EEC 693/793 Special Topics in Electrical Engineering Secure and Dependable Computing Lecture 2 Wenbing Zhao Department of Electrical and Computer Engineering Cleveland State University

2 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Outline Dependability concepts Security in computing systems –Security in Computing, Third Edition By Charles P. Pfleeger, Shari Lawrence Pfleeger –Security in Computing, 4th Edition is also available

3 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao What Do We Mean by Dependability* Dependability: –Def1: Ability to deliver service that can justifiably be trusted –Def2: Ability to avoid service failures that are more frequent or more severe than is acceptable When service failures are more frequent or more severe than acceptable, we say there is a dependability failure *This and the rest of the slides are based on: A. Avizienis, J.C. Laprie, B. Randell, C. Landwehr: ‘Basic Concepts and Taxonomy of Dependable and Secure Computing’, IEEE Trans. on Dependable and Secure Computing, vol. 1, no. 1, Jan-March 2004, pp.11-33; and based on Dr. Laprie’s keynote speak slides on COMSAC 2004

4 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Dependability Related Terminology A system is an entity that interacts with other entities, i.e., other systems, including hardware, software, humans, and the physical world with its natural phenomena These other systems are the environment of the given system The system boundary is the common frontier between the system and its environment

5 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Dependability Related Terminology Service delivered by a system: its behavior as it is perceived by its user or users User: another system that interacts with the former Function of a system: what the system is intended to do (Functional) Specification: description of the system function Correct service: when the delivered service implements the system function

6 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Dependability Related Terminology Service failure: event that occurs when the delivered service deviates from correct service, either –because the system does not comply with the specification, –or because the specification did not adequately describe its function Part of system state that may cause a subsequent service failure: error Adjudged or hypothesized cause of an error: fault Failure modes: the ways in which a system can fail, ranked according to failure severities

7 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao It is not included in some def for dependability

8 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao The Threats to Dependability and Security: Failures, Errors, Faults

9 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Dependability and its Attributes Original definitions of dependability: ability to deliver service that can justifiably be trusted –Aimed at generalizing availability, reliability, safety, confidentiality, integrity, maintainability, that are then attributes of dependability –Focus on trust, i.e. accepted dependence –=> Dependence of system A on system B is the extent to which system A’s dependability is (or would be) affected by that of system B

10 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Dependability and its Attributes Alternate definition of dependability: ability to avoid service failures that are more frequent or more severe than is acceptable –A system can, and usually does, fail. Is it however still dependable? When does it become undependable? –This def defines the criterion for deciding whether or not, in spite of service failures, a system is still to be regarded as dependable –Dependability failure <= fault(s)

11 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Dependability and Security Tree

12 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Dependability vs. High Confidence vs. Survivability vs. Trustworthiness

13 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao

14 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao

15 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao

16 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao

17 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Non-Malicious Faults

18 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Malicious Faults: Statistics from SEI/CERT

19 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Global Information Security Survey 2003 — Ernst & Young

20 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Global Information Security Survey 2004 — Ernst & Young Non-malicious fault: 370 (76%) Malicious fault: 115 (24%) Note: what’s shown here is the number of occurrence, not the damage done

21 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao

22 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao

23 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Security in Computing Systems Security in computing systems = protecting valuable computer-related asset Computer-related asset (valuable components): –Hardware, software, and data Means to achieve security –Protecting programs –Protecting operating systems –Protecting networks

24 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Principle of Easiest Penetration An intruder may use any available means of penetration –The penetration may not necessarily be by the most obvious means –Nor is it the one against which the most solid defense has been installed

25 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Principle of Easiest Penetration This principle implies that –Computer security specialists must consider all possible means of penetration –The penetration analysis must be done repeatedly, and especially whenever the system and its security changes –Strengthening one aspect of a system may simply make another means of penetration more appealing to intruders

26 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Threats, Vulnerabilities, and Controls A threat to a computing system is a set of circumstances that has the potential to cause loss or harm A vulnerability is a weakness in the security system –For instance, a particular system may be vulnerable to unauthorized data manipulation because the system does not verify a user's identity before allowing data access How do we address these problems? We use a control as a protective measure –A control is an action, device, procedure, or technique that removes or reduces a vulnerability –A threat is blocked by control of a vulnerability

27 Spring 2007EEC693: Secure & Dependable ComputingWenbing Zhao Threats, Vulnerabilities, and Controls