Basic Security Concepts University of Sunderland CIT304 Harry R Erwin, PhD

Analyzing Security (from Schneier, 2003, Beyond Fear) These are the questions we must usually answer. 1.What assets are you trying to protect? 2.What are the risks to those assets? 3.How are you trying to protect them? 4.How well does your solution work? 5.What other risks does your solution introduce? 6.What are the costs and trade-offs of your solution? (I often ask this as an exam question.)

Systems Security involves systems, and systems are not simple. They’re complex, elusive, and maddening. ‘A collection of simpler components that interact to form a greater whole.’ Hardware, software, people, and procedures. Systems also interact with other systems. Unexpected interactions are called ‘emergent properties’ or ‘unintended consequences.’ These are our concern.

Security Systems Most systems do something. Security systems are different—they prevent things from happening. You will care about how systems fail and how they can be made to fail. It’s ‘applied paranoia.’

The Roles of People in Security Decision-makers—choose what mechanisms and policies to follow, often to further their own agendas. Users—cooperative or uncooperative. Basic to making security work. Innocent bystanders—but still often affected. Attackers—sometimes not malicious, but usually intending to do what they did.

Bruce Schneier’s Three Rules of Understanding Security Schneier Risk Demystification: Numbers matter and are not that hard to understand. Schneier Secrecy Demystification: Secrecy is anathema to security: –It’s brittle –It conceals abuse –It prevents sensible trade-offs Schneier Agenda Demystification: Know the agendas of the people involved in a security decision. They usually drive the decision in certain directions.

Basic Terminology Vulnerability Threat Risk Trust Reliability Security Integrity (Know these definitions cold!)

Vulnerability ‘A weakness that may lead to undesirable consequences.’ Typical vulnerabilities include –Hardware –Software –Procedure –External or environmental

Threat ‘The danger that a vulnerability will actually occur.’ Describes how the vulnerability would be attacked: –E.g., buffer overflow is the vulnerability, and the threat would be transmission of a TCP/IP packet to cause buffer overflow. Should be quantified by a rate of attack—i.e., how frequently an effective attack can be expected to occur.

Risk ‘A potential problem’, consisting of a –Vulnerability –Threat (expected attack rate) –Expected extent of the consequences. Hence risk in this sense is cost per unit of time (although the elements may be very hard to estimate) You can also think about the capital cost of risk. To convert between the two, you use the cost of money (i.e., interest). These are what managers must evaluate against the costs of mitigating the risk.

Trust ‘A relationship between two entities where one entity allows the other to perform certain actions.’ In traditional security, based on need to know, and can be managed by security level and authorizations. In e-commerce, becomes very complex. Currently a leading-edge research area.

Reliability ‘The system performs functionally as expected.’ Related to availability. Availability (a fraction) can be computed numerically as time the system is actually functional divided by the time the system is supposed to be functional. Related terminology include: –MTTF—mean time to failure (time) –MTTR—mean time to repair (time)

Security ‘Freedom from undesirable events’—hence much broader than the usual concept. In the UK, there are three elements to security (in a narrow sense) often listed: –Confidentiality—‘protection of data from unauthorized access.’ –Integrity—‘protection of data from unauthorized modification.’ More generally, certain desirable conditions are maintained over time –Availability—‘the system is usable by authorized users.’

Summary A security analyst, a safety analyst, and a risk analyst have very similar job descriptions—all are concerned with managing risk. Risk is expensive. The distinctive character of the security analyst’s job reflects a primary concern with malicious and intelligent threats. The US security analysis community was unsurprised by the events of 11/9/2001—we had already thought about the scenario (and worse ones).

Assignment Over the next two weeks, read Schneier (2003) Beyond Fear. We’ll pick up security again in two weeks.