Sir Syed University of Engineering & Technology, Karachi

Cryptography and
Network Security
CS-321

Batch - 2018 Department of Computer Science

 Chapter 0 – CIS

Short discussion on

Course Information Sheet

2
 Marks Distribution
 Assignments
 Quizes
 Mid Term
 Final Exam

3
Achievement

4
 Cryptography and
Network Security
Overview & Chapter 1

Lecture slides by Lawrie Brown

Editied by: Razia Nisar

 Roadmap
 Cryptographic algorithms
 symmetric ciphers
 asymmetric encryption
 hash functions
 Mutual Trust
 Network Security
 Computer Security

6
 Standards Organizations
 National Institute of Standards & Technology
(NIST)
 Internet Society (ISOC)
 International Telecommunication Union
Telecommunication Standardization Sector
(ITU-T)
 International Organization for Standardization
(ISO)
 RSA Labs (de facto)
7
 Background
 Information Security requirements have changed in
recent times (due to attacks on sensitive info.)

 Traditionally provided by physical and administrative

mechanisms

 Computer use requires automated tools to protect

files and other stored information

 Use of networks and communications links requires

measures to protect data during transmission
8
 Definitions
 Computer Security - generic name for the
collection of tools designed to protect data and
to thwart hackers

 Network Security - measures to protect data

during their transmission

 Internet Security - measures to protect data

during their transmission over a collection of
interconnected networks
9
 Computer Security
 Can be elaborated as:
 The protection afforded to an automated
information system in order to attain the
applicable objectives of preserving the
integrity, availability and confidentiality of
information system resources (includes
hardware, software, firmware,
information/data, and telecommunications)
10
Key Security Concepts

11
 Levels of Impact
 can define 3 levels of impact from a
security breach
 Low
 Moderate
 High

12
 Low Impact
 The loss could be expected to have a limited adverse effect on
organizational operations, organizational assets, or individuals.
 A limited adverse effect means that, for example, the loss of
confidentiality, integrity, or availability might
 (i) cause a degradation in mission capability to an extent

and duration that the organization is able to perform its

primary functions, but the effectiveness of the functions is
noticeably reduced;
 (ii) result in minor damage to organizational assets;

 (iii) result in minor financial loss; or

 (iv) result in minor harm to individuals.

13
 Moderate Impact
 The loss could be expected to have a serious adverse effect on
organizational operations, organizational assets, or individuals.
 A serious adverse effect means that, for example, the loss
might
 (i) cause a significant degradation in mission capability to an

extent and duration that the organization is able to perform

its primary functions, but the effectiveness of the functions is
significantly reduced;
 (ii) result in significant damage to organizational assets;

 (iii) result in significant financial loss; or

 (iv) result in significant harm to individuals that does not

involve loss of life or serious, life-threatening injuries.

14
 High Impact
 The loss could be expected to have a severe or catastrophic
adverse effect on organizational operations, organizational
assets, or individuals.
 A severe or catastrophic adverse effect means that, for
example, the loss might
 (i) cause a severe degradation in or loss of mission

capability to an extent and duration that the organization is

not able to perform one or more of its primary functions;
 (ii) result in major damage to organizational assets;

 (iii) result in major financial loss; or

 (iv) result in severe or catastrophic harm to individuals

involving loss of life or serious life threatening injuries.

15
 Examples of Security
Requirements
 confidentiality – student grades
 integrity – patient information
 availability – authentication service
 authenticity – admission ticket
 non-repudiation – stock sell order

16
 Confidentiality
 Confidentiality - Student grade information is an asset whose
confidentiality is considered to be highly important by students.
Grade information should only be available to students, their
parents, and employees that require the information to do their
job. Student enrollment information may have a moderate
confidentiality rating. This information is seen by more people
on a daily basis, is less likely to be targeted than grade
information, and results in less damage if disclosed. Directory
information, such as lists of students or faculty or departmental
lists, may be assigned a low confidentiality rating or indeed no
rating. This information is typically freely available to the public
and published on a school's Web site.

17
 Integrity
 Consider a hospital patient's allergy information stored in
a database. The doctor should be able to trust that the
information is correct and current. Now suppose that an
employee (e.g., a nurse) who is authorized to view and
update this information deliberately falsifies the data to
cause harm to the hospital. The database needs to be
restored to a trusted basis quickly, and it should be
possible to trace the error back to the person responsible.
Patient allergy information is an example of an asset with
a high requirement for integrity. Inaccurate information
could result in serious harm or death to a patient and
expose the hospital to massive liability.
18
 Availability
 The more critical a component or service, the
higher is the level of availability required. Consider
a system that provides authentication services for
critical systems, applications, and devices. An
interruption of service results in the inability for
customers to access computing resources and
staff to access the resources they need to perform
critical tasks. The loss of the service translates into
a large financial loss in lost employee productivity
and potential customer loss.
19
Computer Security Challenges
1. not simple – easy to get it wrong
2. must consider potential attacks
3. procedures used counter-intuitive
4. involve algorithms and secret info
5. must decide where to deploy mechanisms
6. battle of wits between attacker / admin
7. not perceived on benefit until fails
8. requires regular monitoring a process, not an
event
9. too often an after-thought
10. regarded as impediment to using system 20

“Unusable security is not secure”

 OSI Security Architecture
 ITU-T X.800 “Security Architecture for OSI”

 Defines a systematic way of defining and

providing security requirements

 For us it provides a useful, if abstract,

overview of concepts we will study

21
 Aspects of Security
 consider 3 aspects of information security:
 security attack
 security mechanism (control)
 security service
 note terms
 threat – a potential for violation of security
 vulnerability – a way by which loss can happen
 attack – an assault on system security, a
deliberate attempt to evade security services

22
 Attacks, Services and
Mechanisms
 Security Attack: Any action that compromises
the security of information.

 Security Mechanism: A mechanism that is

designed to detect, prevent, or recover from a
security attack.

 Security Service: A service that enhances the

security of data processing systems and
information transfers. A security service makes
use of one or more security mechanisms. 23
 Security Attacks

Learning Assignment: In the notes (below)

24
 Security Attacks
 Passive attacks: are in the nature of
eavesdropping on, or monitoring of,
transmissions
 Goal of the opponent is to obtain
information that is being transmitted

 Active attacks: involve some modification

of the data stream or the creation of a
false stream 25
Passive Attack - Interception

•This is an attack on confidentiality 26

Passive Attack: Traffic Analysis

Observe traffic pattern

27
Active Attack: Interruption

Block delivery of message

•This is an attack on availability 28

Active Attack: Fabrication

Fabricate message

•This is an attack on authenticity 29

Active Attack: Replay

30
Active Attack: Modification

Modify message

This is an attack on integrity 31

 Handling Attacks
 Passive attacks – focus on Prevention
• Easy to stop
• Hard to detect
 Active attacks – focus on Detection and
Recovery
• Hard to stop
• Easy to detect

32
 Week-1

Session-2

33
 How to do an Attack
 The following describes some of the ways
through which any information systems
can be attacked.

a. Social Engineering
b. Viruses / Trojan Horses / Worms
c. Denial of Service (DoS)
d. IP Spoofing
e. Replay Attack

34
 Social Engineering
 Social engineering is a technique used by attackers
to gain system access or information by exploiting
the basic human instinct to be helpful.

 Social engineering exploit are successful because

the targeted enterprise lacks an awareness
program to educate employees of their security-
related duties and responsibilities.

 A simple phone call by an intruder to a target

posing as a network support guy and asking her
username and password to rectify a non existing
problem.
 Viruses / Trojan Horses / Worms
 Virus is malicious code that can plant itself into
operating systems and programs and modify them.

 Trojan-horse is a virus that is hidden inside a

legitimate software. Once the software is installed
or downloaded, the malicious code does its thing.

 Worm is industry nomenclature for a self-contained

program that will replicate itself across a network,
infecting each server and workstation it can
access.
 Denial of Service (DoS)
 An attack that targets resources within the network
with the intention of reserving resource and
keeping legitimate users from gaining access.

 During a SYN attack, an enemy workstation will

generate a flood of session requests using bogus
IP addresses.

 The target server begins reserving resources for

each request while waiting for the completion of
the TCP/IP handshake process.

 The expected reply from the enemy workstation

never comes but the reserved resources results in
the denial of service for the legitimate user.
 IP Spoofing
 IP spoofing is accomplished when an outside
hacker uses a discovered IP address to gain
access of a trusted environment from outside the
network.

 A hacker can obtain a valid IP address in a variety

of ways such as social engineering.
 Replay Attack
 A replay attack occurs when a hacker intercepts a
communication between two parties and replays
the message.

 For instance, a hacker might intercept a credit card

transaction between a consumer and a Web site.
The hacker then replays the transaction multiple
times resulting in multiple debits to the consumers
credit account.
 Security Service
 enhance security of data processing systems
and information transfers of an organization
 intended to counter security attacks
 using one or more security mechanisms
 often replicates functions normally associated
with physical documents
• which, for example, have signatures, dates; need
protection from disclosure, tampering, or
destruction; be notarized or witnessed; be
recorded or licensed
40
 Security Services
 Confidentiality (privacy)
 Authentication (who created or sent the data)
 Integrity (has not been altered)
 Non-repudiation (the order is final)
 Access control (prevent misuse of resources)
 Availability (permanence, non-erasure)
 Denial of Service Attacks
 Virus that deletes files
41 41
 Security Services
 X.800:
“a service provided by a protocol layer of
communicating open systems, which ensures
adequate security of the systems or of data
transfers”

 RFC 2828:
“a processing or communication service
provided by a system to give a specific kind of
protection to system resources”
42
 Security Services (X.800)
 Authentication - assurance that communicating
entity is the one claimed
 have both peer-entity & data origin authentication
 Access Control - prevention of the unauthorized
use of a resource
 Data Confidentiality –protection of data from
unauthorized disclosure
 Data Integrity - assurance that data received is
as sent by an authorized entity
 Non-Repudiation - protection against denial by
one of the parties in a communication
 Availability – resource accessible/usable 43
 Security Mechanism
 a.k.a. control
 feature designed to detect, prevent, or
recover from a security attack
 no single mechanism that will support all
services required
 however one particular element underlies
many of the security mechanisms in use:
 cryptographic techniques
 hence our focus on this topic
44
Security Mechanisms (X.800)
 specific security mechanisms: (May be
incorporated into the appropriate protocol layer in order
to provide some of the OSI security services)
 encipherment, digital signatures, access controls,

data integrity, authentication exchange, traffic

padding, routing control, notarization
 pervasive security mechanisms:
(Mechanisms that are not specific to any particular OSI
security service or protocol layer)
 trusted functionality, security labels, event detection,

security audit trails, security recovery

45
 Specific security mechanisms
Encipherment
 The use of mathematical algorithms to transform data into
a form that is not readily intelligible. The transformation
and subsequent recovery of the data depend on an
algorithm and zero or more encryption keys.
Digital Signature
 Data appended to, or a cryptographic transformation of, a
data unit that allows a recipient of the data unit to prove
the source and integrity of the data unit and protect
against forgery (e.g., by the recipient).
Access Control
 A variety of mechanisms that enforce access rights to
resources.
Data Integrity
 A variety of mechanisms used to assure the integrity of a
data unit or stream of data units. 46
 Cont….
Authentication Exchange
 A mechanism intended to ensure the identity of an entity
by means of information exchange.
Traffic Padding
 The insertion of bits into gaps in a data stream to
frustrate traffic analysis attempts.
Routing Control
 Enables selection of particular physically secure routes
for certain data and allows routing changes, especially
when a breach of security is suspected.
Notarization
 The use of a trusted third party to assure certain
properties of a data exchange. 47
Pervasive security mechanisms:
Trusted Functionality
 That which is perceived to be correct with respect to some
criteria (e.g., as established by a security policy).
Security Label
 The marking bound to a resource (which may be a data unit)
that names or designates the security attributes of that
resource.
Event Detection
 Detection of security-relevant events.
Security Audit Trail
 Data collected and potentially used to facilitate a security audit,
which is an independent review and examination of system
records and activities.
Security Recovery
 Deals with requests from mechanisms, such as event handling
and management functions, and takes recovery actions.
48
Model for Network Security

49
 Model for Network Security
 using this model requires us to:
1. design a suitable algorithm for the security
transformation
2. generate the secret information (keys) used
by the algorithm
3. develop methods to distribute and share the
secret information
4. specify a protocol enabling the principals to
use the transformation and secret
information for a security service
50
Model for Network Access
Security

51
 Model for Network Access
Security
 using this model requires us to:
1. select appropriate gatekeeper functions to
identify users
2. implement security controls to ensure only
authorised users access designated
information or resources
 note that model does not include:
1. monitoring of system for successful
penetration
2. monitoring of authorized users for misuse
3. audit logging for forensic uses, etc. 52
 Summary
 topic roadmap & standards organizations
 security concepts:
 confidentiality, integrity, availability
 X.800 security architecture
 security attacks, services, mechanisms
 models for network (access) security

53