Presentation is loading. Please wait.

Presentation is loading. Please wait.

ECE454/599 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2012.

Similar presentations

Presentation on theme: "ECE454/599 Computer and Network Security Dr. Jinyuan (Stella) Sun Dept. of Electrical Engineering and Computer Science University of Tennessee Fall 2012."— Presentation transcript:


2 Introduction to Computer and Network Security Why security? Security goals Security mechanisms Security services Security limitations 2

3 Threats, Vulnerabilities, Attacks A threat is a set of circumstances that has the potential to cause loss or harm A vulnerability is a weakness that may be exploited to cause loss or harm A vulnerability can be exploited to perpetrate an attack 3

4 Threats, Vulnerabilities, Attacks How to address these problems? Control: an action, device, procedure, or technique that removes or reduces a vulnerability, and subsequently blocks threats and attacks This class focuses on the various controls and how they enhance a system’s security 4

5 Security Trends 5

6 Why Security?-Threats and Vulnerabilities 6 Malware DoS and DDoS attacks Phishing Botnet Software vulnerabilities: cross-site scripting (XSS), SQL injection, buffer overflow, directory traversal, cryptographic issues such as missing encryption/ authentication, using broken cryptographic schemes and improper authorization

7 Malicious Software 7 Trojan horse: instructions hidden inside an otherwise useful program that do bad things Virus: a set of instructions that inserts copies of itself into other programs Worm: a program that replicates itself on other machines across a network Trapdoor: an undocumented entry point in a program Logic bomb: malicious instructions that trigger on some event in the future Zombie: malicious instructions on comprised machines that are used to launch attacks Spyware: a software that installs itself on the user’s computer, monitor user activities, browser hijacking, password sniffing Rootkit: a software that enables continued privileged access while hiding its presence

8 How Do They Spread? 8 Email Shared medium: CD, USB Mobile program Program bugs Buffer overflow

9 Defense 9 Operating System: resource access control Virus Checker: instruction patterns, file lengths or digests Software Patch: bug fixes Intrusion Detection: host intrusion detection, network intrusion detection Firewall: filter unwanted/unauthorized traffic

10 Passive Attacks Disclosure of message contents 10

11 Passive Attacks Traffic analysis 11

12 Active Attacks Masquerade 12

13 Active Attacks Replay 13

14 Active Attacks Modification 14

15 Active Attacks Denial of Service (DoS) 15

16 More Attacks Coming… 16

17 Security Goals Confidentiality: information or resources can only be accessed by authorized parties, sometimes called secrecy or privacy Integrity: information or resources can be modified only by authorized parties or only in authorized ways Availability: information or resources accessible to authorized parties at appropriate times; requirement for denial-of-service (DoS) prevention … 17

18 Security Goals (Cont’d) 18

19 Example: e-Banking Confidentiality: an employee should not disclose a customer’s account information to another customer. Integrity: an employee should not improperly modify a customer’s account balance. Availability: system should be usable when customers purchase with credit cards. 19

20 Example: e-Health Confidentiality: doctors should not disclose patients’ medical records without consent. Integrity: patients’ medical records should not be illegally modified or deleted. Availability: patients’ medical records should be accessible anytime anywhere. 20

21 Attacks Continued… 21 Attacks on confidentiality: network Eavesdropping, packet sniffing, illegal copying

22 Attacks Continued… 22 Attacks on integrity: network Intercept messages, tamper, release again, discard

23 Attacks Continued… 23 Attacks on availability: DoS, DDoS attacks (SYN flooding, smurfing) network Overwhelm or crash servers, disrupt infrastructure

24 SYN Flooding 24 A normal connection between Alice and a server, the three-way handshake is correctly performed.

25 SYN Flooding (Cont’d) 25 SYN flood: Darth the attacker sends several packets but does not send the "ACK" back to the server. The connections are hence half-opened and consuming server resources. Alice, a legitimate user, tries to connect but the server refuses to open a connection resulting in a denial of service. SYN floods may appear with a wide range of source IP addresses, giving the appearance of a well distributed DDoS.

26 Spoofing/Masquerading 26 Attacks on authenticity: man-in-the-middle

27 Attacks on Password Password sniffing Brute-force attack Dictionary attack Phishing Social engineering 27

28 Summary of the Kinds of Attacks Interception: some unauthorized party has gained access to information or resources, e.g., illicit copying of program or data files, wiretapping to obtain data in a network Interruption: information or resources become lost, unavailable, or unusable, e.g., malicious destruction of a hardware device, erasure of a program or data file 28

29 Summary of the Kinds of Attacks Modification: unauthorized parties tampering with the information or resources, e.g., alter a program so that it performs an additional computation, or modify data being transmitted electronically, or modify hardware Fabrication: an unauthorized party might create a fabrication of counterfeit objects on a computing system, e.g., insert spurious transactions to a network communication system or add records to an existing database 29

30 Security Mechanisms Any process (or a device incorporating such a process) designed to detect, prevent, or recover from a security attack Examples: encryption algorithms, digital signatures, authentication protocols Types: - prevention: password, encryption, digital signature, access control, authentication, data integrity, firewall - detection: monitoring, log, auditing, intrusion detection - recovery: backups, bug fixes, retaliation 30

31 Security Services A processing or communication service that enhances the security of the data processing systems and the information transfers of an organization. The services are intended to counter security attacks, and they make use of one or more security mechanisms to provide the service. 31

32 Security Services (Cont’d) Authentication: the assurance that the communicating entity is the one that it claims to be - Peer entity authentication: to provide confidence in the identity of the entities connected - Data origin authentication: to provide assurance that the source of received data is as claimed Access control: the prevention of unauthorized use of a resource Data confidentiality: the protection of data from unauthorized disclosure Data integrity: the assurance that data received are exactly as sent by an authorized entity (i.e., contain no modification, insertion, deletion, or replay). Non-repudiation: provides protection against denial by one of the entities involved in a communication of having participated in all or part of the communication Availability: a system or a system resource being accessible and usable upon demand by an authorized system entity 32

33 Relationship-Security Mechanisms and Services 33

34 A Model for Network Security 34

35 Security Design Principles Easiest penetration Timeliness Effectiveness Weakest link 35

36 Security Limitations Human factors Cost-security tradeoff “Whoever thinks his problem can be solved using cryptography, doesn’t understand his problem and doesn’t understand cryptography” - Roger Needham and Butler Lampson to each other 36

37 Reading Assignments [Kaufman] Chapter 1 37


Similar presentations

Ads by Google