1. USC CSci499 Security Systems Lecture notes – Spring 2013 Dr. Jelena Mirkovic University of Southern California Information Sciences Institute

2. Class home page http://ccss.usc.edu/499 – Syllabus – Assignments – News – Lecture notes Keep checking it!

3. Contact Instructor – Dr. Jelena Mirkovic – Office hours Fri 1-2pm or by appt in SAL 214/216 – Contact via email (on class web page)

4. Grading Grading: – CTF exercises: 20% – Homeworks: 20% – Quizzes: 5% – Participation: 5% – Midterm Exam: 20% – Final Exam: 30% Grades assigned using an absolute curve: AA-B+BB-C+CC-D+DD 9086838076737066636056

5. Homeworks Done on DeterLab testbed – I will open an account for each of you after the class – You will get an automated email how to log on – Your assignment for the next class – read through the tutorial (at http://www.deterlab.net) and run a sample experiment to learn how to use DeterLabhttp://www.deterlab.net We’ll have 4 homeworks, each carries 5% of your grade Ask for help early Do NOT email testbed ops, I can help with all DeterLab issues

6. Capture-the-Flag Exercises Done on DeterLab testbed Blue team develops some technology, Red team attacks it Everyone will have a chance to be on both teams Each exercise will be performed in class, each carries 10% of your grade – I’m not looking for extraordinary solutions (although they are welcome) but for good integration of what you learned in class and what you managed to learn off the Internet – Teamwork is important

7. Quizzes Done before each homework exercise Repeated after the exercise You MUST take each quiz Total 5% of your grade

8. Midterm and Final Closed book, closed notes Each last 1 h 20 min We will have reviews in class before each

9. Class Participation Class participation is important – Ask and answer questions in class – Ask, answer, participate on-line Class participation carries 5% of your grade

10. DEN DEN system will host the class discussion board – To gain access and log in https://mapp.usc.edu/ https://mapp.usc.edu/ – Contact webclass@usc.edu if you have difficulty with the systemwebclass@usc.edu – I will check the discussion board once daily but if you want a reliable response from me email me directly

11. Academic Integrity What is and is not OK – I encourage you to work with others to learn the material but everyone must DO their work ALONE – Do not to turn in the work of others – Do not give others your work to use as their own – Do not plagiarize from others (published or not) – Do not try to deceive the instructor See the Web site – More guidelines on academic integrity – Links to university resources – Ask if in doubt You can always ask me for help!

12. What Does Security Mean?

13. What Does Security Mean? … In Real Life No one should be able to: – Break into my house – Attack me – Steal my TV – Use my house to throw water balloons on people – Damage my furniture – Pretend to be my friend Bob and fool me – Waste my time with irrelevant things – Prevent me from going to my favorite restaurant – Destroy my road, bridge, city..

14. What Does Security Mean? … wrt Computers and Nets No one should be able to: – Break into my computer – Attack my computer – Steal my information – Use my computer to attack others – Damage my computer or data – Use my resources without my permission – Mess with my physical world I want to talk to Alice – Pretend to be Alice or myself or our computers – Prevent me from communicating with Alice

15. Computer vs. Network Security An isolated computer has a security risk? – Computer security aims to protect a single, connected, machine Networking = communication at all times and in all scenarios!!! – Network security aims to protect the communication and all its participants Security = robustness or fault tolerance? Computer security Network security

16. Security Properties Confidentiality (C) – Keep data secret from non-participants Integrity (I) – Aka “authenticity” – Keep data from being modified – Keep it functioning properly Availability (A) – Keep the system running and reachable

17. Orthogonal Aspects Policy – Deciding what confidentiality, integrity and availability mean Mechanism – Implementing the policy

18. Security Goals Attack prevention – It is impossible for the attack to succeed Attack detection – Low false positives, false negatives and detection delay Attack response – Retaliation, observation, recovery Attack recovery – Remedy the effects of the attack or sustain it A false positive is when the system detects an attack, but the attack did not occur. A false negative is when the attack is missed by the system.

19. What Does Security Mean? … wrt Computers and Nets No one should be able to: – Break into my computer – A, C, I – Attack my computer – A, C, I – Steal my information - C – Use my computer to attack others – I? – Damage my computer or data - I – Use my resources without my permission – A – Mess with my physical world – I, A I want to talk to Alice – Pretend to be Alice or myself or our computers – C, I – Prevent me from communicating with Alice - A

20. What Are the Threats? Breaking into my computer o Hackers Break a password or sniff it off the network Exploit a vulnerability Use social engineering Impersonate someone I trust o Viruses and worms A vulnerability is a weakness in the system (its design, implementation or use procedures) that when exploited makes it behave in a way that system’s creator did not expect. An exploit is a set of steps that exercises the vulnerability

21. What Are the Threats? Attacking my computer o Denial-of-service attacks o Viruses and some worms A virus is a self-replicating program that requires user action to activate such as clicking on E-mail, downloading an infected file or inserting an infected floppy, CD, etc.. A worm is a self-replicating program that does not require user action to activate. It propagates itself over the network, infects any vulnerable machine it finds and then spreads from it further. A DOS attack aims to disrupt a service by either exploiting a vulnerability or by sending a lot of bogus messages to a computer offering a service

22. What Are the Threats? Stealing my information o From my computer or from communication o I will use cryptography! There are many ways to break ciphers There are many ways to divulge partial information (e.g. who do you talk to) o I would also like to hide who I talk to and when I will use anonymization techniques Anonymization hinders other security approaches that build models of normal traffic patterns

23. What Are the Threats? Using my machine to attack others o E-mail viruses o Worms o Denial-of-service attacks (including reflector attacks) o Spam, phishing

24. What Are the Threats? Damaging my computer or data o I have to prevent break-ins o I will also use cryptography to detect tampering o I must replicate data to recover from tampering o Denial-of-service attacks and worms can sometimes damage computers

25. What Are the Threats? Taking up my resources with irrelevant messages o Denial-of-service attacks o Spam mail (takes time to read and fills space) o Viruses and worms

26. What Are the Threats? Messing up with my physical world o Cyber-physical attacks or collateral victims o Power systems, traffic control, utilities o Travel agencies o Medical devices o Smart vehicles

27. What Are the Threats? Pretending to be Alice or myself or our computers o I want to be sure who I am talking to (authentication and digital signatures) o It is hard to impersonate a computer in two-way communication, such as TCP But it has been done o Plain IP spoofing seems an extremely hard problem to solve IP spoofing means putting a fake IP address in the sender field of IP packets.

28. What Are the Threats? Preventing me from communicating with Alice o Alice could be attacked o Routers could be overloaded or tampered with o DNS servers could be attacked

29. Some Security Mechanisms Encryption Checksums Key management Authentication Authorization Accounting Firewalls VPNs Intrusion Detection Intrusion Response Virus scanners Policy managers Trusted hw

30. What Are the Challenges? Your security frequently depends on others – Tragedy of the Commons A good solution must – Handle the problem to a great extent – Handle future variations of the problem, too – Be inexpensive – Have economic incentive – Require a few deployment points – Require non-specific deployment points

31. What Are the Challenges? Fighting a live enemy o Security is an adversarial field o No problem is likely to be completely solved o New advances lead to improvement of attack techniques o Researchers must play a double role

32. What Are the Challenges? Attack patterns change Often there is scarce attack data Testing security systems requires reproducing or simulating legitimate and traffic o No agreement about realistic traffic patterns No agreement about metrics There is no standardized evaluation procedure Some security problems require a lot of resources to be reproduced realistically

33. Practical Considerations Risk analysis and risk management – How important it is to enforce a policy – Which threats matter – Legislation may play a role The role of trust – Assumptions are necessary Human factors – The weakest link

34. In The Shoes of an Attacker Who are the attackers – Used to be teenage hackers (bragging rights) – Now organized criminal (for profit) – Political organizations Risk to the attacker – Usually very small