layer SSL encryption Defend this security policy, explaining why a 1024-bit encryption is used in one case, and a 128-bit encryption in the other.