CS475 –Network and Information Security · CS475 –Network and Information Security Lecture 1 Introduction ... , through password) ... •25% Midterm

CS475– NetworkandInformationSecurity

Lecture1IntroductionEliasAthanasopoulos

eliasathan@cs.ucy.ac.cy

Whatisthiscourseallabout?

• Understandthefundamentalconceptsofsecurityinsoftware,systems,andthenetwork

• Broadrangeofsecuritytopics• Noverydeepdives• Hands-onexperience

2

Whycomputersecurityisimportant?

3

4

5

6

https://haveibeenpwned.com

7

8

It’samess…

9

10

Itcanonlygetworse…

Whyitsocomplicated?

• Systemshavedifferentbuildinglayers– Hardware,Software,Network,Protocols

• Heavyinterractionandinterconnection– InternetofThings

• People

11

Ourtopics

• AppliedCrypto• SoftwareSecurity• NetworkSecurity• WebSecurity• MobileSecurity• AnonymityandPrivacy

12

Conceptsofdifferenttopicsinterractwitheachother!

Resources• Nosingletextbooktocovereverything,thetopicisrapidly

changing• Iwillprovidemanyresourcesonaper-lecturebasis

(papers,articles,software,etc.)• Somesuggested(free)material:

– HandbookofAppliedCryptography,http://cacr.uwaterloo.ca/hac/

– SecurityEngineering,http://www.cl.cam.ac.uk/~rja14/book.html

• Somesuggested(nonfree)material:– IntroductiontoComputerSecurity,byMichaelT.Goodrichand

RobertoTamassia(ISBN-13:978-0321512949,ISBN-10:0321512944)

13

Let’sgo!

14

Whatiscomputersecurity?“Computersecurity,alsoknownascybersecurity orITsecurity,istheprotectionofcomputer systemsfromthetheft ordamage totheirhardware,softwareorinformation,aswellasfromdisruption ormisdirection oftheservicestheyprovide.”

Gasser,Morrie(1988).BuildingaSecureComputerSystem(PDF).VanNostrandReinhold.p. 3.ISBN 0-442-23022-2,https://ece.uwaterloo.ca/~vganesh/TEACHING/S2014/ECE458/building-secure-systems.pdf)

15

Whatiscomputersecurity?• Apropertythataffectssystems– Hardware,software,network

• Degradingthispropertyleadstobadthings– Theft,damage,disruption,misdirection

• Degradingthispropertyisdeliberate– Anattackerdegradesthesecurityofasystemonpurpose

Suggestedreadhttps://www.cs.columbia.edu/~smb/blog/2017-09/2017-09-01.html

16

Example1

• Anapplicationneedstotransmitsensitivedata– Submittingapassword– Sendingapersonalmessage

• Justreadingsensitivedataisenoughtobreaksecurity– Leakthepassword,orthepersonalmessage

17

Example2

• Anapplicationneedstotransmitsensitivedata– Submitthedetailsofafinancialtransaction– Submitthecastingofavote

• Modifyingthesensitivedatacanbreakthesecurity–Modifythefinancialtransaction,orthevote

18

SecurityRequirements

• FromExample1and2,wecanseethatsecuritycanimplyseveraldifferent sub-properties

• Differentapplicationshavedifferentsecurityrequirements,whichcanbegrouped– Confidentiality,Integrity,Availability,Authentication,Non-repudiation,Accounting,Privacy

– Suggestedreference:https://www.ietf.org/rfc/rfc2828.txt

19

Confidentiality

Thepropertythatinformationisnotmadeavailableordisclosedtounauthorizedindividuals,entities,orprocesses(i.e.,toanyunauthorizedsystementity)

20

Integrity

Dataintegrity:Thepropertythatdatahasnotbeenchanged,destroyed,orlostinanunauthorizedoraccidentalmannerSystemintegrity:Assuresthatasystemperformsitsintendedfunctioninanunimpairedmanner,freefromdeliberateorinadvertentunauthorizedmanipulationofthesystem

21

Availability

Thepropertyofasystemorasystemresourcebeingaccessibleandusableupondemandbyanauthorizedsystementity,accordingtoperformancespecificationsforthesystem;i.e.,asystemisavailableifitprovidesservicesaccordingtothesystemdesignwheneverusersrequestthem

22

CIA• Confidentiality

– Thepropertythatinformationisnotmadeavailableordisclosedtounauthorizedindividuals,entities,orprocesses(i.e.,toanyunauthorizedsystementity)

• Integrity– Dataintegrity:Thepropertythatdatahasnotbeenchanged,destroyed,or

lostinanunauthorizedoraccidentalmanner– Systemintegrity:Assuresthatasystemperformsitsintendedfunctioninan

unimpairedmanner,freefromdeliberateorinadvertentunauthorizedmanipulationofthesystem

• Availability– Thepropertyofasystemorasystemresourcebeingaccessibleandusable

upondemandbyanauthorizedsystementity,accordingtoperformancespecificationsforthesystem;i.e.,asystemisavailableifitprovidesservicesaccordingtothesystemdesignwheneverusersrequestthem

23

AnExample

24

Confidentiality:Badguyscannotseemessages

Integrity: Badguyscannotchange

messages

Availability: Thesystemisoperational

System/ServiceCommunication

Example1– Confidentiality

• Anapplicationneedstotransmitsensitivedata– Submittingapassword– Sendingapersonalmessage

• Justreadingsensitivedataisenoughtobreaksecurity– Leakthepassword,orthepersonalmessage

25

Example2– Integrity

• Anapplicationneedstotransmitsensitivedata– Submitthedetailsofafinancialtransaction– Submitthecastingofavote

• Modifyingthesensitivedatacanbreakthesecurity–Modifythefinancialtransaction,orthevote

26

AdditionalRequirements

• Non-repudiation– Onepartyofatransactioncannotdenyhavingreceivedatransactionnorcantheotherpartydenyhavingsentatransaction

27

AdditionalRequirements

• AccessControl– Identification• IclaimIamJohnSmith(i.e.,bysubmittingausername)

– Authentication• SystemverifiesthatIamJohnSmith(e.g.,throughpassword)

– Authorization• AsJohnSmithIamauthorizedtoperformaparticularaction(i.e.,postamessage)

28

Privacy

Therightofanentity(normallyaperson),actinginitsownbehalf,todeterminethedegreetowhichitwillinteractwithitsenvironment,includingthedegreetowhichtheentityiswillingtoshareinformationaboutitselfwithothers

29

SecurityContext

• ThreatModel– Listtheattacker’scapabilities– Listtheattacker’sgoal– Often,listthedefensesthatareinplace– Often,listtheaffectedrisksofthetargetsystemusingsecurityrequirements(CIA)

“Securityisn’tascalar.Itdoesn’tmakesensetoask‘IsdeviceXsecure?’withoutacontext:‘secureagainstwhomandinwhatenvironment?’”

30

ExampleThreatModel

• PassiveMan-in-the-Middle– Anattackerthatcanpassivelymonitornetworkpacketsexchangedbetweentwoparties

– Attackerwantstorevealtheconversation– ConversationisencryptedusingthecryptosystemX

– ConfidentialitycanbeaffectedifattackercanbreakcryptosystemX

– Integrity,andAvailabilitycannotbeaffected

31

CourseLogistics

32

Ethics

• Thecoursehasmanyoffensiveparts• Usingtheoffensivepartinthewildisstrictlyforbidden

• Ourgoalistounderstandattacksforbuildingbetterdefenses

33

Logistics• 45%Final• 25%Midterm• 30%Assignments– 20%Programmingassignments(4intotalandinC/C++)

– 10%Quiz• Success– Allassignmentshavebeensubmitted– Finalwrittenexamisatleast4,5– Finalscoreisatleast5

34