1. Review Slides, Security +
Ted Demopoulos

2. Risk Management Security is all about Risk Management
Risk = Vulnerability x Threat
Vulnerability – a weakness in a system. All complex systems have vulnerabilities
Threat – an event that can cause an undesirable outcome. Threat implies potential harm

3. SLE/ALE
SLE: Single Loss Expectancy – loss from a single event (how bad can it be?)
ALE: Annual Loss Expectancy – loss from a threat over an entire year (can it happen multiple times?)

4. Quantitative vs. Qualitative
Risk assessment can be Quantitative or Qualitative
Quantitative -- a quantity or number.
e.g. if a Katrina strength hurricane hits again the expected loss is 22 billion dollars
Qualitative
e.g. if a Katrina strength hurricane hits again it will be extremely bad

5. Crypto Algorithms Symmetric Asymmetric Hashing Secret Key Public Key
Message Digest 1-way Encryption Irreversible Encryption
One Key
Public, Private Key Pairs
No Key
DES, 3-DES
AES, IDEA, RC4
Diffie-Hellman, RSA, El Gamal, ECC
MD2, MD4, MD5, SHA-1, SHA-2

6. PGP versus PKI
PKI – Central authority in change of trust, You MUST trust the central authority
PGP – Closer to anarchy. NO central authority.
Web of Trust – you trust your friends and many of your friend’s friends.

7. Access Control Discretionary Access Control (DAC)
Users control
Mandatory Access Control (MAC)
Not controlled by users, requires matching clearance and classification levels (e.g. top secret, secret, classified, etc.)
Role Based Access Control (RBAC)
Based on group memberships

8. TCP/IP 3 way Handshake
SYN
SYN, ACK
ACK

9. Some Common Ports (1) TCP 20, 21 – FTP (file transfer protocol)
TCP 22 – SSH (secure shell)
TCP 23 – telnet
TCP 25 – SMTP (simple mail transfer protocol)
TCP and UDP 53 – DNS (domain name system)

10. Some Common Ports (2) TCP 80 – HTTP (hyper text transfer protocol)
TCP 110 POP3 (post office protocol)
TCP 143 IMAP (internet message access protocol)
TCP 443 SSL, HTTPS (secure sockets layer, HTTP over SSL)

11. Open Source Tools (not on test)
Sniffers: TCPdump, Ethereal (now called Wireshark)
802.11: NetStumbler, Kismet
Password Assessment: John the Ripper, Cain and Abel
Vulnerability Assessment: Nessus
Intrusion Detection: Snort