Information (Cyber Security)

Information security is about protecting the CIA properties of the services

• Confidentiality: only those entitled may access the service
• Integrity: services should always behave correctly
• Availability: authorized clients should always have access and also ensuring Privacy and Accountability

Authentication

Identity Verification:

Something you know

Example: password

Pros:

• Simple to implement
• Simple for users to understand

Cons:

• Easy to crack
• Passwords are reused anytime

OTP: different password used each time, but it is difficult to remember all of them

Something you have

Example:

• OTP Cards (e.g. SecurID): generates new
• password each time user logs in
• Smart Card: tamper-resistant, stores secret
  information, entered into a card-reader
• Token / Key (i.e., iButton)
• ATM Card

Strength of authentication depends on difficulty
of forging

Something you are

Example: biometrics

Pros:

• Raises the bar

Cons:

• false negatives/positives, social acceptance, key management
  – false positive: authentic user rejected
  – false negative: impostor accepted

Multi-Authentication

Two-factor Authentication: Methods can be combined (i.e. ATM card & PIN)

Three types (e.g. SSL):

• Client Authentication: server verifies client’s id
• Server Authentication: client verifies server’s id
• Mutual Authentication (Client & Server)

Authenticated user is a “Principal”

Authorization

Checking whether a user has permission to conduct some action

Access Control Models

Mechanism used by many operating systems to determine whether users
are authorized to conduct different actions

Mandatory: computer system decides exactly who has access to which resources

Discretionary: users are authorized to determine which other users can access files or other resources that they create, use, or own

Role-Based (Non-Discretionary): user’s access & privileges determined by role

Bell-LaPadula Model

Confidentiality

Goal: Keep the contents of communication or data on storage secret

Example: Alice and Bob want their communications to be secret from Eve

Key — a secret shared between Alice & Bob

Sometimes accomplished with Cryptography, Steganography, Access Controls, Database Views

Message/Data Integrity

Data integrity = No corruption

Man in the middle attack: Has Mallory tampered with the message that Alice sends to Bob?

Integrity Check: Add redundancy to data/message

Techniques:

Hashing, checksums, Message authentication codes

Accountability

Able to determine the attacker or principal

Logging & Audit Trails

Requirements:

• Secure Timestamping (OS vs. Network)
• Data integrity in logs & audit trails, must not be able to change trails, or be able to detect changes to logs
• Otherwise attacker can cover their tracks

Availability

Uptime, Free Storage
e.g. Dial tone availability, System downtime limit, Web server response time

Solutions:

• Add redundancy to remove single point of failure
• Impose “limits” that legitimate users can use

Goal of DoS (Denial of Service) attacks are to reduce availability

• Malware used to send excessive traffic to victim site
• Overwhelmed servers can’t process legitimate traffic