CYB 5272 Summary

Intro and Overview

We need to remember that the main goal of computer and information security is to protect
assets such as hardware software or sensitive data, from hackers, criminals, malcontent
employees, or even terrorists. Major costs can be incurred depending on the type of attack and
the target of the attack. Tangible costs such as the cost of replacement and repair as well as
intangible cost such as the company's reputation and its employee's both must be considered when
referring to an attack occurrence. For these reasons alone, we need to think about security
differently in order to prevent or at least reduce the risks of such an event from occurring. How
should we think about security? I believe we should view it from the attacker's perspective. We
should respect the fact that the attackers have the advantage. Attackers can choose both the
time and place of the attack as well as how they are going to attack. Attackers can also identify
software vulnerabilities in advance by getting a copy of it and looking at the common
vulnearability database or analyzing the code itself. As in warfare attackers are the aggressors. On
the other hand, we are the defenders which means we are going to have to work very hard to
anticipate possible attacks and prevent them. In order to be effective at what we do we need to
understand security risks. In most cases security risks are very difficult to understand. Knowing the
difference the between threats ,vulnerabilities, and attacks can go a long ways in helping us to get a
grasp on security risks. Threats are the potential source of an adverse event to do harm.
Vulnerabilities are a weakness in a system, network, or an application through which that harm can
occur therby making it subject to exploitation or misuse. Attacks basically carry out threats through
malicious activities by collecting, disrupting, denying, or destroying IS resources. Once we fully
understand these definitions we will have a better understanding of the security risks we are faced
with. It is a well known fact that attackers usually target the three aspects of security known as
confidentiality, integrity, and availability. Confidentiality in a nutshell is keeping our secrets secret. It is
the property that sensitive information is not disclosed to unauthorized individuals, entities, or
processes. Integrity is guarding against improper information modification or destruction, and includes
ensuring information has not changed and therefore is authentic, and availability is ensuring timely
and reliable access to and use of information. As defenders our goals should be to anticipate threats
and control vulnerabilities as best as we can. In order to defend our systems we also need to
understand the goals or motivations of attackers which in essence will give us not only the reasons for
the attack but may even give us a hint as to the type of attack we can expect . As a result we can
employ the use of hardware and software tools and techniques specifically designed to protect
systems as well as detect and prevent attacks. Using tools and techniques such as firewalls,
authetication, encryption, crytography, intrusion detection and intrusion prevention systems, along
with other security controls and requirements, we can rest assured that we have everything we need
for protecting assests. We can also set up policies and procedures to make systems more secure in
order to recover from attacks more quickly.
Cryptography
What is Crytography? Cryptography comes from secret writing and it involves taking plaintext that is
unencrypted text and converting it into ciphertext. Ciphertext is encrypted through the use of a secret
piece of information kown as a key. This key is used to convert the plaintext into the ciphertext. Thus
encryption is the conversion of plaintext to ciphertext through the use of a cryptographic algorithm.
Encryption can by symmetric or asymmetric. There differences are very suddle. Basically symmetric
uses the same key for encrypting and decrypting messages while asymmetric uses different keys for
encrypting and decrypting. The process uses well-defined algorithms which today are easily broken by
skilled attackers. Encryption unfortunately tends to foster security through obsecurity meaning that
protection is achieved by keeping the algorithm secret. Basically, if know one knows how the
encryption algorithm works then it can't be cracked. This gives a false sense of protection because
eventually hidden encryption algorithms will be discovered. Using unbreakable encryption such as a
one-time pad is a better option and ideal for ironclad protection. A one-time pad is where the key is
the same length as the message and is used only once and is never repeated. Its difficult to break
because it requires trying all possible combinations of key which could take years even centuries on
long messages. Although the one-time pad isn't necesarily unbreakable, the time to break it is what
keeps it safe. How do attackers reduce the difficulty of breaking encryption? In many cases they guess
or steal the key. By using techniques like social engineering, espionage, and other means, most often
attackers can get access to the key without even trying to break the encryption algorithm. for those

attackers acting as code breakers, they look for common patterns in order to do a plaintext attack. By
understanding that there are two common encryption approaches called substitution and
transposition, attackers can map a strategy of how to pursue breaking the code. Substitution hides
messages by replacing characters in the plaintext by other characters or symbols on a one-to-one
basis. The basically attempts to confuse the reader by making the encrypted message look like a
bunch of random characters; however this is not enough to safely encrypt messages. The solution to
that problem is transposition which repositions the letters by following a specific algorithm. This
produces a diffusion of the original letters spreading them out throughout the message and while at
the same time hiding those combinations of double letters but because its a specific algorithm they
can then be reconstructed later. Most modern encryption algorithms use a combination of substitution
and transposition along with mathematical manipulations to further diffuse the contents of the
plaintext. The best cryptographic algorithms security is based on sound mathematical principles and
secret keys . Other uses of encryption include hash functions which are used to verify the integrity of a
message, mixed-matched encrypt-decrypt techniques for passing secret keys back and forth between
people and digital signatures for verifying a person's authentication as well a a messages integrity.
Cryptography can also be used to protect software by issuing digital certificates to verify its
authenticity.
Program Security & Secure System Design
According to Jerome Saltzer and Michael Schroeder there are eight excellent design security principles.
The first of those is called economy of mechanism that is make your programs simple and small. In
essence, complexity is the enemy of security because it increase the risks of problems occurring.
Keeping things simple and small can avoid problems. The second is fail-safe defaults the idea is to
deny access to everyone and then allow access only to those who need it. In other words, security
problems related to failure should be avoided at all costs. The third is called complete mediation every
access requests should be checked for authentication every time. In other words, the access control
system should be throrugh and constantly rechecked for system changes.The forth is open design the
design of a system should not be secret. We cannot depend on the ignorance of potential attackers,
but rather on possession of specific protection keys or passwords. Security through obsurity is always
a bad idea. Then theres separation of privilege the idea that two separate keys are better than one. In
other words keep privileges set apart. Two keys are more robust and flexible than one key. Next
theres least privilege the idea that we should grant the minimum set of permissions to a user that is
required for them to do their task. This limits the damage that can result from an accident or error
and reduces the interactions among privileged programs. Also, we should have least common
mechanism that is minimize the amount of shared code and data that is common to multiple users.
Every shared mechanism represents a potential information path between users and must not
unintentionally compromise security. Finally, we need to have psychological acceptability if the human
user interface is not easy to understand and is not easy to use and users wont use it which means
they wont use protection mechanisms that are built in your system. We should understand that
attackers will find vulnerabilities in software and figure out a way to exploit them to attack or
compromise the system. Software designers and programmers need to learn to avoid errors that can
cause exploitable vulnerabilities by using secure software design principles in a a proven secure
software development lifecycle. This will in essence help guide developers towards creating more
secure software. Software that was designed without using secure software principes should perform
security testing that focuses on finding errors in the software that might lead to security
vulnerabilities. Software engineers can use something called secure software design patterns which
are guidelines for how to build more secure systems. There re a number of simple but easily
exploitable software errors. Things such as overly complicated designs, excessive access to data snd
assumptions about the user or about valid input data, are all common errors that could be avoided
with secure prctices. The most common vulnerabilities are listed on both OWASP and Mitre Corporation
websites. Both of these resources allow you to get an idea of what the most common most recent
vulnerabilities are and hopefully to prevent using those in your own software development. The intent
of malicious code is to target the confidentiality integrity and availability of systems. In a nutshell they
try to access secrets, modify or delete data, or deny access to users. Two common forms of malicious
code are viruses and worms. A virus is a computer program that can replicate itself, infect a computer
without permission or knowledge of the user, and then spread or propagate to another computer. A
worm on the other hand is a self-replicating, self-propagating, self-contained program that uses
networking mechanisms to spread itself. Both of them duplicate themselves and replicate across the
network or across disk drives. Viruses require human interaction someone must open a file or start a

program to activate the virus. Worms are self-activating therefore can spread much faster .we msut
remember tat detection approach is perfect, It willeither miss some malicious software or or produce
false alarms. There are two main approaches: the reactive approach detects known malicious software
accurately by looking at its signature and the proactive approach whic looks for behavior thats
suspicious but it may often be wrong and can threby trrgger a falsre alarm. Stealthy malicious code
deliberately hides itself to avoid detection. Keystroke loggers are used for stealing private data such as
passwords and transmiting them to the attacker. Root kits circumvent operating system protections by
installing themselves places where they won't be noticed and then make changes to the system that
will allow unauthorized access. Trapdoors and backdoors secretly give remote access to attackers
across the network. Security controls such as good design and coding to prevent the creation of
vulnerable software, security focus software testing to discover vulnerabilities in existing code, attack
resilient system design and proper training to raise security awareness among employees and
customers, can all be useful in detecting and preventing attacks.