Authentication And Threats and Attacks to information security, polices and laws

Social engineering is the name given to a category of security attacks in which someone manipulates others into revealing information that can be used to steal data, access to systems, access to cellular phones, money,or even your own identity. Social engineering is the acquisition of sensitive information or inappropriate access privileges by an outsider, based upon the building of an inappropriate trust relationship with insiders. Note that the term “outsider” does not refer only to nonemployees; an outsider can be an employee who is attempting to circumvent established policies and standards. The goal of social engineering is to trick someone into providing valuable information or access to that information or resource. Social engineering is the most difficult form of attack to defend against because it cannot be defended with hardware or software alone. After giving such information as account id, password, social security number, and home address, the Web site returned a message that indicated it was still under Within a week, nearly every employee with a 401(k) plan, including senior management, had attempted to register on the Web site. Pretending to be someone you are not, or schmoozing your way to the information you need. are dumpster diving and shoulder surfing. The dumpster diver is willing to get dirty to get the information he needs. Too often companies throw out important information. Sensitive information, manuals, and phone directories should be shredded before disposing. The shoulder surfer will look over someone’s shoulder to gain pass- words or PIN numbers. The tech support method is where the social engineer pretends to be someone from an infrastructure group and wants a user to access the system while the social engineer scopes out the connection

ppt67 trang | Chia sẻ: vutrong32 | Ngày: 17/10/2018 | Lượt xem: 77 | Lượt tải: 0download
Bạn đang xem trước 20 trang tài liệu Authentication And Threats and Attacks to information security, polices and laws, để xem tài liệu hoàn chỉnh bạn click vào nút DOWNLOAD ở trên
AUTHENTICATION AND THREATS AND ATTACKS TO INFORMATION SECURITY, POLICES AND LAWSLê Quốc ThắngNguyễn Minh Tân*AUTHENTICATION*OUTLINEDefinitionSome basic authentication methodsAuthentication ProtocolsKerberos-An security protocols in the real world*DEFINITIONAccess control is concern with access system resources includes:Authentication :deal with the problem of determining whether a user should be allowed access to particular system or resourceAuthorization restrict the action of authenticated user *AUTHENTICATION METHODSBase on any combination of the following:Something you knowSomething you haveSomething you are *SOMETHING YOU KNOWPasswordEx: Your ATM PIN numberYour date of birthPro:User often choose bad passwords ->easy to crackBut:CostConvenient*PASSWORD CRACKINGConsider the key search problems Here we use 64-bit cryptographic keyTrudy must try possible keys to find the correct one.If we construct a pass with 8 chars ,with 256 possible choices for each charThe complexity of both problems is the same.But:Passwordkf&Yw!a[So with a good dictionary of pass Trudy can crack your passConsider the chance of success / *CHOOSING PASSWORDSFrank Pikachu 10251960AustinStampReplace by:jfIej(43j-EmmL+y 09864376537263P0kem0NFSa7YagoPassphrase“four score and seven years ago”*ATTACKING SYSTEMS VIA PASSWORDSOutsider → normal user → administrator-> one weak pass and our systemPassword attack and system responseSystems often lock after three bad passwords attempts?->How long?Some other password issues:Password reuseSocial engineeringKeystroke logging software* SOMETHING YOU AREBiometricsUniversalDistinguishing PermanentCollectableReliable, robust, and user-friendlyThere are two phase in a Biometric system:enrollment phaserecognition phase*BIOMETRICS Fingerprints:*FINGERPRINTS*BIOMETRICSHand Geometry.*BIOMETRICSIris Scan*BIOMETRICSIn particular, biometrics are difficult, although not impossible , to forge.There are also many potential software-based attacks on biometricsWhile a broken cryptographic key or password can be revoked and replaced, it’s not clear how to revoke a “broken” biometric*SOMETHING YOU HAVE*AUTHENTICATION PROTOCOLSBasic requirementsSimple Security ProtocolsAuthentication protocolsSimple Authentication ProtocolsAuthentications using Symmetric KeysAuthentications using Public KeysSession Keys and Timestamp*SECURITY PROTOCOLS REQUIREMENTSProtocols ? Ex: HTTP , FTPSecurity Protocols? Ex : SSL , IPSec Authentication protocols?Basic requirements:Beside security requirementsEfficient in:CostBandwidthShould not be too fragileAnticipate likely change in the environmentEase of use , implementation, flexibility*SIMPLE SECURITY PROTOCOLSEx : Withdraw money from an ATMInsert ATM card into readerEnter PINIs the PIN correct? • Yes: Conduct your transactions • No: Machine eats your ATM card*SIMPLE SECURITY PROTOCOLS*SIMPLE SECURITY PROTOCOLS*AUTHENTICATION PROTOCOLSSimple Authentication ProtocolsAuthentications using Symmetric KeysAuthentications using Public KeysSession Keys*SIMPLE AUTHENTICATION PROTOCOLS*SIMPLE AUTHENTICATION PROTOCOLS*SIMPLE AUTHENTICATION PROTOCOLS*AUTHENTICATIONS USING SYMMETRIC KEYS C=E(P,K)P=D(C,K)KAB*AUTHENTICATIONS USING SYMMETRIC KEYS *AUTHENTICATIONS USING SYMMETRIC KEYS *AUTHENTICATIONS USING SYMMETRIC KEYS *AUTHENTICATIONS USING SYMMETRIC KEYS *AUTHENTICATIONS USING SYMMETRIC KEYS *AUTHENTICATIONS USING PUBLIC KEYS C={M}AliceM=[C]AliceS=[M]Alice[{M}Alice]Alice=M{[M]Alice}=M*AUTHENTICATIONS USING PUBLIC KEYS*AUTHENTICATIONS USING PUBLIC KEYS*SESSION KEY*SESSION KEY*SESSION KEY*TIMESTAMPContent the current timeCons:Don’t need messages for noncePros:We must accept any timestamp that is close to the current time-> conditions for replay attacks*TIMESTAMP*TIMESTAMP*KERBEROSA trusted third party modelsEmploys a key distribution center, or KDCKDCKKDCAliceKABobKBTrudyKT*KERBERIZED LOGINThe key KA is derived from Alice’s password as KA = h(Alice’s password). The KDC creates the session key SA.Alice’s computer decrypts using KA to obtain SA and the TGT, and then the computer forgets KA.TGT = E(“Alice”,SA;KKDC).*KERBEROS TICKET*KERBEROS SECURITYRecall that, when Alice logs in, the KDC sends E(SA,TGT;KA) to Alice, where TGT = E(“Alice”,SA;KKDC).Since the TGT is encrypted with KKDC, why is the TGT encrypted again with the key KA?The KDC does not need to know who is making the REQUEST in order to decrypt it, since all TGTs are encrypted with KKDC.Why is “ticket to Bob” sent to Alice, when Alice simply forwards it on to Bob?How does Kerberos prevent replay attacks? Kerberos could have chosen to have Alice’s computer remember her password and use that for authentication?Can we have the KDC remember session keys instead of putting these in the TGT?*Q&A AUTHENTICATION*THREATS AND ATTACKS TO INFORMATION SECURITY, POLICES AND LAWS*AGENDARisk analysis and risk managementInformation security policiesThreat to information securityQ&A*RISK ANALYSIS & RISK MANAGEMENTDefinitionInformation security life cycleRisk analysis processRisk mitigationChoose & evaluate*1.DEFINITIONThe process that allows business managers to balance operational and economic costs of protective measure.Some questions:Why & when ?How’s the success of risk analysis measured ?*2.INFORMATION SECURITY LIFE CYCLE*3.RISK ANALYSIS PROCESSAsset definitionThreat IdentificationDetermine probability of occurrenceDetermine the impact of the threatControls recommendedDocumentation *4.RISK MITIGATIONA methodology used by senior management to reduce organizational riskRisk assumptionRisk alleviationRisk avoidanceRisk limitationRisk planningRisk transference*5. CHOOSE & EVALUATEControl categories: avoidance, assurance, detection and recovery.Cost/benefit analysis*INFORMATION SECURITY POLICIES high-level statement of enterprise beliefs, goals, and objectives and the general means for their attainment for a specified subject area.Internal External *OVERALL INFORMATION SECURITY POLICIES*THREATS TO INFORMATION SECURITY*CONTENTOverview of Information securityCommon threatsErrors and OmissionsFraud and TheftMalicious HackersMalicious CodeDenial of Service attacksSocial Engineering*1.OVERVIEW OF INFORMATION SECURITYSecurity policyOrganizational securityAsset classificationPersonal securityPhysical securityCommunication & operationAccess controlDevelopment, maintenance & continuity planning*2. COMMON THREATSGoals of IS:IntegrityConfidentialityAvailability Fault-tolerant (RAID)Load balancingSystem failover*2.1 ERRORS AND OMISSIONSNumber one threat to integrityDefense:Least privilegebackup*2.2 FRAUD AND THEFTDifficult to findDefense Well define policiesComputer forensics (firewalls, server logs, client workstation)MD5**2.3 MALICIOUS HACKERSPrimary groups:Hackers Crackers Phreaks Process:ReconnaissanceScanningGaining accessMaintaining accessCovering tracks*2.4 MALICIOUS CODEWhat is malicious code ?Type of malicious codeVirus Worm (Nimda)Trojan horsesLogic bomb (Michelangelo)*2.5 DENIAL OF SERVICE ATTACKSDOS : designed to overwhelm the target server’s hardware resources.Type of DOS :One to one: SYN floods, FIN floods, Smurfs and FraggleDDOS -many to one attack: Trinoo, TFN2K, stacheldraht*2.6 SOCIAL ENGINEERINGThe acquisition of sensitive information or inappropriate access privileges by an outsiderCommon types of SE: human-based interactionImpersonation and Important UserDumpster diving and shoulder surfingthird-party authorization and tech methods*Q&A*

Các file đính kèm theo tài liệu này:

  • pptsem01_iatech_kstn_1989.ppt