1. Assessing the Threat How much money is lost due to cyber crimes? –Estimates range from $100 million to $100s billions –Why the discrepancy? Companies don’t want to acknowledge that they have been broken in to No reliable reporting mechanism Games people play in estimating loss of time/productivity

2. Assessing the Threat How much money is lost due to cyber crimes? –Best report is the Annual CSI/FBI study

3. What is at Risk? Data Time Money Confidentiality (data disclosure) Resource availability

4. Why is there a Risk? Buggy Code Clueless Users –Should not blame users for not being experts Malicious Users –Systems should be user-proof, when possible Poor Administration Rise in sophistication of hacker tools –Root kits, nice GUI’s

5. Why is there a Risk? Poor implementation/choice of a cipher –How WEP (Wired Equivalent Privacy) implemented the RC4 cipher –Bad choice for WEP to use a stream cipher Poor implementation of design choices by programmers –Early versions of Netscape used a bad random number generator –Poor choices made when designing WEP BUGS, BUGS, BUGS….. –Buffer overflows, file permissions, Microsoft, etc

6. Categories of Risk Data vulnerabilities –Can the data be manipulated? Deleted? Software vulnerabilities –Does the software have bugs? –Is there any buffer overflows? –Can it execute code your not aware of? Physical-system vulnerabilities –Is your key systems behind lock and key? –What about a power loss/surge? –Fire?

7. Categories of Risk Transmission Vulnerabilities –Internet attacks –The gardener? –Sniffer –Traffic

8. Internet Attack Methods Password-based attacks –Guess the password –Brute force –Crack Network-snooping –See clear text; passwords, credit card numbers, protocols Trusted System Attacks –Exploit security that is based on trust.

9. Internet Attack Methods IP Spoofing –Assuming the identity of another computer A client connects to your machine instead of the server –Man in the middle Assume the identity of two computers at once Act as the server for the client Act as the client for the sever Become a relay of all data between the client and the server –Session Hijacking Redirect all data from the server to your machine

10. Internet Attack Methods Technology Exploits –Knowledge that certain combination of packets or requests causes known errors Shared Library Exploits –Replacing libraries that allows the attacker to access systems or sends data out. Social Engineering –Assume the identity of someone important and request access.

11. Security Management Security is primarily a management issue not a technology issue! –Because technology is only as good as the: Procedures Diligence of following the procedures Enforcement of the procedures

12. Security Management Management must have a comprehensive approach to security –Security is an Asymmetrical warfare Attackers only need 1 vulnerability to get in. So all aspects of security must be looked at –There must be multiple levels of security Management can’t rely on one security measure to assume a secure environment. –One firewall in not enough –VPN – only as secure as the laptop the employee takes home! –Management must have security audits Outside firms should be hired to “attack” the company to find vulnerabilities not know about.

13. Security Management There are three paths to protection –All must be followed to assure protection –And it must be done continually!! Policy Ex: Allow access only to specific web servers Technology Firewall, Hardened Web server, etc… Procedures Who can make changes? What access is allowed? Testing Try to get into a system Protection