UNIT IV:Security Measurement Strategies

Antivirus Techniques: Firewalls, Intrusion Detection System (IDS),
Intrusion Prevention System (IPS).
Brief Introduction about Anti-Phishing Approach (Common Strategies Used
For Secured Authentication): Authentication using passwords like One Time
Password (OTP) generators, Two Factor Authentications, Secure Socket
Layer (SSL), Secure Electronic Transaction (SET), Cryptography.

 Firewall is a barrier between Local Area Network (LAN) and the Internet. It
allows keeping private resources confidential and minimizes the security risks. It
controls network traffic, in both directions.
 The following diagram depicts a sample firewall between LAN and the internet.
The connection between the two is the point of vulnerability. Both hardware and
the software can be used at this point to filter network traffic.

Firewall is categorized into three basic types −
 Packet filter (Stateless & Stateful)
 Application-level gateway
 Circuit-level gateway

Sateless & Stateful Packet Filtering Firewall
In this type of firewall deployment, the internal network is connected to the external network/Internet via a
router firewall. The firewall inspects and filters data packet-by-packet.
Packet-filtering firewalls allow or block the packets mostly based on criteria such as source and/or destination
IP addresses, protocol, source and/or destination port numbers, and various other parameters within the IP
header.
The decision can be based on factors other than IP header fields such as ICMP message type, TCP SYN and
ACK bits, etc.
Packet filter rule has two parts −
 Selection criteria − It is a used as a condition and pattern matching for decision making.
 Action field − This part specifies action to be taken if an IP packet meets the selection criteria. The action
could be either block (deny) or permit (allow) the packet across the firewall.
Packet filtering is generally accomplished by configuring Access Control Lists (ACL) on routers or switches.
ACL is a table of packet filter rules.
As traffic enters or exits an interface, firewall applies ACLs from top to bottom to each incoming packet, finds
matching criteria and either permits or denies the individual packets.

 Stateless firewall is a kind of a rigid tool. It looks at packet and allows it if its
meets the criteria even if it is not part of any established ongoing communication.
 Hence, such firewalls are replaced by stateful firewalls in modern networks. This
type of firewalls offer a more in-depth inspection method over the only ACL based
packet inspection methods of stateless firewalls.

 An application-level gateway acts as a relay node for the application-level traffic.
They intercept incoming and outgoing packets, run proxies that copy and forward
information across the gateway, and function as a proxy server, preventing any
direct connection between a trusted server or client and an untrusted host.
 The proxies are application specific. They can filter packets at the application
layer of the OSI model.

An application-specific proxy
 An application-specific proxy accepts packets generated by only specified application for which
they are designed to copy, forward, and filter. For example, only a Telnet proxy can copy, forward,
and filter Telnet traffic.
 If a network relies only on an application-level gateway, incoming and outgoing packets cannot
access services that have no proxies configured. For example, if a gateway runs FTP and Telnet
proxies, only packets generated by these services can pass through the firewall. All other
services are blocked.
Application-level Filtering
 An application-level proxy gateway, examines and filters individual packets, rather than simply
copying them and blindly forwarding them across the gateway. Application-specific proxies check
each packet that passes through the gateway, verifying the contents of the packet up through the
application layer. These proxies can filter particular kinds of commands or information in the
application protocols.
 Application gateways can restrict specific actions from being performed. For example, the
gateway could be configured to prevent users from performing the ‘FTP put’ command. This can
prevent modification of the information stored on the server by an attacker.

 The circuit-level gateway is an intermediate solution between the packet filter and
the application gateway. It runs at the transport layer and hence can act as proxy
for any application.
 Similar to an application gateway, the circuit-level gateway also does not permit
an end-to-end TCP connection across the gateway. It sets up two TCP connections
and relays the TCP segments from one network to the other. But, it does not
examine the application data like application gateway. Hence, sometime it is
called as ‘Pipe Proxy’.

 The packet filtering firewalls operate based on rules involving TCP/UDP/IP
headers only. They do not attempt to establish correlation checks among different
sessions.
 Intrusion Detection/Prevention System (IDS/IPS) carry out Deep Packet
Inspection (DPI) by looking at the packet contents. For example, checking
character strings in packet against database of known virus, attack strings.
 Application gateways do look at the packet contents but only for specific
applications. They do not look for suspicious data in the packet. IDS/IPS looks for
suspicious data contained in packets and tries to examine correlation among
multiple packets to identify any attacks such as port scanning, network mapping,
and denial of service and so on.

Types of IDS
There are two basic types of IDS.
 Signature-based IDS: It needs a database of known attacks with their signatures.
Signature is defined by types and order of packets characterizing a particular attack.
 Limitation of this type of IDS is that only known attacks can be detected. This IDS can
also throw up a false alarm. False alarm can occur when a normal packet stream
matches the signature of an attack. Well-known public open-source IDS example is
“Snort” IDS.
 Anomaly-based IDS: This type of IDS creates a traffic pattern of normal network
operation. During IDS mode, it looks at traffic patterns that are statistically unusual.
For example, ICMP unusual load, exponential growth in port scans, etc. Detection of
any unusual traffic pattern generates the alarm. The major challenge faced in this
type of IDS deployment is the difficulty in distinguishing between normal traffic and
unusual traffic.

 IDS and IPS are similar in detection of anomalies in the network. IDS is a ‘visibility’
tool whereas IPS is considered as a ‘control’ tool.
 Intrusion Detection Systems sit off to the side of the network, monitoring traffic at
many different points, and provide visibility into the security state of the network. In
case of reporting of anomaly by IDS, the corrective actions are initiated by the network
administrator or other device on the network.
 Intrusion Prevention System are like firewall and they sit in-line between two
networks and control the traffic going through them. It enforces a specified policy on
detection of anomaly in the network traffic. Generally, it drops all packets and blocks
the entire network traffic on noticing an anomaly till such time an anomaly is
addressed by the administrator.

Phishing prevention measures should be complemented with detection methods.
The key strategies include
 Monitor domain name registrations.
 Watermark the original web pages to identify usage in phishing sites.
 Monitor web server logs for suspicious referral entries and excessive traffic from
one source IP.
 Track double-bounce mails.
 Setup forum for users to report phishing.

Detecting registered fake domain names
 The attacker needs to setup a look-alike site. First a domain name is registered. Many
times attackers register a domain which sounds similar to the original. If they are
targeting www.abcbank.com attackers might register www.abc-bank-1.com. In a recent
phishing attack Halifax bank was targeted using a domain called www.halifaax.com.
Notice the extra "a". If we are diligent enough to track registrations of new DNS
domains, we have a chance of getting to know about these "similar" registrations and
can initiate action before the domain name can be used for a phishing attack.
 This method of detection is not fool-proof because of different reasons. First - Even
though it is easy to track new registrations of GLTD-generic top-level-domain like .com
and .net, it is not true for CCTLD -country specific top-level-domains like .cn(China) or
.kr(Korea) where many phishing sites are registered. Second - attackers may choose
not to register a domain name and operate the website using just IP address.

Detecting look alike webpages
 When a phishing webpage is being created, some attackers might not want to write their own
HTML page -they might just Copy-Paste the content of the original website and make their own
page. If we insert something like obfuscated javascript in the original website [which alerts us
when run under any URL other than the authentic] we can get alerted against these attacks.
There are many methods for watermarking your original website to track a phisher. For more on
this read the "6 steps to beat phishing".
 Many times attackers design the phishing webpage such that the images are picked up from the
original site rather than keeping a repository of images in their fake website. When the user
loads the phishing webpage, the browser goes and picks the images from original website. The
referrer URL as seens by the original website will be the URL of the fake website [www.abc-
bank-1.com].
 On the original website if we are analyzing the web server logs and looking for suspicious
referrers we will be able to detect an phishing attack in progress.

Detecting emails sent to users
 Once the phishing site is ready, attackers sends emails to hundreds of users, who are the potential
victims. As expected, many of these emails would bounce as the TO: address is incorrect. To increase
credibility of the mail attackers would keep the From: address of the mail as something like
admin@abcbank.com. This userid will be non-existent on the abcbank.com email server. Otherwise the
mails which bounce will get into the mailbox of a user, if the admin@abcbank.com is a valid email id. If
this is a valid email address, attackers would keep the from address as something like
admin1@abcbank.com.
 The mails with wrong To: addresses are all returned to the abcbank.com SMTP server. The SMTP
server looks at the From: address admin1@abcbank.com and finds it is non-existent. From: address
and To: address are both wrong. This is called a double-bounce mail.
 This method of detection is not foolproof as attackers could use a domain name other than the original
like admin1@abc-bank-1.com. The bounced mail will never reach the SMTP server of the original
abcbank.com and no analysis and alerting is possible.
 Finally, users who receive the phishing mail can alert the organization about it. It is important for the
organization to implement forums for easy reporting. It could be setting up a common mailbox like
phish@abcbank.com or a toll-free-number or educating the user helpdesk about this attack. These
forums should be actively published to the users via different channels. An alert user who reports
early could save many others.

Detecting Man in the Middle Attacks
 Another method quite popular today is real time man-in-the-middle phishing
attacks. As was recently demonstrated in the attacks on Citibusiness, phishers
collect user-id passwords [short-lived one time passwords] and use them in real
time against the original websites. If the attacker is trying passwords of multiple
victims, you will see hundreds of connections from the attacker's PC. If we are
analyzing the webserver logs and checking for large number of connections from
one IP it could be the attacker doing man-in-the-middle.
 This method of detection is not fool-proof as attackers might use the phished
informations from multiple computers rather than from a single one.

Secured Login
The first and foremost security step should be the use of an HTTPS site rather than
an HTTP one. Whenever you login from an HTTP page, there is no guarantee that
your login credentials are sent in an encrypted format onto the main page. Further,
two-way authentication or certificate-based login is a must for significant logins.
This is a combination of a traditional username and password along with a code
sent to you on your phone.

Two-Factor Authentication (2FA) One time Password: One Time PasswordOne time
passwords (OTPs) are an authentication method commonly used as part of two-factor
identification (2FA) and multi-factor authentication (MFA) that can help balance these
needs. OTPs are unique passwords that are only valid for a single login session for a
defined period of time. Because OTPs aren’t reusable, they overcome many of the
shortcomings of traditional (static) passwords by not being vulnerable to replay attacks.
How OTP Soft Tokens Work
 Soft tokens are software programs, typically downloadable mobile authenticator
applications, such as RapidIdentity Mobile or Google Authenticator, that effectively
turn a user’s device into an OTP generator.
 The setup process entails the server generating a secret key. The user enters the secret
key into the authenticator application. The user can then generate an OTP to verify
the setup process worked with the server.
 Each time the authenticator app is opened, a random number is generated for use at a
fixed interval. After a specified period of time has elapsed (normally 30 seconds), a new
number is presented.

 When it is time for a user to authenticate, the user simply enters the current
value generated by the mobile authenticator app, along with their username and
optionally, a password, PIN, TouchID, or FaceID to log in, effectively adding
another layer of security.
 Behind the scenes, the server that is authenticating the user runs the algorithm
used to generate the OTP. The clocks of the user's device and the server are
roughly synchronized, so the numbers entered should match. Once the user’s
credentials are validated, the user is permitted to access the service, website, or
application.

Benefits
 Ease of Use: As most users already have smartphones and are comfortable with mobile
technologies, it is easy for them to learn to use soft OTPs and incorporate them into
their daily routines. Users tend to keep their smartphones close at hand, making the
mobile authenticator application readily accessible.
 Works Offline: Because the soft OTPs are generated by a clock-based algorithm that is
synchronized across the IT infrastructure, a cell phone signal is not required to
authenticate using this method. This comes in handy for situations where a wireless
signal isn’t available, such as on flights when airplane mode is used.
 Not Vulnerable to Replay Attacks: In addition to offering an extra layer of security,
OTPs also mitigate the risk of replay attacks—a shortcoming of traditional passwords.
Replay attacks use valid username and password data captured in transmission to fool
a system into granting access, effectively replaying the request. Because OTPs are not
reusable, even if a would-be intruder were to record an OTP, it would no longer be
valid if the intruder tried to use the OTP to log into a service.

Drawbacks
 Requires a Mobile Device: Soft OTPs require users to complete the login process
on their mobile phones. Some users may not want to take this step on their
personal phones, and it may not even be an option for users who don't have
smartphones. Additionally, mobile phones have to be charged frequently, and if the
battery dies, the user can’t authenticate via this method.
 Devices Can Be Lost or Stolen: A soft OTP cannot be used to authenticate if the
mobile device itself is lost or stolen. However, in the event this does happen, it’s
just a matter of re-provisioning the mobile authenticator app on the user’s new
smartphone, unlike with hard tokens, where a new token would have to be
purchased and shipped to the user.
 Security Vulnerabilities: Soft OTPs are installed on mobile devices, leaving them
vulnerable to attacks on the phone’s operating system or other applications. Soft
OTPs also utilize a shared secret between the app and the system’s server, each of
which can be hacked to access the password.

 Secure Sockets Layer (SSL) is a networking protocol designed for securing
connections between web clients and web servers over an insecure network, such
as the internet. After being formally introduced in 1995, SSL made it possible for
a web server to securely enable online transactions between consumers and
businesses. Due to numerous protocol and implementation flaws and
vulnerabilities, SSL was deprecated for use on the internet by the Internet
Engineering Task Force (IETF) in 2015 and has been replaced by the Transport
Layer Security (TLS) protocol.
 While TLS and SSL are not interoperable, versions of TLS through 1.2 were
backward-compatible with SSL 3.0. However, backward compatibility with SSL
was removed from TLS 1.3, the current version of TLS that was published in
2018.

 A website that implements SSL/TLS has "HTTPS" in its URL instead of "HTTP."

Secure Socket Layer Protocols:
 SSL record protocol
 Handshake protocol
 Change-cipher spec protocol
 Alert protocol

SSL Record provide two services to SSL connection.
 Confidentiality
 Message Integrity
 In SSL Record Protocol application data is divided into fragments. The fragment
is compressed and then encrypted MAC (Message Authentication Code) generated
by algorithms like SHA (Secure Hash Protocol) and MD5 (Message Digest) is
appended. After that encryption of the data is done and in last SSL header is
appended to the data.

Handshake Protocol is used to establish sessions. This protocol allow client and
server to authenticate each other by sending a series of messages to each other.
Handshake protocol uses four phases to complete its cycle.
 Phase-1: In Phase-1 both Client and Server send hello-packets to each other. In
this IP session, cipher suite and protocol version are exchanged for security
purpose.
 Phase-2: Server send his certificate and Server-key-exchange. Server end the
phase-2 by sending Server-hello-end packet.
 Phase-3: In this phase Client reply to the server by sending his certificate and
Client-exchange-key.
 Phase-4: In Phase-4 Change-cipher suite occurred and after this Handshake
Protocol ends.

 This protocol uses SSL record protocol. Unless Handshake Protocol is completed,
the SSL record Output will be in pending state. After handshake protocol the
Pending state is converted into Current state.
 Change-cipher protocol consists of single message which is 1 byte in length and
can have only one value. This protocol purpose is to cause the pending state to be
copied into current state.

This protocol is used to convey SSL-related alerts to the peer entity. Each message
in this protocol contain 2 bytes.
Level is further classified into two parts:
 Warning: This Alert have no impact on the connection between sender and
receiver.
 Fatal Error: This Alert breaks the connection between sender and receiver.

 Advantage of this approach is that the service can be tailored to the specific needs
of the given application.
 Secure Socket Layer was originated by Netscape.
 SSL is designed to make use of TCP to provide reliable end-to-end secure service.
 This is two-layered protocol.

 Secure Electronic Transaction or SET is a system which ensures security and
integrity of electronic transactions done using credit cards in a scenario. SET is
not some system that enables payment but it is a security protocol applied on
those payments. It uses different encryption and hashing techniques to secure
payments over internet done through credit cards. SET protocol was supported in
development by major organizations like Visa, Mastercard, Microsoft which
provided its Secure Transaction Technology (STT) and NetScape which provided
technology of Secure Socket Layer (SSL).
 SET protocol restricts revealing of credit card details to merchants thus keeping
hackers and thieves at bay. SET protocol includes Certification Authorities for
making use of standard Digital Certificates like X.509 Certificate.

 Let’s see a general scenario of electronic transaction, which includes client,
payment gateway, client financial institution, merchant and merchant financial
institution.

Requirements in SET :
SET protocol has some requirements to meet, some of the important requirements
are :
 It has to provide mutual authentication i.e., customer (or cardholder)
authentication by confirming if the customer is intended user or not and merchant
authentication.
 It has to keep the PI (Payment Information) and OI (Order Information)
confidential by appropriate encryptions.
 It has to be resistive against message modifications i.e., no changes should be
allowed in the content being transmitted.
 SET also needs to provide interoperability and make use of best security
mechanisms.

Participants in SET :
In the general scenario of online transaction, SET includes similar participants:
 Cardholder – customer
 Issuer – customer financial institution
 Merchant
 Acquirer – Merchant financial
 Certificate authority – Authority which follows certain standards and issues
certificates(like X.509V3) to all other participants.

SET functionalities :
 Provide Authentication
Merchant Authentication – To prevent theft, SET allows customers to check previous
relationships between merchant and financial institution. Standard X.509V3 certificates
are used for this verification.
 Customer / Cardholder Authentication – SET checks if use of credit card is done by an
authorized user or not using X.509V3 certificates.
 Provide Message Confidentiality : Confidentiality refers to preventing unintended
people from reading the message being transferred. SET implements confidentiality by
using encryption techniques. Traditionally DES is used for encryption purpose.
 Provide Message Integrity : SET doesn’t allow message modification with the help of
signatures. Messages are protected against unauthorized modification using RSA
digital signatures with SHA-1 and some using HMAC with SHA-1.

 Cryptography is the study and practice of techniques for secure communication in
the presence of third parties called adversaries. It deals with developing and
analyzing protocols which prevents malicious third parties from retrieving
information being shared between two entities thereby following the various
aspects of information security.
 Secure Communication refers to the scenario where the message or data shared
between two parties can’t be accessed by an adversary. In Cryptography, an
Adversary is a malicious entity, which aims to retrieve precious information or
data thereby undermining the principles of information security.

 Confidentiality refers to certain rules and guidelines usually executed under
confidentiality agreements which ensure that the information is restricted to
certain people or places.
 Data integrity refers to maintaining and making sure that the data stays accurate
and consistent over its entire life cycle.
 Authentication is the process of making sure that the piece of data being claimed
by the user belongs to it.
 Non-repudiation refers to ability to make sure that a person or a party associated
with a contract or a communication cannot deny the authenticity of their
signature over their document or the sending of a message.

Consider two parties Alice and Bob. Now, Alice wants to send a message m to Bob
over a secure channel. So, what happens is as follows.
 The sender’s message or sometimes called the Plaintext, is converted into an
unreadable form using a Key k. The resultant text obtained is called the
Ciphertext. This process is known as Encryption. At the time of receival, the
Ciphertext is converted back into the plaintext using the same Key k, so that it
can be read by the receiver. This process is known as Decryption.
 Alice (Sender) Bob (Receiver)
 C = E (m, k) ----> m = D (C, k)
 Here, C refers to the Ciphertext while E and D are the Encryption and Decryption
algorithms respectively.

Let’s consider the case of Caesar Cipher or Shift Cipher as an example.
As the name suggests, in Caesar Cipher each character in a word is replaced by
another character under some defined rules. Thus, if A is replaced by D, B by E and
so on. Then, each character in the word would be shifted by a position of 3. For
example:
Plaintext : prestige
Ciphertext : suhvwljh
Note that even if the adversary knows that the cipher is based on Caesar Cipher, it
cannot predict the plaintext as it doesn’t have the key in this case which is to shift
the characters back by three places.

In general there are three types Of cryptography:
 Symmetric Key Cryptography: It is an encryption system where the sender and
receiver of message use a single common key to encrypt and decrypt messages.
Symmetric Key Systems are faster and simpler but the problem is that sender and
receiver have to somehow exchange key in a secure manner. The most popular
symmetric key cryptography system is Data Encryption System(DES).
 Hash Functions: There is no usage of any key in this algorithm. A hash value with
fixed length is calculated as per the plain text which makes it impossible for contents
of plain text to be recovered. Many operating systems use hash functions to encrypt
passwords.
 Asymmetric Key Cryptography: Under this system a pair of keys is used to encrypt
and decrypt information. A public key is used for encryption and a private key is used
for decryption. Public key and Private Key are different. Even if the public key is
known by everyone the intended receiver can only decode it because he alone knows
the private key.

UNIT IV:Security Measurement Strategies

Recommended

More Related Content

Similar to UNIT IV:Security Measurement Strategies (20)

More from Arnav Chowdhury (20)

Recently uploaded (20)

UNIT IV:Security Measurement Strategies