Introduction to Cyber Security

January 15, 2016

Lecture #1

Dr. Bhavani Thuraisingham

01/18/25 04:49

13-2

Outline
0 Cyber Security Modules
0 Risk and Governance
0 Security Architectures
0 Access Control
0 Cryptography
0 Network Security
0 Digital Forensics
0 Data Management Security
01/18/25 04:49

13-3

C. I.A.
0 Confidentiality: Preventing from unauthorized disclosure
0 Integrity: Preventing from unauthorized modification
0 Availability: Preventing denial of service
01/18/25 04:49

13-4

Ten Major Modules of Cyber Security

0 Information Security and Risk Management
0 Access Control
0 Security Architecture and Design
0 Cryptography
0 Network Security
0 Applications Security (aka Data and Applications Security)
0 Legal Regulations, Compliance and Investigations (aka Digital
Forensics)
0 Physical and Environmental Security
0 Business Continuity Planning
0 Operations Security
01/18/25 04:49

13-5

Information Security and Risk Management

0 Security Management
0 Security Administration
0 Organizational Security Model
0 Information Risk Management
0 Risk Analysis
0 Policies, Standards, Guidelines, Procedures
0 Information Classification
0 Layers of Responsibility
0 Security Awareness Training
01/18/25 04:49

13-6

Access Control
0 Security Principles
0 Identification, Authentication, Authorization, Accountability
0 Access Control Models
0 Access Control techniques
0 Access Control Administration
0 Access Control Methods
0 Access Control Types
0 Accountability
0 Access Control practices
0 Access Control Monitoring
0 Threats to Access Control
01/18/25 04:49

13-7

Security Architecture and Design

0 Computer Architecture
0 Systems Architecture
0 Security Models
0 Security Modes of Operation
0 Systems Evaluation Methods
0 Open vs. Closed Systems
0 Enterprise Architecture
0 Security Threats
01/18/25 04:49

13-8

Physical and Environmental Security

0 What is Physical Security
0 Planning Process
0 Protecting assets
0 Internal Support Systems
0 Perimeter Security
0 Other aspects
01/18/25 04:49

13-9

Telecommunications and Network Security

0 Open Systems Interconnection Reference Model
0 TCP/IP
0 Types of Transmission
0 LAN Networking
0 Routing Protocols
0 Networking Devices
0 Networking services and protocols
0 Intranets and Extranets
0 Metropolitan Area networks
0 Remote access
0 Wireless technologies
0 Rootkits
01/18/25 04:49

13-10

Cryptography
0 History, Definitions and Concepts
0 Types of Ciphers
0 Methods of Encryption
0 Type of Asymmetric Systems
0 Message Integrity
0 PKI
0 Key Management
0 Link / End-to-end Encryption
0 Email standards
0 Internet security
0 Attacks
01/18/25 04:49

13-11

Legal Regulation and Compliance Investigation

0 Cyber law and Cyber crime
0 Intellectual property law
0 Privacy
0 Liability and Ramifications
0 Digital Forensics and Investigations
0 Ethics
01/18/25 04:49

13-12

Applications Security
0 Database Security
0 Software and applications security issues
0 Secure systems development
0 Application development and security
0 Object-oriented systems and security
0 Distributed computing and security
0 Expert systems and security
0 Web security
0 Mobile code
0 Patch management
01/18/25 04:49

13-13

Business Continuity
0 Data Storage and Recovery
0 Storage Area Networks
0 Business Continuity Planning
0 Disaster Planning
01/18/25 04:49

13-14

Operations Security
0 Role of the Operations Department
0 Administrative Management
0 Assurance Levels
0 Configuration management
0 Media Controls
0 Data Leakage
0 Network and Resource Availability
0 Mainframes
0 Email Security
0 Vulnerability testing
01/18/25 04:49

13-15

Information Governance and Risk Management

0 Security Management, Administration and Governance
0 Policies, Standards, Guidelines, Procedures
0 Information Classification
0 Roles and Responsibilities
0 Risk Management and Analysis
0 Best Practices
01/18/25 04:49

13-16

Security Management, Administration and

Governance
0 Information security (ISec) describes activities that relate to the
protection of information and information infrastructure assets
against the risks of loss, misuse, disclosure or damage. Information
security management (ISM) describes controls that an organization
needs to implement to ensure that it is sensibly managing these
risks.
0 The risks to these assets can be calculated by analysis of the
following issues:
0 Threats to your assets. These are unwanted events that could cause
the deliberate or accidental loss, damage or misuse of the assets
0 Vulnerabilities. How susceptible your assets are to attack
0 Impact. The magnitude of the potential loss or the seriousness of the
event.
01/18/25 04:49

13-17

Security Management, Administration and

Governance
0 Standards that are available to assist organizations implement the
appropriate programs and controls to mitigate these risks are for
example BS7799/ISO 17799, Information Technology Infrastructure
Library and COBIT.
0 Information Security Governance, Information Security Governance
or ISG, is a subset discipline of Corporate Governance focused on
information Security systems and their performance and risk
management.
0 Establish and maintain a framework to provide assurance that
information security strategies are aligned with business objectives
and consistent with applicable laws and regulations
01/18/25 04:49

13-18

Security Management, Administration and

Governance
0 Develop the information security strategy in support of business
strategy and direction.
0 Obtain senior management commitment and support
0 Ensure that definitions of roles and responsibilities throughout the
enterprise include information security governance activities.
0 Establish reporting and communication channels that support
information security governance activities.
0 Identify current and potential legal and regulatory issues affecting
information security and assess their impact on the enterprise.
0 Establish and maintain information security policies that support
business goals and objectives.
0 Ensure the development of procedures and guidelines that support
information security policies.
0 Develop business case for information security program
investments.
01/18/25 04:49

13-19

Policies, Standards, Guidelines and Procedures

0 Policies are the top tier of formalized security documents. These
high-level documents offer a general statement about the
organization’s assets and what level of protection they should have.
0 Well-written policies should spell out who’s responsible for security,
what needs to be protected, and what is an acceptable level of risk..
0 Standards are much more specific than policies. Standards are
tactical documents because they lay out specific steps or processes
required to meet a certain requirement. As an example, a standard
might set a mandatory requirement that all email communication be
encrypted. So although it does specify a certain standard, it doesn’t
spell out how it is to be done. That is left for the procedure.
01/18/25 04:49

13-20

Policies, Standards, Guidelines and Procedures

0 A baseline is a minimum level of security that a system, network, or
device must adhere to. Baselines are usually mapped to industry
standards. As an example, an organization might specify that all
computer systems comply with a minimum Trusted Computer
System Evaluation Criteria (TCSEC) C2 standard.
0 A guideline points to a statement in a policy or procedure by which
to determine a course of action. It’s a recommendation or
suggestion of how things should be done. It is meant to be flexible
so it can be customized for individual situations.
0 A procedure is the most specific of security documents. A procedure
is a detailed, in-depth, step-by-step document that details exactly
what is to be done.
0 A security model is a scheme for specifying and enforcing security
policies. Examples include: Bell and LaPadula, Biba, Access control
lists
01/18/25 04:49

13-21

Information Classification
0 It is essential to classify information according to its actual value
and level of sensitivity in order to deploy the appropriate level of
security.
0 A system of classification should ideally be:
- simple to understand and to administer
- effective in order to determine the level of protection the
information is given.
- applied uniformly throughout the whole organization (note:
when in any doubt, the higher, more secure classification
should be employed).
01/18/25 04:49

13-22

Information Classification
0 With the exception of information that is already in the public
domain, information should not be divulged to anyone who is not
authorized to access it or is not specifically authorized by the
information owner.
0 Violations of the Information Classification Policy should result in
disciplinary proceedings against the individual.
0 Number of information classification levels in an organization
should be a manageable number as having too many makes
maintenance and compliance difficult.
01/18/25 04:49

13-23

Information Classification
0 Top Secret: Highly sensitive internal documents and data. For
example, impending mergers or acquisitions, investment strategies,
plans or designs that could seriously damage the organization if lost
or made public. Information classified as Top Secret has very
restricted distribution indeed, and must be protected at all times.
Security at this level is the highest possible.
0 Highly Confidential: Information which is considered critical to the
organization’s ongoing operations and could seriously impede or
disrupt them if made shared internally or made public. Such
information includes accounting information, business plans,
sensitive information of customers of banks (etc), patients' medical
records, and similar highly sensitive data. Such information should
not be copied or removed from the organization’s operational
control without specific authority. Security should be very high.
01/18/25 04:49

13-24

Information Classification
0 Proprietary: Procedures, project plans, operational work routines,
designs and specifications that define the way in which the
organization operates. Such information is usually for proprietary
use by authorized personnel only. Security at this level is high.
0 Internal Use Only: Information not approved for general circulation
outside the organization, where its disclosure would inconvenience
the organization or management, but is unlikely to result in financial
loss or serious damage to credibility/reputation. Examples include:
internal memos, internal project reports, minutes of meetings.
Security at this level is controlled but normal.
0 Public Documents: Information in the public domain: press
statements, annual reports, etc. which have been approved for
public use or distribution. Security at this level is minimal.
01/18/25 04:49

13-25

Roles and Responsibilities

0 Internal Roles
- Executive Management; Information System Security
Professionals; Owners: Data and System Owners; Custodians
- Operational Staff; Users; Legal, Compliance and Privacy
Officers; Internal Auditors; Physical Security Officers
0 External Roles
- Vendors and Supplies; Contractors; Temporary Employees;
Customers; Business Partners; Outsourced Relationships;
Outsourced Security
0 Human Resources
- Employee development and management; Hiring and
termination; Signed employee agreements; Education
01/18/25 04:49

13-26

Risk Management and Analysis

0 Risk is the likelihood that something bad will happen that causes
harm to an informational asset (or the loss of the asset). A
vulnerability is a weakness that could be used to endanger or cause
harm to an informational asset. A threat is anything (man made or
act of nature) that has the potential to cause harm.
0 The likelihood that a threat will use a vulnerability to cause harm
creates a risk. When a threat does use a vulnerability to inflict harm,
it has an impact. In the context of information security, the impact is
a loss of availability, integrity, and confidentiality, and possibly other
losses (lost income, loss of life, loss of real property). It should be
pointed out that it is not possible to identify all risks, nor is it
possible to eliminate all risk. The remaining risk is called residual
risk.
01/18/25 04:49

13-27

Risk Managementg and Analysis

0 A risk assessment is carried out by a team of people who have
knowledge of specific areas of the business. Membership of the
team may vary over time as different parts of the business are
assessed.
0 The assessment may use a subjective qualitative analysis based on
informed opinion (scenarios), or where reliable dollar figures and
historical information is available, the analysis may use quantitative
analysis
0 For any given risk, Executive Management can choose to accept the
risk based upon the relative low value of the asset, the relative low
frequency of occurrence, and the relative low impact on the
business. Or, leadership may choose to mitigate the risk by
selecting and implementing appropriate control measures to reduce
the risk. In some cases, the risk can be transferred to another
business by buying insurance or out-sourcing to another business.
01/18/25 04:49

13-28

Risk Management and Analysis

0 Identification of assets and estimating their value. Include: people,
buildings, hardware, software, data supplies.
0 Conduct a threat assessment. Include: Acts of nature, accidents,
malicious acts originating from inside or outside the organization.
0 Conduct a vulnerability assessment, and for each vulnerability,
calculate the probability that it will be exploited. Evaluate policies,
procedures, standards, training, physical security, - - -
0 Calculate the impact that each threat would have on each asset. Use
qualitative analysis or quantitative analysis.
0 Identify, select and implement appropriate controls. Provide a
proportional response. Consider productivity, cost effectiveness,
and value of the asset.
0 Evaluate the effectiveness of the control measures. Ensure the
controls provide the required cost effective protection without
discernible loss of productivity.
01/18/25 04:49

13-29

Risk Management and Analysis

0 Step 1: Estimate Potential Loss
- SLE = AV ($) x EF (%)
- SLE: Single Loss Expectancy, AV: Asset Value. EF: Exposure
Factor (percentage of asset value)
0 Step 2: Conduct Threat Likelihood Analysis
- ARO Annual Rate of Occurrence
- Number of times per year that an incident is likely to occur
0 Step 3: Calculate ALE
- ALE: Annual Loss Expectancy
- ALE = SLE x ARO
01/18/25 04:49

13-30

Security Best Practices

0 Job Rotation
0 Separation of Duty
0 Security Awareness training
0 Ethics Education
01/18/25 04:49

13-31

Security Architecture and Design

0 Computer Architecture
0 Operating System
0 System Architecture
0 Security Architecture
0 Security Models
0 Security Models of Operation
0 System Evaluation Methods
0 Open Vs Closed Systems
0 Some security threats
01/18/25 04:49

13-32

Computer Architecture Components

0 Central Processing Unit (CPU)
0 Registers
0 Memory Units
0 Input/output Processors
0 Single Processor
0 Multi-Processor
0 Multi-Core Architecture
0 Grids and Clouds
01/18/25 04:49

13-33

Operating Systems
0 Memory Management
0 Process management
0 File Management
0 Capability Domains
0 Virtual Machines
01/18/25 04:49

13-34

System Architecture
0 The software components that make up the system
0 Middleware
0 Database management
0 Networks
0 Applications
01/18/25 04:49

13-35

Security Architecture
0 Security critical components of the system
0 Trusted Computing Base
0 Reference Monitor and Security Kernel
0 Security Perimeter
0 Security Policy
0 Least Privilege
01/18/25 04:49

13-36

Trusted Computing Base

0 The trusted computing base (TCB) of a computer system is the set of
all hardware, firmware, and/or software components that are critical
to its security, in the sense that bugs or vulnerabilities occurring
inside the TCB might jeopardize the security properties of the entire
system. By contrast, parts of a computer system outside the TCB
must not be able to misbehave in a way that would leak any more
privileges than are granted to them in accordance to the security
policy.
0 The careful design and implementation of a system's trusted
computing base is paramount to its overall security. Modern
operating systems strive to reduce the size of the TCB so that an
exhaustive examination of its code base (by means of manual or
computer-assisted software audit or program verification) becomes
feasible.
01/18/25 04:49

13-37

Reference Monitor and Security Kernel

0 In operating systems architecture, a reference monitor is a
tamperproof, always-invoked, and small-enough-to-be-fully-tested-
and-analyzed module that controls all software access to data
objects or devices (verifiable).
0 The reference monitor verifies that the request is allowed by the
access control policy.
0 For example, Windows 3.x and 9x operating systems were not built
with a reference monitor, whereas the Windows NT line, which also
includes Windows 2000 and Windows XP, was designed to contain a
reference monitor, although it is not clear that its properties
(tamperproof, etc.) have ever been independently verified, or what
level of computer security it was intended to provide.
01/18/25 04:49

13-38

Security Models
0 Bell and LaPadula (BLP) Confidentiality Model
0 Biba Integrity Model (opposite to BLP)
0 Clark Wilson Integrity Model
0 Other Models
- information Flow Model
- Non Interference Model
- Graham Denning Model
- Harrison-Ruzzo-Ullman Model
- Lattice Model
01/18/25 04:49

13-39

Bell and LaPadula

0 A system state is defined to be "secure" if the only permitted access modes
of subjects to objects are in accordance with a security policy. To determine
whether a specific access mode is allowed, the clearance of a subject is
compared to the classification of the object (more precisely, to the
combination of classification and set of compartments, making up the
security level) to determine if the subject is authorized for the specific access
mode. The clearance/classification scheme is expressed in terms of a lattice.
The model defines two mandatory access control (MAC) rules and one
discretionary access control (DAC) rule with three security properties:
0 The Simple Security Property - a subject at a given security level may not
read an object at a higher security level (no read-up).
0 The *-property (read "star"-property) - a subject at a given security level must
not write to any object at a lower security level (no write-down). The *-
property is also known as the Confinement property.
0 The Discretionary Security Property - use of an access matrix to specify the
discretionary access control.
01/18/25 04:49

13-40

Biba
0 In general, preservation of data integrity has three goals:
- Prevent data modification by unauthorized parties
- Prevent unauthorized data modification by authorized parties
- Maintain internal and external consistency (i.e. data reflects the real
world)
0 Biba security model is directed toward data integrity (rather than
confidentiality) and is characterized by the phrase: "no read down, no write
up". This is in contrast to the Bell-LaPadula model which is characterized by
the phrase "no write down, no read up".
0 The Biba model defines a set of security rules similar to the Bell-LaPadula
model. These rules are the reverse of the Bell-LaPadula rules:
0 The Simple Integrity Axiom states that a subject at a given level of integrity
must not read an object at a lower integrity level (no read down).
0 The * (star) Integrity Axiom states that a subject at a given level of integrity
must not write to any object at a higher level of integrity (no write up).
01/18/25 04:49

13-41

Clark Wilson Model

0 The Clark-Wilson integrity model provides a foundation for
specifying and analyzing an integrity policy for a computing system.
0 The model is primarily concerned with formalizing the notion of
information integrity.
0 Information integrity is maintained by preventing corruption of data
items in a system due to either error or malicious intent.
0 An integrity policy describes how the data items in the system
should be kept valid from one state of the system to the next and
specifies the capabilities of various principals in the system.
0 The model defines enforcement rules and certification rules.
0 The model’s enforcement and certification rules define data items
and processes that provide the basis for an integrity policy. The core
of the model is based on the notion of a transaction.
01/18/25 04:49

13-42

Security Modes of Operation

0 Dedicated
0 Systems High
0 Compartmented
0 Multilevel
0 Trust and Assurance
01/18/25 04:49

13-43

Secure System Evaluation: TCSEC

0 Trusted Computer System Evaluation Criteria (TCSEC) is a United
States Government Department of Defense (DoD) standard that sets
basic requirements for assessing the effectiveness of computer
security controls built into a computer system. The TCSEC was used
to evaluate, classify and select computer systems being considered
for the processing, storage and retrieval of sensitive or classified
information.
0 The TCSEC, frequently referred to as the Orange Book, is the
centerpiece of the DoD Rainbow Series publications. Initially issued
in 1983 by the National Computer Security Center (NCSC), an arm of
the National Security Agency, and then updated in 1985,.
0 TCSEC was replaced by the Common Criteria international standard
originally published in 2005.
01/18/25 04:49

13-44

Secure System Evaluation: TCSEC

0 Policy: The security policy must be explicit, well-defined and
enforced by the computer system. There are two basic security
policies:
0 Mandatory Security Policy - Enforces access control rules based
directly on an individual's clearance, authorization for the
information and the confidentiality level of the information being
sought. Other indirect factors are physical and environmental. This
policy must also accurately reflect the laws, general policies and
other relevant guidance from which the rules are derived.
- Marking - Systems designed to enforce a mandatory security
policy must store and preserve the integrity of access control
labels and retain the labels if the object is exported.
0 Discretionary Security Policy - Enforces a consistent set of rules for
controlling and limiting access based on identified individuals who
have been determined to have a need-to-know for the information.
01/18/25 04:49

13-45

Secure System Evaluation: TCSEC

0 Accountability: Individual accountability regardless of policy must be
enforced. A secure means must exist to ensure the access of an authorized
and competent agent which can then evaluate the accountability information
within a reasonable amount of time and without undue difficulty. There are
three requirements under the accountability objective:
0 Identification - The process used to recognize an individual user.
0 Authentication - The verification of an individual user's authorization to
specific categories of information.
0 Auditing - Audit information must be selectively kept and protected so that
actions affecting security can be traced to the authenticated individual.
0 The TCSEC defines four divisions: D, C, B and A where division A has the
highest security. Each division represents a significant difference in the trust
an individual or organization can place on the evaluated system. Additionally
divisions C, B and A are broken into a series of hierarchical subdivisions
called classes: C1, C2, B1, B2, B3 and A1.
01/18/25 04:49

13-46

Secure System Evaluation: ITSEC

0 The Information Technology Security Evaluation Criteria
(ITSEC) is a structured set of criteria for evaluating computer
security within products and systems.
0 The ITSEC was first published in May 1990 in France,
Germany, the Netherlands, and the United Kingdom based on
existing work in their respective countries.
0 Following extensive international review, Version 1.2 was
subsequently published in June 1991 by the Commission of
the European Communities for operational use within
evaluation and certification schemes.
0 Levels E1 – E6
01/18/25 04:49

13-47

Secure System Evaluation: Common Criteria

0 The Common Criteria for Information Technology Security
Evaluation (abbreviated as Common Criteria or CC) is an
international standard (ISO/IEC 15408) for computer security
certification.
0 Common Criteria is a framework in which computer system users
can specify their security functional and assurance requirements,
vendors can then implement and/or make claims about the security
attributes of their products, and testing laboratories can evaluate the
products to determine if they actually meet the claims. In other
words, Common Criteria provides assurance that the process of
specification, implementation and evaluation of a computer security
product has been conducted in a rigorous and standard manner.
0 Levels: EAL 1 – EAL 7 (Evaluation Assurance Levels)
01/18/25 04:49

13-48

Certification and Accreditation

0 Certification and Accreditation (C&A) is a process for implementing
information security. It is a systematic procedure for evaluating,
describing, testing and authorizing systems prior to or after a
system is in operation.
0 Certification is a comprehensive assessment of the management,
operational, and technical security controls in an information
system, made in support of security accreditation, to determine the
extent to which the controls are implemented correctly, operating as
intended, and producing the desired outcome with respect to
meeting the security requirements for the system.
0 Accreditation is the official management decision given by a senior
agency official to authorize operation of an information system and
to explicitly accept the risk to agency operations (including mission,
functions, image, or reputation), agency assets, or individuals,
based on the implementation of an agreed-upon set of security
controls.
01/18/25 04:49

13-49

Access Control
0 Access Control Overview
0 Identification, Authentication, Authorization, Accountability
0 Single Sign-on and Kerberos
0 Access Control Models
0 Access Control Techniques and Technologies
0 Access Control Administration
0 Access Control Monitoring: Intrusion Detection
0 Threats to Access Control
01/18/25 04:49

13-50

Access Control Overview

0 Access control is a system which enables an authority to control
access to areas and resources in a given physical facility or
computer-based information system.
0 In computer security, access control includes authentication,
authorization and audit. It also includes measures such as physical
devices, including biometric scans and metal locks, hidden paths,
digital signatures, encryption, social barriers, and monitoring by
humans and automated systems.
0 In any access control model, the entities that can perform actions in
the system are called subjects, and the entities representing
resources to which access may need to be controlled are called
objects (see also Access Control Matrix). Subjects and objects
should both be considered as software entities and as human users
01/18/25 04:49

13-51

Access Control
0 Access control models used by current systems tend to fall into one
of two classes: those based on capabilities and those based on
access control lists (ACLs).
0 In a capability-based model, holding an unforgeable reference or
capability to an object provides access to the object
0 Access is conveyed to another party by transmitting such a
capability over a secure channel.
0 In an ACL-based model, a subject's access to an object depends on
whether its identity is on a list associated with the object
01/18/25 04:49

13-52

Identification, Authentication, Authorization

0 Access control systems provide the essential services of
identification and authentication (I&A), authorization, and
accountability where:
0 identification and authentication determine who can log on to a
system, and the association of users with the software subjects that
they are able to control as a result of logging in;
0 authorization determines what a subject can do;
0 accountability identifies what a subject (or all subjects associated
with a user) did.
01/18/25 04:49

13-53

Single Sign-On
0 Single sign-on (SSO) is a property of access control of multiple,
related, but independent software systems.
0 With this property a user logs in once and gains access to all
systems without being prompted to log in again at each of them.
0 Single sign-off is the reverse property whereby a single action of
signing out terminates access to multiple software systems.
0 As different applications and resources support different
authentication mechanisms, single sign-on has to internally
translate to and store different credentials compared to what is used
for initial authentication.
01/18/25 04:49

13-54

Single Sign-on Kerberos

0 Kerberos is a computer network authentication protocol, which
allows nodes communicating over a non-secure network to prove
their identity to one another in a secure manner.
0 It is also a suite of free software published by MIT that implements
this protocol. Its designers aimed primarily at a client–server model,
and it provides mutual authentication — both the user and the server
verify each other's identity. Kerberos protocol messages are
protected against eavesdropping and replay attacks.
0 Kerberos builds on symmetric key cryptography and requires a
trusted third party, and optionally may use public-key cryptography
by utilizing asymmetric key cryptography during certain phases of
authentication
01/18/25 04:49

13-55

Access Control Techniques

0 Role based access control
0 Constrained user interfaces
0 Access control Matrix
0 Content dependent access control
0 Attribute-based access control
01/18/25 04:49

13-56

Access Control
0 Access control techniques: Access control techniques are sometimes
categorized as either discretionary or non-discretionary. The three most
widely recognized models are Discretionary Access Control (DAC),
Mandatory Access Control (MAC), and Role Based Access Control (RBAC).
MAC and RBAC are both non-discretionary.
0 Attribute-based Access Control: In attribute-based access control, access is
granted not based on the rights of the subject associated with a user after
authentication, but based on attributes of the user.
0 The user has to prove so called claims about his attributes to the access
control engine. An attribute-based access control policy specifies which
claims need to satisfied in order to grant access to an object. For instance the
claim could be "older than 18" .
01/18/25 04:49

13-57

Access Control
0 Discretionary access control: (DAC) is an access policy determined
by the owner of an object. The owner decides who is allowed to
access the object and what privileges they have.
0 Two important concepts in DAC are
0 File and data ownership: Every object in the system has an owner. In
most DAC systems, each object's initial owner is the subject that
caused it to be created. The access policy for an object is
determined by its owner.
0 Access rights and permissions: These are the controls that an owner
can assign to other subjects for specific resources.
0 Access controls may be discretionary in ACL-based or capability-
based access control systems. (In capability-based systems, there is
usually no explicit concept of 'owner', but the creator of an object
has a similar degree of control over its access policy.)
01/18/25 04:49

13-58

Access Control
0 Mandatory access control: (MAC) is an access policy determined by the
system, not the owner. MAC is used in multilevel systems that process highly
sensitive data, such as classified government and military information. A
multilevel system is a single computer system that handles multiple
classification levels between subjects and objects.
0 Sensitivity labels: In a MAC-based system, all subjects and objects must have
labels assigned to them. A subject's sensitivity label specifies its level of
trust. An object's sensitivity label specifies the level of trust required for
access. In order to access a given object, the subject must have a sensitivity
level equal to or higher than the requested object.
0 Data import and export: Controlling the import of information from other
systems and export to other systems (including printers) is a critical function
of MAC-based systems, which must ensure that sensitivity labels are properly
maintained and implemented so that sensitive information is appropriately
protected at all times.
01/18/25 04:49

13-59

What is Biometrics?
0 Biometrics are automated methods of recognizing a person based
on a physiological or behavioral characteristic
0 Features measured: Face, Fingerprints, Hand geometry, handwriting,
Iris, Retinal, Vein and Voice
0 Identification and personal certification solutions for highly secure
applications
0 Numerous applications: medical, financial, child care, computer
access etc.
0 Biometrics replaces Traditional Authentication Methods
0 Provides better security
0 More convenient
0 Better accountability
0 Applications on Fraud detection and Fraud deterrence
0 Dual purpose: Cyber Security and National Security
01/18/25 04:49

13-60

What is the Process?

0 Three-steps: Capture-Process-Verification
0 Capture: A raw biometric is captured by a sensing device
such as fingerprint scanner or video camera
0 Process: The distinguishing characteristics are extracted
from the raw biometrics sample and converted into a
processed biometric identifier record
- Called biometric sample or template
0 Verification and Identification
- Matching the enrolled biometric sample against a single
record; is the person really what he claims to be?
- Matching a biometric sample against a database of
identifiers
01/18/25 04:49

13-61

Security Vulnerabilities
0 Type 1 attack: present fake biometric such a synthetic
biometric
0 Type 2 attack: Submit a previously intercepted biometric
data: replay
0 Type 3 attack: Compromising the feature extractor module to
give results desired by attacker
0 Type 4 attack: Replace the genuine feature values produced
by the system by fake values desired by attacker
0 Type 5 attack: Produce a high number of matching results
0 Type 6 attack: Attack the template database: add templates,
modify templates etc.
01/18/25 04:49

13-62

Intrusion Detection System

0 An IDS is a device (or application) that monitors network and/or
system activities for malicious activities or policy violations and
produces reports to a Management Station.[
0 Intrusion prevention is the process of performing intrusion detection
and attempting to stop detected possible incidents.
0 Intrusion detection and prevention systems (IDPS) are primarily
focused on identifying possible incidents, logging information about
them, attempting to stop them, and reporting them to security
administrators.
01/18/25 04:49

13-63

Cryptography
0 Cryptography
- Mathematical manipulation of information that prevents the
information being disclosed or altered
0 Cryptanalysis
- Defeating the protected mechanisms of cryptography
0 Cryptology
0 Study of Cryptography and Cryptanalysis
0 Goals
- Confidentiality, Integrity, Authenticity, Non-repudiation, Access
Control, Make compromise difficult
01/18/25 04:49

13-64

Process
0 Input (also called Plaintext or Clear Text)
0 Cryptosystem (device that performs encryption/decryption)
0 Cryptographic Algorithms (Mathematical functions)
0 Output (Cipher text or Cryptogram)
0 Key (Crypto variable)
01/18/25 04:49

13-65

Key Clustering
0 In cryptography, key clustering is said to occur when two different
keys generate the same ciphertext from the same plaintext, using the
same cipher algorithm.
0 A good cipher algorithm, using different keys on the same plaintext,
should generate a different ciphertext, irrespective of the key length.
0 If an 'attacker' tries to break a cipher by brute-force (trying all
possible keys until it finds the correct key) then key clustering will
result in an easier attack on a particular cipher text.
0 If there are N possible keys without any key clustering then the
attacker will on average need to try N/2 keys to decrypt it and a worst
case of trying all N keys.
0 If there are two keys that are clustered then the average number of
keys to try is reduced to N/4 (worst case is N-1 keys). If three keys
cluster than average attempt is only N/6 attempts.
01/18/25 04:49

13-66

Symmetric Key Cryptography

0 Symmetric-key algorithms are a class of algorithms for cryptography
that use trivially related, often identical, cryptographic keys for both
decryption and encryption.
0 The encryption key is trivially related to the decryption key, in that
they may be identical or there is a simple transformation to go
between the two keys.
0 The keys, in practice, represent a shared secret between two or more
parties that can be used to maintain a private information link.
0 The disadvantage of symmetric cryptography is that it presumes two
parties have agreed on a key and been able to exchange that key in a
secure manner prior to communication.
0 This is a significant challenge. Symmetric algorithms are usually
mixed with public key algorithms to obtain a blend of security and
speed.
01/18/25 04:49

13-67

Public Key Cryptography

0 Public-key cryptography is a cryptographic approach which involves
the use of asymmetric key algorithms instead of or in addition to
symmetric key algorithms.
0 Unlike symmetric key algorithms, it does not require a secure initial
exchange of one or more secret keys to both sender and receiver.
0 The asymmetric key algorithms are used to create a mathematically
related key pair: a secret private key and a published public key. Use
of these keys allows protection of the authenticity of a message by
creating a digital signature of a message using the private key,
which can be verified using the public key.
0 It also allows protection of the confidentiality and integrity of a
message, by public key encryption, encrypting the message using
the public key, which can only be decrypted using the private key.
01/18/25 04:49

13-68

Public Key Cryptography

0 Public key cryptography is a fundamental and widely used
technology around the world. It is the approach which is employed
by many cryptographic algorithms and cryptosystems.
0 It underlies such Internet standards as Transport Layer Security
(TLS) (successor to SSL)
0 Uses asymmetric key algorithms, where the key used to encrypt a
message is not the same as the key used to decrypt it. Each user
has a pair of cryptographic keys—a public key and a private key.
0 The private key is kept secret, whilst the public key may be widely
distributed.
0 Messages are encrypted with the recipient's public key and can only
be decrypted with the corresponding private key. The keys are
related mathematically, but the private key cannot be feasibly
derived from the public key.
01/18/25 04:49

13-69

Network Security
0 Network security consists of the provisions made in an
underlying computer network infrastructure, policies
adopted by the network administrator to protect the
network and the network-accessible resources from
unauthorized access, and consistent and continuous
monitoring and measurement of its effectiveness
0 Network security starts from authenticating the user,
commonly with a username and a password; Once
authenticated, a firewall enforces access policies such as
what services are allowed to be accessed by the network
users.
0 Though effective to prevent unauthorized access, this
component may fail to check potentially harmful content
such as computer worms or Trojans being transmitted over
the network.
01/18/25 04:49

13-70

Network Security
0 Anti-virus software or an intrusion prevention system (IPS) help
detect and inhibit the action of such malware; An anomaly-based
intrusion detection system may also monitor the network and traffic
for unexpected (i.e. suspicious) content or behavior and other
anomalies to protect resources logged for audit purposes and for
later high level analysis.
0 Honeypots essentially decoy network-accessible resources, could
be deployed in a network as surveillance and early-warning tools.
Techniques used by the attackers that attempt to compromise these
decoy resources are studied during and after an attack to keep an
eye on new exploitation techniques.
0 A Botnet is a collection of software agents, or robots, that run
autonomously and automatically. The term is most commonly
associated with malicious software, but it can also refer to a network
of computers using distributed computing software.
01/18/25 04:49

13-71

Digital Forensics
0 Digital forensics is about the investigation of crime including
using digital/computer methods
0 More formally: “Digital forensics, also known as computer
forensics, involved the preservation, identification, extraction,
and documentation of computer evidence stored as data or
magnetically encoded information”, by John Vacca
0 Digital evidence may be used to analyze cyber crime (e.g.
Worms and virus), physical crime (e.g., homicide) or crime
committed through the use of computers (e.g., child
pornography)
0 Computers are attacked (Cyber crime); Computers are used
to commit a crime (child predators, Embezzlement, Fraud);
Computers are used to solve a crime (Homicide)
01/18/25 04:49

13-72

Relationship to Intrusion Detection, Firewalls,

Honeypots
0 They all work together with Digital forensics techniques
0 Intrusion detection
- Techniques to detect network and host intrusions
0 Firewalls
- Monitors traffic going to and from and organization
0 Honeypots
- Set up to attract the hacker or enemy; Trap
0 Digital forensics
- Once the attack has occurred or crime committed need to
decide who committed the crime
01/18/25 04:49

13-73

Access Control in Relational Databases:

1975 - Present
0 Access Control policies were developed initially for file systems
- E.g., Read/write policies for files
0 Access control in databases started with the work in System R and
Ingres Projects
- Access Control rules were defined for databases, relations,
tuples, attributes and elements
- SQL and QUEL languages were extended
=GRANT and REVOKE Statements
=Read access on EMP to User group A Where
EMP.Salary < 30K and EMP.Dept <> Security
- Query Modification:
=Modify the query according to the access control rules
=Retrieve all employee information where salary < 30K and
Dept is not Security
01/18/25 04:49

13-74

Query Modification Algorithm

0 Inputs: Query, Access Control Rules
0 Output: Modified Query
0 Algorithm:
- Given a query Q, examine all the access control rules relevant to
the query
- Introduce a Where Clause to the query that negates access to
the relevant attributes in the access control rules
=Example: rules are John does not have access to Salary in
EMP and Budget in DEPT
=Query is to join the EMP and DEPT relations on Dept #
=Modify the query to Join EMP and DEPT on Dept # and
project on all attributes except Salary and Budget
- Output is the resulting query
01/18/25 04:49

13-75

Mandatory Access Control (MAC) in

Databases: 1982- Present
0 Bell and LaPadula Policy adapted for databases
- Read at or below your level and Write at your level; Granularity of
classification: Databases, Relations, Tuples, Attributes, Elements
0 Security Architectures
- Operating system providing mandatory access control and DBMS is
untrusted with respect to MAC (e.g., SRI’s SeaView)
- Trusted Subject Architecture where DBMS is trusted with respect to MAC
(e.g., TRW’s ASD and ASD Views)
- Integrity Lock where Trusted front-end computes checksums (e.g.,
MITRE’s MISTRESS Prototype)
- Distributed Architecture where data is distributed according to security
levels and access through trusted front-end (e.g., NRL’s SINTRA)
Extended Kernel for Security Policy Enforcement such as constraints
(e.g., Honeywell’s Lock Data Views)
01/18/25 04:49

13-76

Security Policies / Access Control Rules

0 Simple Constraint: John cannot access the attribute Salary of
relation EMP
0 Content-based constraint: If relation MISS contains information
about missions in the Middle East, then John cannot access MISS
0 Association-based Constraint: Ship’s location and mission taken
together cannot be accessed by John; individually each attribute can
be accessed by John
0 Release constraint: After X is released Y cannot be accessed by
John
0 Aggregate Constraints: Ten or more tuples taken together cannot be
accessed by John
0 Dynamic Constraints: After the Mission, information about the
mission can be accessed by John
01/18/25 04:49

13-77

Other Developments in Access Control

0 Inference Problem and Access Control
- Inference problem occurs when users pose queries and deduce
unauthorized information from the legitimate responses
- Security constraint processing for controlling inferences
- More recently there is work on controlling release information
instead of controlling access to information
0 Temporal Access Control Models
- Incorporates time parameter into the access control models
0 Role-based access control
- Controlling access based on roles of people and the activities
they carry out; Implemented in commercial systems
0 Positive and Negative Authorizations
- Should negative authorizations be explicitly specified? How can
conflicts be resolved?
01/18/25 04:49

13-78

Some Examples
0 Temporal Access Control
- After 1/1/05, only doctors have access to medical records
0 Role-based Access Control
- Manager has access to salary information
- Project leader has access to project budgets, but he does not
have access to salary information
- What happens is the manager is also the project leader?
0 Positive and Negative Authorizations
- John has write access to EMP
- John does not have read access to DEPT
- John does not have write access to Salary attribute in EMP
- How are conflicts resolved?
01/18/25 04:49

13-79

Dissemination Policies
0 Release policies will determine to whom to release the data
- What is the connection to access control
- Is access control sufficient
- Once the data is retrieved from the information source (e.g.,
database) should it be released to the user
0 Once the data is released, dissemination policies will determine who
the data can be given to
- Electronic music, etc.
01/18/25 04:49

13-80

Risk Based Data Sharing/Access Control

0 What are the risks involved in releasing/disseminating the data
0 Risk modeling should be integrated with the access control model
0 Simple method: assign risk values
0 Higher the risk, lower the sharing
0 What is the cost of releasing the data?
0 Cost/Risk/Security closely related
01/18/25 04:49

13-81

Summary
0 Cyber Security Modules
0 Risk and Governance
0 Security Architectures
0 Access Control
0 Cryptography
0 Network Security
0 Digital Forensics
0 Access Control for Database Management