Week 1: Introduction

Seite 1

Defining Security

The security of a system, application, or protocol is always relative to:

A set of desired properties

An adversary with specific capabilities

For example, standard file access permissions in Linux and Windows are not effective against an adversary who can boot from a CD

[Core] Security Goals (C.I.A.)

Confidentiality is the avoidance of the unauthorized disclosure of information.

Involves protection of data, providing access for those allowed to see it while disallowing other from learning anything about its content.

Tools:

Encryption: the transformation of information using an encryption key to so that the transformed information can only be read using the decryption key (which may be the same as the encryption key in some cases).

Access Control: rules and policies that limit access to confidential information to those people and/or systems with a "need to know".

This need to know may be determined by identity, such as a person's name or a computer's serial number, or by a role that person has, such as being a manager or a computer security specialist.

Authentication: the determination of the identity or role someone has usually based on a combination of:

something the person has (smart card or key fob)

something the person knows (password, pin, security questions)

something the person is (fingerprint, iris scanners)

Authorization: the determination if a person or system is allowed access to resources, based on access control policy

Such authorizations should prevent an attacker from tricking the system into letting him have access to protected resources.

Physical Security: the establishment of physical contact barriers to limit access to protected computational resources.

Such barriers include locks on cabinets and doors, placements of computers in windowless rooms, the use of sound dampening materials, and even the construction of buildings or walls incorporating copper meshes (called Faraday cages) so that electromagnetic signals cannot enter or exit the enclosure.

Integrity is the property that information has not been altered in an unauthorized way.

Tools:

Backups: periodic archiving of data.

Checksums: the computation of a function that maps the contents of a file to a numerical value. A checksum function depends on the entire contents of a file and is designed in a way that even a small change to the input file (such as flipping a bit) is highly likely to result in a different output value.

Data Correcting Codes: methods for storing data in such a way that changes can be easily detected and automatically corrected.

Availability is the property that information is accessible and modifiable in a timely fashion by those authorized to do so.

Tools:

Physical Protections: infrastructure meant to keep information available even in the event of physical challenges.

Computational Redundancies: computers and storage devices that serve as fallbacks in the case of failures

Seite 2

Other Security Concepts (A.A.A.)

Assurance refers to how trust is provided and managed in computer systems.

Trust management depends on:

Policies which specify behavioral expectations that people or systems have for themselves and others.

For example, the designers of an online music system may specify policies that describe how users can access and copy songs.

Permissions which describe the behaviors that are allowed by the agents that interact with a person or system

For instance, an online music store may provide permissions for limited access and copying to people who have purchased certain songs.

Protections which describe mechanisms put in place to enforce permissions and policies.

We could imagine that an online music store would build in protections to prevent people from unauthorized access and copying of its songs.

Authenticity is the ability to determine that statements, policies, and permissions issued by persons or systems are genuine.

Primary tool:

Digital Signatures: these are cryptographtic computations that allow a person or system to commit to the authenticity of their documents in a unique way that achieves nonrepudiation, which is the property that authentic statements issued by some person or system cannot by denied.

Anonymity the property that certain records or transactions not to be attributable to any individual.

Tools:

Aggregation: the combining of data from many individuals so that disclosed sums or averages cannot be tied to any individual.

Mixing: the intertwining of transactions, information, or communications in a way that cannot be traced to any individual.

Proxies: trusted agents that are willing to engage in actions for an individual in a way that cannot be traced back to that person.

Pseudonyms: fictional identities that can fill in for real identities in communications and transactions, but are otherwise known only to a trusted entity.

Seite 3

Threats and Attacks

Eavesdropping: the interception of information intended for someone else during its transmission over a communication channel.

Alteration: unauthorized modification of information.

Example: the man-in-the-middle attack, where a network stream is intercepted, modified, and retransmitted.

Denial-of-Service (DOS): the interruption or degradation of a data service or information access.

Example: email spam, to the degree that it is meant to simply fill up a mail queue and slow down an email server.

Masquerading: the fabrication of information that is purported to be from someone who is not actually the author.

Repudiation: the denial of a commitment or data receipt.

This involves an attempt to back out of a contract or a protocol that requires the different parties to provide receipts acknowledging that data has been received

Correlation and Traceback: the integration of multiple data sources and information flows to determine the source of a particular data stream or piece of information.

Seite 4

The Ten Security Principles

Economy of Mechanism

This principle stresses simplicity in the design and implementation of security measures.

While applicable to most engineering endeavors, the notion of simplicity is especially important in the security domain, since a simple security framework facilitates its understanding by developers and users and enables the efficient development and verification of enforcement methods for it.

Fail-Safe Defaults

This principle states that the default configuration of a system should have a conservative protection scheme.

For example, when adding a new user to an operating system, the default group of the user should have minimal access rights to files and services. Unfortunately, operating systems and applications often have default options that favor usability over security.

This has been historically the case for a number of popular applications, such as web browsers that allow the execution of code downloaded from the web server.

Complete Mediation

The idea behind this principle is that every access to a resource must be checked for compliance with a protection scheme.

As a consequence, one

Open Design

Separation of Privilege

Least Privilege

Least Common Mechanism

Psychological Acceptability

Work Factor

Compromise Recording

Seite 5

Access Control

Access Control Matrices

A table that defines permissions.

Each row of this table is associated with a subject, which is a user, group, or system that can perform actions.

Each column of the table is associated with an object, which is a file, directory, document, device, resource, or any other entity for which we want to define access rights.

Each cell of the table is then filled with the access rights for the associated combination of subject and object.

Access rights can include actions such as reading, writing, copying, executing, deleting, and annotating.

An empty cell means that no access rights are granted.

Access Control Lists

It defines, for each object, o, a list, L, called o's access control list, which enumerates all the subjects that have access rights for o and, for each subject, s, gives the access rights that s has for object o.

Seite 6

Seite 7

Seite 8

Seite 9

Seite 10