I I 3YSTEMS AND NTERNET NFRASTRUCTURE 3ECURITY ETWORK AND 3ECURITY 2ESEARCH ENTER EPARTMENT OF OMPUTER 3CIENCE AND NGINEERING 0ENNSYLVANIA 3TATE 5NIVERSITY 5NIVERSITY 0ARK 0 CMPSC443 Introduction to Computer and Network Security Module Security Basics Professor Patrick McDaniel Spring 2009 CMPSC443 Introduction to Computer and Network Security Page 1 How to rob a bank First get a cockroaches a cell phone a uniform and and friend CMPSC443 Introduction to Computer and Network Security Page 2 What is security Garfinkel and Spafford 1991 A computer is secure if you can depend on it and its software to behave as expected Harrison Ruzzo Ullman 1978 Prevent access by unauthorized users Not really satisfactory does not truly capture that security speaks to the behavior of others Expected by whom Under what circumstances CMPSC443 Introduction to Computer and Network Security Page 3 Risk At risk valued resources that can be misused Monetary Data loss or integrity Time Confidence Trust What does being misused mean Privacy personal Confidentiality communication Integrity personal or communication Availability access or fidelity Q What is at stake in your life CMPSC443 Introduction to Computer and Network Security Page 4 Threats A threat is a specific means by which an attacker can put a system at risk An ability of an attacker e g eavesdrop on a communication channel Independent of what can be compromised A threat model is a collection of threats that deemed important for a particular environment A collection of attacker s abilities E g A powerful attacker can read and modify all communications and generate messages on a communication channel Q What were risks threats in the introductory examples ZDNet Yale Princeton Estonia CMPSC443 Introduction to Computer and Network Security Page 5 Vulnerabilities attack vectors A vulnerability is a systematic artifact that exposes the user data or system to a threat E g buffer overflow WEP key leakage What is the source of a vulnerability Bad software or hardware Bad design requirements Bad policy configuration System Misuse Unintended purpose or environment E g student IDs for liquor store CMPSC443 Introduction to Computer and Network Security Page 6 Adversary An adversary is any entity trying to circumvent the security infrastructure The curious and otherwise generally clueless e g script kiddies Casual attackers seeking to understand systems Venal people with an ax to grind Malicious groups of largely sophisticated users e g chaos clubs Competitors industrial espionage Governments seeking to monitor activities CMPSC443 Introduction to Computer and Network Security Page 7 Are users adversaries Have you ever tried to circumvent the security of a system you were authorized to access Have you ever violated a security policy knowingly or through carelessness CMPSC443 Introduction to Computer and Network Security Page 8 Attacks An attack occurs when someone attempts to exploit a vulnerability Kinds of attacks Passive e g eavesdropping Active e g password guessing Denial of Service DOS Distributed DOS using many endpoints A compromise occurs when an attack is successful Typically associated with taking over altering resources CMPSC443 Introduction to Computer and Network Security Page 9 Social Networking The act of exploiting human tendencies or processes to circumvent physical security to obtain sensitive data or access exploit natural tendency to trust gas station guy blind people with huge reward Nigerian finance minister exploit people s vanity who s who in X exploits people desire to avoid embarrassment Lisa calling me from CMPSC443 Introduction to Computer and Network Security Page 10 Participants Participants are expected system entities Computers agents people enterprises Depending on context referred to as servers clients users entities hosts routers Security is defined with respect to these entitles Implication every party may have unique view A trusted third party Trusted by all parties for some set of actions Often used as introducer or arbiter CMPSC443 Introduction to Computer and Network Security Page 11 Trust Trust refers to the degree to which an entity is expected to behave What the entity not expected to do E g not expose password What the entity is expected to do obligations E g obtain permission refresh A trust model describes for a particular environment who is trusted to do what Note you make trust decisions every day Q What are they Q Whom do you trust CMPSC443 Introduction to Computer and Network Security Page 12 Security Model A security model is the combination of a trust and threat models that address the set of perceived risks The security requirements used to develop some cogent and comprehensive design Every design must have security model LAN network or global information system Java applet or operating system The single biggest mistake seen in use of security is the lack of a coherent security model It is very hard to retrofit security design time This class is going to talk a lot about security models What are the security concerns risks What are the threats Who are our adversaries CMPSC443 Introduction to Computer and Network Security Page 13 A Security Model Example In class elements of the security model for the bank Participants Trusted Adversaries Risks Threats Q how did the security model fail what was not modeled leads to insecurity CMPSC443 Introduction to Computer and Network Security Page 14 Makefile Make a utility for automatically building executable programs and libraries from source code Files called makefiles specify how to derive the target program from each of its dependencies CMPSC443 Introduction to Computer and Network Security Page 15 Tar tar an archiving program designed to store and extract files from an archive file known as a tarfile To create gzipped tar archive of the directory test called file tgz tar cvfz file tgz test To extract gzipped tar file tar xvfz file tgz Where c create x extractr v verbose f file rather than standard input z compress zip The uncompress will create the directory and contents CMPSC443 Introduction to Computer and Network Security Page 16