IT Security Threats Lecture 7: IT Security PAD 6710 Security Threats External- Intrusion Threats Network- Technological Threats Internal- Organizational Threats Intrusion threats Hacking: Unauthorized access and use of sensitive information Compromising National security data Compromising Personnel data, e.g SSN, Credit cards Compromising Personal data Cyber crimes ID thefts: on the rise Carding Forums: Criminal websites dedicated to the sale of stolen personal and financial information 1
IT Security Threats Network threats System vulnerabilities/ compromises Malicious software Viruses: Programs that attach to files, enabling them to spread from one computer to another; can damage hardware, software or files. Worms: Self-propagating viruses Spyware: Programs that are installed without user s knowledge, and can potentially monitor activities or steal sensitive information Phishing: Legitimate looking emails that tricks user into providing sensitive information Pharming: Redirecting to a bogus website Wireless insecurities Wireless is more prone to security threats than wired connections Open wireless communities (e.g. Wi-FI hotspots in public places that do not require a password) are particularly vulnerable IT Security Threats Internal organizational threats Employee security who is to guard the guard? Lax management governments are extensive data repositories; lax management could compromise the data Problems of security threats Corruption of Information Disclosure of Information to unauthorized parties Theft of Service Denial-of-service to legitimate users 2
Need for IT security Processes of Network Attacks Authentication Provides the assurance that the person affixing a signature to an electronic document is who he or she claims to be Confidentiality Access to the content of the document is limited to authorized persons Integrity Assurance that the message is whole, complete, and not changed in transmission Nonrepudiation Neither party to a transaction can later claim that the transaction did not take place, or that the signature is not valid 3
Containing Security Threats Legislation and Executive Branch Actions Covers legal action against security threats Computer Security Act (1987) security guidelines and standards for government computers Government Information Security Reform Act (GISRA 2000) complemented CSA Homeland Security Act (HSA 2002): CIO authority for overseeing coordination and consolidation of data Fair and Accurate Credit Transactions Act (FACTA 2003) Controlling the Assault of Non-Solicited Pornography and Marketing Act (CAN-SPAM Act of 2003) Containing Security Threats SECURITY AUDIT AND VULNERABILITY ASSESSMENT Update software Install the latest software patches Install antivirus software with frequent updates Attack halting Stops the attack, whether it is a program or a hacker Attack blocking Closes the loop-hole through which the attacker gained access Attack alerting Either pop-up to an online admin, or email or SMS to a remote admin Information collecting On what is done by the attack to the network, and from where the attack came - helps gather forensic evidence should a prosecution become necessary or possible Full reporting Learn from mistakes; prevent future problems 4
Containing Security Threats Intrusion Detection Systems Firewalls Access limitations CAPTCHAs (Completely Automated Turing Test To Tell Computers and Humans Apart) Multi level access control Discretionary access control (DAC) Mandatory access control (MAC) Role based access control Task based access control Containing Security Threats Fail-safe features Encryption of data to authenticate identity of individuals attempting to access the governmental computer systems Federal ID Cards for federal employees and contractors (Smartcards) Virtual Private Network (VPN) tunneling through secure channels 5
Containing security threats Containing Security Threats Public Key Infrastructure (PKI) PKI is based upon Public Key Cryptography (PKC), an internationally accepted method for securing electronic communications PKC involves a pair of mathematically related keys (large prime numbers of 1024 characters in length) Public key: Distributed freely to anyone whom the public key owner wishes to communicate securely Private Key: Known only by the signer; used to sign a message that only the public key can verify PKI Process User gets certificate of authority Certificate creates a public key for the user Certificate also issues matching private key User can employ the private key to send messages Another user can decrypt messages by using the public key PENETRATION TESTS Agency-Level Security Policies Security governance and reporting Physical Security Systems Security Checks and Clearances Biometrics Configuration Management Secure System Design Red Teams teams of experts Honey Pots proactive security strategies 6