Network Security. Introduction. Security services. Players. Conclusions. Distributed information Distributed processing Remote smart systems access

Transcription

1 Roadmap Introduction Network services X.800 RFC 2828 Players Marco Carli Conclusions 2 Once.. now: Centralized information Centralized processing Remote terminal access Distributed information Distributed processing Remote smart systems access 3 4

2 Network security Network are composed of interconnected hosts Hosts provide services and store information Users access services and exchange/store information 5 6 Vulnerability Each functionality has its own vulnerabilities! Joint functions more threads!!! Increasing complexty, freedom Network security It is important to assure in a distributed setting: privacy/confidentially Integrity/consistency Availability etc. 7 8

3 Roadmap Service Introduction Definition: services X.800 RFC 2828 It enhances the security of the data processing systems and the information transfers of an organization; Players intended to counter security attacks; Conclusions make use of one or more security mechanisms to provide the service 9 10 Service - 2 Services (X.800 and RFC 2828) replicate functions normally associated with physical documents ITU-T Recommendation X.800 ( Architecture for OSI) eg. have signatures, dates; need protection from disclosure, tampering, or destruction; be notarized or witnessed; be recorded or licensed; defines a systematic way of defining and providing security requirements a useful abstract overview of security concepts X.800 defines Service as: a service provided by a protocol layer of communicating open systems, which ensures adequate security of the systems or of data transfers 11 12

4 Services (X.800 and RFC 2828) IETF RFC 2828 (Internet Glossary) defines Service as: a processing or communication service provided by a system to give a specific kind of protection to system resources; Introduction services X.800 RFC 2828 Roadmap security services implement security policies, and are implemented by security mechanisms. Players Conclusions Services (X.800) 1. Authentication - the communicating entity is the one claimed Authentication - simple Hi, I am Jane 2. Access Control - prevention of the unauthorized use of a resource 3. Data Confidentiality protection of data from unauthorized disclosure Prove it 4. Data Integrity - assurance that data received is as sent by an authorized entity 5. Non-Repudiation - protection against denial by one of the parties in a communication 15 Mary 16

5 Authentication - mutual Hi Jane. Trust is speaking! PROOF Hi, I am Jane. Is Trust there? Hi, I am Jane Prove it Authentication - mutual Mary Trust Company Jane 17 authorization Did she authorize you? Give me Alice scar Integrity Data has not been changed, destroyed, or lost in an unauthorized or accidental manner Maintaining demonstrable data integrity is one of the cardinal aims of data security Mary 19 20

6 Privacy, secrecy 'Privacy' and 'secrecy' are easily confused. Secrecy is something you might seek. Privacy is something you should have. You might, for example, wish to keep some communications secret. You should have the right to expect that the communications remain private. However, neither is easily attainable in the modern world. Strong encryption can render data communications secret and private - but only depending on where you live in the world. Non repudiation Attribute of communications that seeks to prevent future false denial of involvement by either party. with proof of originin provides the recipient of data with evidence that proves the origin of the data. with proof of receipt provides the originator of data with evidence that proves the data was received as addressed. Non-repudiation is consequently an essential element of trust in e- business Non repudiation Problems: The signature is a forgery; The signature is not a forgery, but was obtained via: Unconscionable conduct by a party to a transaction; Fraud instigated by a third party; Undue influence exerted by a third party. When did you sign it? Where did you sign it? parameters RFC 2828 Access control Audit Data origin authentication Peer entity authentication Availability Data confidentiality Data integrity i System integrity Non-repudiation 23 24

7 Roadmap Services (RFC 2828) Introduction Access control service services X.800 RFC 2828 protection of system resources against unauthorized access Audit service Players Conclusions records information needed to establish accountability for system events and for the actions of system entities that cause them Services (RFC 2828) Services (RFC 2828) Authentication service: (i) data origin authentication service: a security service that verifies an identity claimed by or for an entity in a network, there are two general forms of authentication service: verifies the identity of an entity that is claimed to be the original source of received data provided to any entity that receives or holds the data i) data origin authentication service, ii) peer entity authentication service 27 28

8 Services (RFC 2828) (ii) peer entity authentication service: verifies an identity claimed by or for a system entity in an association. used to confirm the identity of one entity to another, thus protecting against a masquerade by the first entity. this service requires an association to exist between the two entities Services (RFC 2828) availability service protects a system to ensure its availability denial-of-service attacks data confidentiality service information is not made available or disclosed to unauthorized individuals, entities, or processes (i.e., to any unauthorized system entity) protects data against unauthorized disclosure Services (RFC 2828) data integrity service: data has not been changed, destroyed, or lost in an unauthorized or accidental manner. deals with constancy of and confidence in data values, not with the information n that t the values represent. protects against unauthorized changes to data, (intentional or not), by ensuring that changes to data are detectable. Services (RFC 2828) can only detect a change and report it to an appropriate system entity; changes cannot be prevented unless the system is perfect (error-free) and no malicious user has access however, a system that t offers data integrity it service might also attempt t to correct and recover from changes although data integrity service is defined separately from data origin authentication service and peer entity authentication service, it is closely related to them 31 32

9 Services (RFC 2828) system integrity service: Services (RFC 2828) non-repudiation service: the system integrity is the quality that a system has when it can perform its intended function protects system resources in a verifiable manner against unauthorized or accidental change, loss, or destruction a security service that provide protection against false denial of involvement in a communication; does not prevent ent an entity ty from repudiation; it provides evidence that can be stored and later presented to a third party Services (RFC 2828) there are two basic kinds of non-repudiation service: 1. non-repudiation with proof of origin" - this service can be viewed as a stronger version of an data origin authentication service, in that it proves authenticity to a third party 2. non-repudiation with proof of receipt" - protects the originator i against an attempt by the recipient i to falsely l deny receiving the data Mechanisms (X.800) specific security mechanisms (can be included in appropriate communication layer): encipherment digital signatures access controls data integrity authentication exchange traffic padding routing control notarization (third-party authentication) 35 36

10 Mechanisms (X.800) pervasive security mechanisms (general): Relationship Between Services and Mechanisms trusted functionality security labels l event detection security audit trails security recovery Introduction Roadmap The enemy services X.800 RFC 2828 Players Conclusions 39

11 Imagine.. Where is the enemy? Outside the boundary Defend it! Firewall Inside Protect the LAN/Intranet Among the partners Protect the Extranet (VPN) Everywhere Protect the applications From Effects internal system (33%) Denial of service (40%) remote dial-up (12%) Internet (74%) Computer Institue/FBI 2002 report Virus (85%) Non authorized access (40%) Secrecy steeling (20%) Fraudes (12%) Sabotages (8%) Unauthorized network use (78%) 43 44

12 89% is protected by firewall 2002 CSI/FBI Computer Crime & Survey 60% uses IDS (Intrusion Detection System) 40% of intrusions comes from outside! Attackers Script download malicious software (from hacker web sites) Hackers game to prove to their peers that they can compromise a specific system Insiders access data that they have no rights to access Organizational level attackers use the full resources of the organization to attack 90% is protected by antivirus software 85% affected by viruses, worm, trojan, etc, Roadmap System insecurity Introduction services X.800 RFC 2828 Players Attack technology is developing in a open source environment and is evolving rapidly Thousands - perhaps millions - of system with weak security are connected to the Internet Conclusions 47 48

13 System insecurity System insecurity The explosion in use of the Internet is straining our poor technical talent. The average level of system administrators has decreased dramatically in the last 5 years Increasingly complex sw is being written by programmers who have no training in writing secure code Attacks and attack tools transcend geography and national boundaries The difficulty of criminal investigation of cybercrime coupled with the complexity of international law means that prosecution of computer crime is unlikely Problems Networks have been created with a different purpose. No encryption Problems Networks uncertain boundaries (wlan, tunneling, mobility, UMTS,..) User authentication: weak! Pw No mutual authentication ti ti LAN: broadcast MAN: Shared networks. Third part equipments Software bugs. Viruses More bandwidth, more services (UMTS!!) Increasing complexity Internet Operating systems Windows 3.1 ~ 3 milions code Windows 95 ~ 15 milions Windows 2000 ~ 60 milions 51 52

14 References The protection of resources (including data and programs) from accidental or malicious modification, destruction, or disclosure W. Stallings, "Cryptography and Network : Principles and Practice" 3th Edition, Prentice Hall C. Kaufman, R. Perlman, M. Speciner, "Network : Private Communication in a Public World" 2nd Edition, Prentice Hall 53 54