Please enable JavaScript.

Coggle requires JavaScript to display documents.

Network Security Midterm (Security (is Hard (Complexity of security…

- - - - Security rests on
        (Objectives)
        
        C.I.A
        
        Confidentiality
        (Secrecy)
        
        Keeping data and resources hidden
        
        Availability
        (Denial of Service)
        
        Enabling access to data
        and resources
        
        Integrity
        (Trustworthiness)
        
        Data & Origin (authentication) integrity
        
        Authenticity
    - - Potential actions are Threats
        
        Threats that are carried out are Attack/Exploits
        
        Intentional attack are carried out by an Attacker
        
        Objects of attacks are Assets
      - Weaknesses are Vulnerabilities
  - - - Detect attackers’ violation of security policy
    - - Stop attack, assess and repair damage
    - - Continue to function correctly even if attack succeeds
    - - Prevent attackers from violating security policy
  - - - Policy
        
        Specification
        
        Design
        
        Implementation
        
        Operation
- - - - Make it a zombie
        
        Botnet: Collection of zombie
  - - - Code that replicates and propagates across network
        (often carries payload)
      - Spread via exploiting flaws in open services
      - 1st Worm: Robert Morris, Nov 1988
      - Internet Worm
        
        Effect
        
        Resource exhaustion
        
        Server disconnected from the Internet
        by sys admin to stop infection
        
        What it did?
        
        Spread its infection
        
        Remain undiscovered and undiscoverable
        
        Determine where it could spread
        
        How it worked?
        
        Spread
        
        Remain unrecoverable
        
        Where to spread?
    - - Program that can reproduce itself by
        attaching its code to another program
      - Often written in Assembly or C
      - Attacker infects a program on his own
        machine then distributes that program
        
        Once install, it remains dormant until executed
      - Four stages
        
        Propagation Phase
        
        Triggering Phase
        
        Dormant Phase
        
        Executing Phase
      - Types
        
        Memory-resident
        
        infect running program
        
        Boot sector
        
        spread whenever system is boosted
        
        Parasitic
        
        Search and infect executable files
        
        Polymorphic
        
        encrypt part of virus program using randomly generated key
      - Myths
        
        Spread only on disks or in email
        
        Cannot remain in memory while reboot
        
        Can modify hidden and read-only files
        
        Cannot infect hardware
        
        Can only infect Windows
        
        Can be malevolent, benign, benevolent
      - Antivirus Approach
        
        Detection and identification
        
        Removal
        
        Prevention
        
        Limit contact to outside world
        
        Four generations of antivirus software
        
        Heuristic Scanners
        
        Activity traps
        
        Simple scanner
        
        full-featured protection
    - - Tranport means
        
        Victims download virus without
        attacker's intervention
        
        Have to get the victim to run it
      - Download program somewhere users PATH
      - Pick a name of mistype command (mistype 'ls' as 'la')
- - - - Communicating securely over an insecure channel
      - Secure storage on insecure media
      - Message integrity
      - Authentication
    - - Converts one input plaintext block of fixed
        size k bits to an output ciphertext block also
        of k bits
    - - – 40 bits were considered adequate in 70’s
      - – 56 bits used by DES were adequate in the 80’s
      - – 128 bits are adequate for now
      - 5 more key bits per decade
        to stay “sufficiently” hard to break
  - - - Make the relationship between the <plaintext, key> input and the <ciphertext> output as
        complex (non-linear) as possible
      - mainly accomplished by substitutions
    - - Spread the influence of each input bit across many output bits
      - mainly accomplished by permutations