 This course is IT security information technology security. It's for I think all of you Your first course that handles computer and network security So what we do is to get started to introduce what we mean by computer and network security and this lecture will be introducing some terminology some Notations some concepts that we will we will use and see applied through the the subsequent topics in the rest of the semester So a quick quite a light introduction to security Computer security covers many different topics and because we only have one semester. I select Just a subset of the topics that we can cover So if you want to get more details about Cryptography and the theory behind computer security you won't get that in this course But I do teach the security and cryptography course as well on Monday morning So feel free to join that if you want some more theory on computer security Let's start by giving some definitions of what do we mean by computer security and then introduce some some different Notation and terminology so here's a definition of computer security This comes from a handbook produced by NIST NIST is a government Standards organization in the US and they they produce a lot of recommendations and standards about computing including security And they say computer security is the protection afforded to an automated information system An automated information system like a computer system In order to obtain the applicable objectives of preserving so we have some objectives Here as we go through to attain some objectives of preserving the integrity availability and confidentiality of The information system resources So a computer system or a generally an information system has a set of resources data hardware software and Computer security is about trying to protect those that information system such that we meet the objectives of preserving integrity availability and confidentiality and those are three key concepts of computer security Integrity is a making sure that those resources are not modified in an inappropriate manner For example, you have a file stored on your hard disk To maintain the integrity of the file You want to make sure that no one can modify that file without you knowing Availability is making sure that those resources are available to the normal users You're a company you provide a network or a computer system for your users and It's part of running the business. They need to access that computer system. That system needs to be available to the users If due to some security attack it becomes unavailable You can't access a website or a database server. Then that's a problem. So that's what availability is about confidentiality Often we want to keep information secret. So we want to ensure that that data is kept secret That's what confidentiality is about So those are three key objectives that you'll see come up in other definitions and other discussions of computer security preserve integrity availability and confidentiality CIA confidentiality integrity availability, not the central intelligence agency. This is So confidentiality a little bit more depth Sometimes we think of it from two perspectives. We have some the normal perspective of confidentiality is keeping things secret keeping data secret You have a file Only you should be able to access the contents of that file So you may take some mechanisms such that no one else can read the contents of the file you keep it secret confidentiality or You send an email to some Destination or a set of destinations you only want those specific people to be able to read the contents of that email So data confidentiality is about providing that service so that only the authorized people can access the contents but sometimes in confidentiality we also talk about privacy and Privacy Sometimes it's mixed the terminology, but here we'll talk about privacy as being keeping your actions secret hiding your actions So data confidentiality confidentiality is about keeping your data secret Not letting unauthorized people access your data here We'll use privacy to mean keeping your actions secret that is One thing that you may be aware of what websites you access Keeping the the set of websites that you've accessed not just the data you've downloaded But the URLs you've accessed when how often keeping that information secret is one example of privacy And often privacy and data confidentiality a grouped generally is confidentiality So we need to look at in this course Some techniques for providing confidentiality We often want to provide that how do we do that? Anyone know how to provide confidentiality of data You have a file you don't want others to see the contents of that file. What do you do with that file? Password you what put a password in the file Lock the file. How do you lock the file with a key or? Zip folder you're on the right track. You're using the right thing What's the term or the mechanism that we often talk about to lock that file? Encoding and and you probably have heard of another one as well Encryption we would encrypt that file or encrypt the data inside the file and yes using Software like zip often has an option to allow you to encrypt the contents, but there are other ways as well encryption takes the data Transforms that data usually using some secret key like a password and Transforms the data such that once you have that transformed version the encrypted version You can only get back to the original data if you have the correct key you can only decrypt if you have the key so if you don't have the key you cannot decrypt and Unauthorized people assuming they don't have the key cannot cannot access the data So we'll talk a lot about encryption and how we can provide Data confidentiality with encryption What about privacy? How do you what are some mechanisms you can use to stop people knowing what websites you access how often you access them? What times a day you access them Delete the history your web browser keeps a record of the the web Sites the URLs that you access So if someone accesses your computer they can obtain that information What else? So that's only if people access your computer But when you access websites the the packets that are being sent between your computer and the web server are going via many Intermediate devices and they may keep a record of Which websites you're accessing your ISP internet service provider may record? What websites you're accessing when? So we need to look at other ways. How could we hide that information from other users? And we'll talk about towards the end of the semester We'll look at different aspects of web security virtual private networks and related techniques for privacy integrity Is about data integrity Making sure that the data Is only changed in an authorized manner for example, like I said before you have a file stored on your server and If someone can access the server and modify the file without you knowing Then our data integrity has failed. We want to prevent that We don't want changes to happen without or in an unauthorized way and System integrity is not so much related to the data the files we store But the computer system the hardware and software make sure it performs what it's it does what it's supposed to do For example, if we have a our computer system infected with a virus or some malicious software Then your software that you normally use Microsoft Word for example may if it's compromised may do some unexpected things on your computer So we'd like to maintain the integrity of the system the software and the hardware is not compromised so it doesn't perform in an unauthorized manner How do we for data integrity? How do we ensure that a file is not modified without us noticing? Or maybe a simple example an email. I send an email to you How are you sure that the email that you receive is exactly the same as the email I sent? We know we send it across the an internet How can we check at the receiver? That the data that I sent you has not been modified Any ideas you may have heard of you you do it in in Hard copies we can sign the document Okay, we can use what's called a digital signature. There are techniques using cryptography that allow you before you send the email you Attach a digital signature to that email send it to the recipient and the recipient can verify if The message received is being modified or not. So the Digital signature is one technique that we'll look at in the next topic and we'll see it applied and related technologies in later topics for Ensuring that data is not modified along the way not modified without Authorization and some other techniques Availability we have a computer system data bases a network servers and the normal users access that computer system Availability is making sure that they can access it as intended And a simple example of an attack on availability and you would have heard of the term is a DOS or a denial of service attack a Denial of service attack is when some malicious user really overloads that server Network or resource Such that the normal users can't access it. So that's an attack on the availability of our computer system and Over the last few weeks if you follow the some technology news You'll see some of the groups like anonymous do denial of service attacks on on gaming systems like The PlayStation or Xbox network they try and overload the servers So that the normal users cannot access them in the intended manner so in one of our topics will look at denial of service attacks how they work and some options for Trying to protect against denial of service attacks So be aware of the three key security objectives confidentiality integrity and availability Now some people add others on so two other common ones authenticity Checking that the data That you receive is authentic or the person who sent it to you is authentic and the simple example there is that You receive an email from Steve. How are you sure it's from me not someone pretending to be me? So we need Authentication such that the receiver can confirm. Yes, this email did come from Steve It didn't come from a student pretending to be me So that's one aspect of authentication and we look at techniques for how to authenticate people and data and accountability is keeping track of things that happen so that we can be sure that Events that have taken place cannot be denied and we can log and Detect attacks when they're attacking when they're taking place and take action afterwards to recover So usually accountability Accountability involves keeping a log of what's happened in the past usually often using some encryption techniques one example is Listed here. It's called non-repudiation and non-repudiation is the service of saying preventing people from denying that something's happened That is you across the internet you send money to someone to pay for a service What do you want to do is to make sure that when they receive the money electronically they cannot deny That they've received the money you would like to have some method to be sure that If they receive the money they later cannot come back and say I didn't get the money you didn't pay so non-repudiation is an example of Holding the users accountable for what's what's Taken place and it's one method of doing that is having some form of digital receipt and there's some other Features that fall within accountability. We'll talk in one subject about intrusion detection We were not talking this course any details about legal actions, but With an organization if an attack does take place that tries to compromise the confidentiality integrity availability of the system often some actions have to be taken after the fact to recover and Possibly take some legal actions to against the attackers So keeping records of what's happened is useful for that We're going to focus mainly on how do we provide confidentiality integrity and availability in computer systems We spend 15 weeks on computer security and don't get to cover many details Because computer security is hard It's hard to ensure a computer system is truly secure There are many different challenges and This just lists some of the key challenges that are that arise when we're trying to secure a computer system We will not go through all of them. You can read through Often it may seem simple to secure a computer system, but it's not as hard as we it's not as simple as we think Especially to people new to computing it may be simple to secure a computer, but in fact there are many different avenues for attack often some of the security techniques that we use to provide the services are Not as we expect we say they're counter-intuitive So that makes it hard for users that have to use these systems to to adapt What else can we say here when we implement? Computer security we usually need to have new algorithms new protocols for example in the internet when we Access websites and emails instant messaging and so on normally our data is not encrypted. There's no forms of security applied The internet protocol TCP HTTP did not have any built-in security mechanisms New protocols have been created like add-ons To add the security features So with IP there was IP sec added with TCP there was TLS added with HTTP HTTPS was the extension and These new protocols add complexity and may even degrade the performance So that's challenging to provide the security while also Keeping things simple and making them perform well Another problem with computer security is the attackers only need to find one flaw in your system to get access If there's one hole or weakness in your laptop that they can remotely access Then they can compromise that laptop Whereas to defend The people developing software Developing the systems need to try and find all the weaknesses and and fix them before they say release the software or deploy the system For example, you're creating a new piece of software It's a network Application you allow people to communicate with across the network You need to make sure it's programmed well such that there are no ways that people can Inappropriately use your software across the network and perform an attack. So in theory you need to find all the bugs That lead to attacks Whereas if you miss just one of them, maybe the attacker can use that to perform the attack So it's easier for the attacker than the normal user Another problem with computer security is that the users the end users that use the computer network computer systems And even the people managing the computer network and systems Often don't need don't see the benefits of adding security until a failure occurs You say you love my lectures. So do you have any questions at this stage? No, the quizzes too easy Okay one of the problems with security is that if there's If we deploy security systems in a network or a computer system often it may inconvenience the users and the users don't know Well, why are you adding this security feature? What's the benefit of making the passwords? Long so the users may not be aware of why a long password or a password with different characters is really of benefit and They don't really become aware until someone hacks into their account and Steals all their personal data or their the private photos or their money so failures the the main things that Lead to users to be aware of the the benefits of security, but that's too late So that's a challenge last one It's often thought of making things inefficient and Not user-friendly and I think you will know examples of security techniques like password checks Encryption often it's hard to use it makes the normal system harder to use and it may slow it down So that's a challenge to convince people to accept those impediments To keep a system secure So we'll like see examples of these and I think you're aware of some as we go through the course So let's keep going and introduce some terminology about some different concepts of computer security and Over these two slides. I think there are six different terms will introduce and we'll see the relationship between them First in a computer system. We talk about assets the things that we want to protect so the user of a computer or a computer system and when I say a computer system it could be an Individual computer it could be a network of computers across a building or a campus or across the globe So it's not just a single computer So we want to protect system resources and there are four types of assets or resources we distinguish between hardware We'd like to protect the hardware that people cannot get access to that hardware or use it in an inappropriate manner software We'd like to protect that the software running For example, can the integrity of that software cannot be compromised if I run a web server on my computer web server software that web server Software responds to requests from people out on the internet if the software itself is compromised and does something Unexpected then that's a problem. So we'd like to protect that software. So software is an asset data the information we store as an asset and The communication lines so the links between computers to form a network. We also treat as assets So we'll see I think a table later giving some examples of those four assets But now the four types of things that we want to protect with computer security we talk about vulnerabilities These are weaknesses in the system so some weakness in the hardware or software that can potentially make an attack be successful and Let's go direct to the example to see those Definitions are corrupted leaky and unavailable. I think I have one. I hope so Here's the four assets Actually, no, I'll go back Go through the terms and then give the example so Corrupted leaky and unavailable So an asset which is corrupted doesn't do what it's expected to do for example software Which is corrupted the software doesn't do what it was in program to do. That's a problem Leaky means that that asset reveals information It leaks out information and that compromises the confidentiality So if we talk about our communications line and we say there's a vulnerability in the communication line such that It leaks information then that's a potential problem for example, it our communication line could be a wireless link from my laptop to the access point in the back of the room and That inherently leaks information in that people nearby can capture the packets that I send and See the information I'm sending to the access point and out beyond on the net the network So that's a vulnerability an example of a vulnerability and some vulnerabilities can make assets unavailable a Vulnerability in hardware may mean that that hardware no longer works. It's unavailable for the normal users So systems unfortunately often always have or I think all systems may have vulnerabilities Vulnerabilities arise because it's complex and creating those systems complex to write software without bugs complex to build hardware without flaws Complex to keep track of data. So there are often vulnerabilities It's hard to avoid them. We'll talk about a security policy an organization a University a company your your in your side your home You may have a security policy and the policy is a set of rules and practices That specify how the system provides the security services So how do we protect the assets? So we define a set of rules to do that a simple example is With SIT an educational institution. We have policies for who can access student data So this is about confidentiality For example, can you access the grades of other students? No, a student cannot access the grades of other students. That's a policy. That's a rule that we try to implement As one student should not be able to see the grades of other students another policy may be a faculty member Can only see the grades of the students they teach or the students they advise They cannot see the grades or the the contact information of every student So there are a set of policies that we have to run the business and the security policies they Define those rules and then we will use techniques to try to implement those policies. How do we? Make it such that a student cannot access the grades of another student where we need to implement some Some controls in the website the registration website such that a student when they log in cannot see the grades of other students So it would implement techniques to will use techniques to implement the policies threats Potential violations of the policy. So we have a set of rules So student cannot cannot access the grades of another student a threat is if something can allow a student to Potentially access another student's grades that would be a threat for our system and That's usually performed by exploiting a vulnerability if there's a bug in the web system that provides the grade access a Vulnerability then that presents a threat. Maybe a student can access other students grades and When a threat is carried out That is someone does use that vulnerability to access other students grades. That's called an attack So a threat is something that may go wrong an attack is an attempt to do wrong an attack Maybe successful or failed and a successful attack Leads to a violation of the security policies. So a successful attack Maybe if a student can log in and see other students grades Due to some bug in the the registration system We will see later some examples of attacks, but we often classify the types of attacks The active and passive will to I'll describe later. They'll make sense from the examples But inside an outside attack an inside attack is initiated by an entity that is allowed to access the system For example a student inside SIT is allowed to access the registration system if they perform the attack We can say that's an insider attack an outsider attack is someone from someone Unauthorized so someone outside of SIT who doesn't have a login account Performs an attack to access student grades and that's called an outsider attack and When we talk about access control and logins and passwords would would distinguish between authorized and unauthorized access Account a measure is a way to deal with an attack and There are four approaches to deal with attacks. We either want to prevent them Stop them from happening in the first place If we can't prevent them at least detect them So if we've got no way to prevent the attack from happening when it does happen Detect ah, there's an attack taking place and if we can detect we can respond Maybe we can close down the system temporarily and Eventually recover restore data from backups and so on so countermeasures are ways to deal with an attack unfortunately, even if we have countermeasures then Vulnerability still may exist leading to risk to assets. So our assets are the things we want to protect because of the threats there are risks to those assets and Our aim in computer security is to minimize the risks We accept that there may be attacks. We want to minimize the risks involved and And people do risk analysis of security systems and try to prioritize what are the highest risks and What is the highest levels of impact of those risks to see how to? Improve the computer security this picture tries to connect those six concepts together We say that where can we start the owners of the computer system of The the network the data want to minimize the risk involved So what they do is they use countermeasures they impose countermeasures to try to minimize the risk There are threat agents threat agents are Entities that may initiate threats and perform attacks so they give rise to threats and threats increase the risk The threat agents try to damage the assets. So we talk about the assets that we have Because the assets have value to it the owner of the system. We want to protect the assets the threats on the assets and can lead to attacks so let's Look at them from a different perspective more again threats attacks and assets So today or what we're trying to do or in this topic is to go through a selection of Concepts that we use in general in computer security in the next topics. We'll look at the techniques that we use To provide the computer security Here's a different classification focusing on threats and looking at the consequences of threats and attacks So we're distinguished between a threat in here different notation a threat action is called an attack a Threat agent is someone that performs an attack Or as a threat to the system So the other name for a threat agent may be the attacker An adversary a malicious user. What's another name for a threat agent that you hear What do you call someone who breaks into a computer system? What have you what are they called if you hear in the news someone broke into a computer system? What would you call them a hacker? So sometimes we? Referred to the threat agent as the hacker It's just that in some systems or in the past the hacker was used to refer to people who build things with computers and hardware So not necessarily a malicious person in this course. I'll usually just talk about an attacker or a malicious user Note that in some cases they don't need to be bad the attacker for example It may be a legitimate operation to attack a computer system like law enforcement the police They perform an attack on a system. They have the legal authority to do so and they're doing it for good So when we talk about the attacker, it doesn't necessarily mean they're a bad person It's just saying that with respect to the computer system. They are the adversary trying to break the security a threat consequences The what goes wrong what happens as a result of an action? so people have tried to give definitions of these and There's a what's called an internet security glossary. You can find it from this link. There's a new version and It classifies different types of threats and attacks as these sets of unauthorized disclosure deception disruption and usurpation and It goes through and gives details of them and if you Hopefully flick through a few slides. You'll see that document or a cut-down version. Let me see if I record it Yes, if you go to Page 25 on your handouts, you'll see I've included the list of these threat consequences From this document. So I want you to read them. I Will not read them all today. I will just highlight some of them and just explain what it's showing It's really just classifying threats and attacks giving them different names So the first consequence is unauthorized disclosure So it says a circumstance whereby an entity gains access to data Which they're not authorized to do so they get access to data when they're not authorized to do What causes unauthorized disclosure what actions cause this or they classify the action of exposure and They give some examples really of exposure Could be deliberate exposure That is Someone gets access to the data and deliberately gives it to other people Publishers are on a website so that anyone can access Human error Sometimes it may not be a malicious action. Maybe a normal user Access is a confidential document within say SIT and Then makes a mistake some makes that confidential document available to people outside Due to some permissions problem or some human error. They send the email to the wrong destination so that's an example of exposing information and Leading to unauthorized disclosure So what this document does is classifies the different consequences of threats what can go wrong and some actions that lead to those consequences Interception is about Getting access to data as it moves between two points Usually cross a network We can intercept data in a Wi-Fi network for example When I send a packet from my laptop up to the access point the nature of Wi-Fi is that packet signal is Broadcast in all directions and you can sit with your laptop and intercept get a copy of that packet So that's an example of interception So you can do it in wireless network so you can physically access wired communication links and perform theft of data So obtain for example the solutions to the exam or the exam questions as I send them across the network to someone to print and You can do monitoring of systems called wiretapping emanations analysis is about looking at The signals being sent and observing about who's communicating and what they may be doing One example, I think we won't get time to cover this semester was that people can use They can use microphones To listen in to the operations that a CPU performs when it encrypts data and Use that to determine secrets secret keys so that they can decrypt data So there's been studies where people for example someone is encrypting data on a laptop and they place Essentially an antenna that listens in to the CPU the CPU makes a noise or the computer makes a noise when it does things Very very quiet noise But they can distinguish between the different noises when the CPU performs different operations and from that Steal secret keys from that laptop That's an example of emanations analysis. What's emanating out of the laptop is analyzed to obtain secret information Have a read through the others, then there's the threat consequence of deception Deceiving someone using false data or something that people believe to be true masquerade means pretending to be someone else falsification using false information Replacing valid data with false data Repudiation is denying something's taken place Deny the origin of the data or deny the reception of the data So non-repudiation is the service of stopping that disrupting services disrupting data corrupting data corruption and Usurpation is about Stealing information misappropriation or misuse theft of service for example an Example of this theft of service is that you are not an SIT student or Employee, but you sit outside you work from somewhere else You sit outside and use the SIT internet access you log in you get it via some Floor allows you to access the internet via SIT's Wi-Fi. That's an example of theft of service The service is the internet service being provided for SIT Students and staff if someone outside uses that then that's Misappropriation So some of the terms you may have heard of already what I suggest really is just read through those and You don't have to remember all of them But be aware when they come up in in the rest of the course what they mean in a moment We'll get to specifics about network security and and look at some examples of attacks, but before that Here's a picture that tries to cover. What do we what is the scope of computer security? First what does it show that the blue boxes are some computer systems some computers for example Whether it's a single user computer, but most likely a multi-user computer and what's a computer? Well some hardware running some software in this case shown as processors software processors the circles and accessing data So we think about computer systems some hardware that runs software and that software accesses data and We may have multiple computer systems that communicate with each other via some communications line or network and Then we have the users These two circles are outside of each of the boxes So there are different aspects of computer security and what will cover in this course some of the things Often the users the human users make requests for the data By using the software Before they can use the computer system often will have some guard technology that will Control who can use that computer system? So the this item point to the access to the computer facility must be controlled and user Authentication is one of our early topics and one Authentication technique, you know of his passwords How do we ensure that the student that accesses the computer system is in fact an SIT student? Well, we give them user names and hopefully unique and passwords that only they know So that's user authentication and that's one of our topics Once the user is allowed to access the system another thing we want to do is we have different pieces of data We want to control what software can access what data? so we may have access controls on the files and We will see some examples of that will look using Linux as an operating system Example when we look at access control where we set permissions on files Can you read a file who can write a file who can execute a file? Some data is sensitive and needs to be kept confidential so we can use encryption To encrypt the file so we'll look at some techniques for or the different encryption techniques and When we send data between computer systems, we need to ensure that that Data is securely transmitted. So we'll look at some aspects of network security How do we encrypt data across the networks and how are we sure that who we're communicating is? Is who they say they are? So that four areas of computer security will look at in this course The last one before we look at network security. This just gives an example of the four assets and The three security concepts our objectives of confidentiality integrity and availability and Examples of threats against those assets grouped by the concepts for examples Let's not go through all of them Our asset of data like files that we want to protect Confidentiality if someone can read the data when they're not supposed to then that's a threat on that data So a threat on the asset of data is someone can read the data when they're not supposed to or analyze Which files you're reading and accessing that's a threat on confidentiality a threat with respect to integrity is that someone can Access the existing files and modify them without us knowing So that modifies the integrity of the file or create new fake files and The threat on the availability of that data is that the files may be deleted Denying normal users to access the files So there are threats on the asset of data and those threats can be against the services of Confidentiality integrity and availability so for today trying to pick up on some of the terminology we use and Come back to refer to that as we go through the course one aspect of Security is network security So what we want to do is look at some some attacks and some services that we want to provide usually in network security communication security here Just as a reminder make sure you you read through the course website So you've got two homework tasks at the moment read the course website and read that threat consequences and actions document That's to come work so far for the next week On the course website you'll see that we have different assessment items to exams We'll also have some online quizzes, and I think most of you have taken some of my online quizzes before and In fact a few students said that they're a bit easy last year last semester We'll address that in a moment So with respect to communication security There are different people different definitions of what it means In this course, we don't care too much about where the definitions come from but an organization called ITU has come up with a standard very old now and they Defined or separated into attacks mechanisms and services and That's what I want to focus on now talk about different attacks on networks We were talking in this course about the mechanisms We have available to try and prevent the attacks and detect the attacks and the set of services that we try to provide in network and communication server security So let's go through the next slides and look at attacks mechanisms and services a security attack is Some action that tries to compromise the security of our information or facilities. We've mentioned attacks already a Mechanism is it a method or technique for stopping the attack? preventing it if we can Detecting it if we can't prevent it and if we detect it to recover One example of a security mechanism mechanism is encrypting Before we send the data across the network. We encrypt that data to try to prevent the attack of someone intercepting and releasing the contents We will talk about and list six security services Which use a selection of mechanisms to try to prevent the attacks stop the attacks So in the next slides we'll go through some attacks and list some key security services and that may finish for today Yet the security services they the ones that I'm using come from some different documents and some textbooks They are listed there But what is a security service? Well? We said that we have security policies rules that the organization tries to implement to keep things secure Well, they select security services to implement the policies and The services are implemented by security mechanisms So the policy against one student cannot access the grades of other students We need to select from one of our upcoming security services to implement that policy What security services? Well, here are the six key security services and this is a good one to remember for quizzes There's always questions. What is non-repudiation? What's the difference between access control and availability? Let's go through the six security services These are things that we commonly want to provide in network security and in general in computer security as well and I'll go in a slightly different order will go with the ones that are maybe easier to understand Data confidentiality We often want to make sure that the data is kept secret or confidential. So that's a security service Protect unauthorized people from accessing the data data integrity We often want to make sure that the data Cannot be modified along the way in a network, especially we send a message from a to be We want to make sure that the message be received is exactly the same as what a sent That someone in the middle didn't modify the message So data integrity is about ensuring that the data received is exactly the same as what was sent by an authorized entity authentication up the top is about Ensuring that the people we're communicating with are who they say they are You receive a message from someone you want to make sure that the source is the right person who they're saying they are They're authentic We will look at Techniques for providing data confidentiality data integrity and authentication and the techniques are built on cryptography so the next topic is Cryptography and introducing encryption and other cryptographic techniques which are used primarily for data confidentiality integrity and authentication the other services Access control is about preventing unauthorized use of a resource and two examples. We'll see in this course. One is firewalls a Firewall is a device in the network that controls who can access into a network and Also, maybe who from inside the network can access out and what they can access You may know in in SIT. We have a firewall And one thing that that firewall is configured to do we have some internal servers in SIT Database servers for finance department and staff to use just inside SIT So the firewall is set up that is if anyone outside of the SIT network tries to access one of those internal servers They are blocked from doing so So that firewall provides network access control It may also be configured to stop internal users from accessing outside resources For example, stop all students from accessing Facebook So the firewall could be implemented to do that. So that's access control The other form of access control. We'll see an example of is access control on files on a computer Many computers nowadays are multi-user systems. There's not just a single user that uses the computer There are multiple people that use the same computer So when multiple users use the same computer, we want to control who can access which files you shouldn't be able to access anyone else's files and Some of you may have logged into the ICT server you have accounts on the ICT server and Access control is used to ensure that one student cannot access the files of other students We'll look at how that can be done the last two services Availability making sure the system is available and usable The best way to think of that is from the attack perspective a denial of service attack is making a system unavailable and Non-repudiation I've mentioned before is protecting against people denying something took place To main things in the network protect against people denying that they've sent a message and The denying that they've received a message So that's what non-repudiation is about In different computer systems and networks. We may select from these services to try to implement Sometimes we don't care about all of them So we'd select the services that we want to provide to our users from that set and then for those we'd use different mechanisms So the last thing for today I think is to look at some example some classification of attacks on communication lines or in networks in general And we'll go through six types of attacks Then they're grouped into two sets So there are two attacks which are considered passive attacks and then four attacks considered active attacks So there are six attacks in total Two will be passive for active. I will not explain passive or active until after we've gone through some of the attacks So let's look at the attacks of release message contents traffic analysis and the four down the bottom and Then we'll compare passive versus active First attack and here's any picture from a textbook that uses three users To illustrate the attack we have Alice and Bob Two normal users of our computer system our computer network Bob wants to send a message to Alice. That's the normal behavior here And we have a malicious user our attacker Daph and This attack of releasing the message contents is the one that we often Think about when we think about computer security is that if Bob sends a message to Alice If Daph can intercept that message as it's passing through the network and See the contents of that message then that's an attack Essentially the contents of the message sent from Bob to Alice We're only intended for Alice So if someone else can see the contents then we say that the contents have been released to others to unauthorize users a Simple example of where that can happen. I've used before is when I send something using Wi-Fi on my laptop. I Send it to a web server in the US Then that the packets containing that information go from my laptop wirelessly up to the access point on the back of the classroom Follows them cables down to the third floor and to the computer center and then goes out through our internet service provider to some routers And it goes probably up to Maybe up to Tokyo then across the Pacific Ocean to the US so my packets containing the data travel through many links to get to the destination and An attack of releasing the message contents involve someone on any one of those links or the devices in between Accessing those packets and reading those packets a Simple one that you can perform is when I send packets to the access point You can use your laptop to wirelessly capture those packets and and see the packet that I've sent or If you're a little bit more devious Maybe what you could do while I'm not in the room You'd plug a special device into that access point where the cable goes in and then plug it into your laptop such that every packet That goes to that access point Is also sent to your laptop It would be hard for someone to see that you would hard to see the cable there and that could intercept all the packets going via that access point so if you can Access via the wireless network or get physical access to a wired network. You can intercept messages sent sent through the network And that's what it would involve Darth doing How do we stop that? How does Bob keep his message content content secret before Alice gets it? What do we use? encryption You you use it on a regular basis when you use HTTPS to access a website What happens is your web browser encrypts the data before it sends to the web server So even though someone may intercept on that access point all they see is the encrypted form of your data and They need the key to decrypt it and if it's set up correctly, they should not be able to find the key So we'll see is encryption is a key part or a key technique for preventing this attack Encrypt the data before you send it If we do encrypt the data, there still may be attacks possible and one is traffic analysis Let's say the message that Bob sent to Alice Alice and Darth are married Okay Husband and wife Darth and Alice Bob is not married to Alice, but was sending messages love messages late at night So what Darth is trying to do is intercept and see whether his wife is having a affair with with Bob And if Bob doesn't encrypt his messages Then it's very easy for Darth to intercept and see that Now let's say Bob smart and he does encrypt his messages And he's still sending his love messages to Alice late at night So traffic analysis is about Darth our attacker here not reading the contents of the messages but analyzing The frequency of the messages the time of day the size of the messages and in referring from that information, what's happening? So maybe Darth Can intercept the messages all he sees is encrypted messages But what he sees is at 11 p.m. On a Friday night Bob is sending many messages to Alice when He shouldn't be and from that Darth may infer that something something's gone wrong So traffic analysis is about analyzing the patterns of communications not looking at the data but how often people communicate when and with who as well another example may be Alice and Bob represent well Alice is a known terrorist known by the law enforcement agencies and The law enforcement agencies Darth are monitoring the communications to that terrorist and And the encrypt the data is encrypted that's going between Bob and Alice but what the law enforcement agency does is by monitoring how often the messages are being sent from some other user Bob to the Known terrorist Alice they can infer some other information about what's happening and maybe use other techniques to to then trace Bob and find out who he is So this is not about looking at the data, but looking at the patterns of communications any questions So far in our first two types of attacks releasing message contents and traffic analysis Many students know that we have some online quizzes and people have been sending me emails Let's see Send me emails about the discourse and they want to have more quizzes and harder quizzes so that means that we should have harder quizzes maybe so Quizzes were too easy last semester and some students were copying. This is reported from a student Okay, so other students are reporting Who's who's copying who sent this email? Okay, who sent this email just then 1148 okay, so that means I should make the quizzes harder Okay, so thanks for the feedback What's happened? Did you send the email just one minute ago? No This is a masquerade attack. The next type of attack is where someone pretends to be someone else Here I have received an email and The from address of those emails indicates it's from some of the students in this class But if you ask those students, they didn't send those emails. It was someone pretending to be those students and the point here is that With email it's very easy to pretend to be someone else by changing the from address So what actually happened is I using a different account sent the email to myself But I set the from address of the sent me messages to match that of some of the students So it looks like it's from some of our students, but in fact, it's from someone else Emails are easy. It's easy to set fake source addresses for emails So you can't trust the from address and that's an example of a masquerade attack to pretend to be someone else masquerade so in this case Alice is the normal user in different case Alice Bob is the the director of the company He's the boss and Alice is the finance officer. She Determines or she Sets how much everyone gets paid every month and what happens is each month Bob sends a message to Alice saying who gets a pay rise and who doesn't And what Darth does want to employ employee? He sends a message to Alice saying please increase the salary of Darth by ten thousand bar signed by Bob so if Darth the attacker sends a message pretending to be Bob Then in this case it may get Alice the finance officer to Inevitably increase the salary of Darth when he shouldn't when she shouldn't have So this is easy with emails if you trust the from address as we just saw It's very easy to send an email with a fake from address to anything you did like so Considering emails, how could we stop this from happening when I get an email from someone? I look at the from address. How can I be sure that is from that person and not someone pretending to be them? Given that we just thought it's very easy to do a fake address Because we need such techniques when we're doing business doing financial transactions We'll look up. There are some encryption based techniques that allow us to do that. So encryption plays a role in Allowing someone the receiver to verify when they get the message Even if the from address is fake they can verify. Is this true or not? So digital signatures are one approach and it's based upon some encryption techniques will go over in the next topic So that's a masquerade attack pretend to be someone else Don't do it. Don't send me emails from other students just because I did doesn't mean you should and The famous comic that says that captures that is on the internet Nobody knows you're a dog because on the internet again. There are no inbuilt mechanisms That easy allows to verify who's sending something. So when you're communicating with someone by email or accessing a website or via chat How do you know that the person at the other end is not a dog? three more attacks to finish today a Replay attack again Alice is the finance officer Bob is the director every month He sends an email to the finance officer saying increase the salary decrease the salary Last month Bob sent a message to Alice saying Increase the salary of Darth by 10,000 baht. That was a valid message Darth did well That was just for last month though and it shouldn't be increased again this month just for last month But when Bob sent that message Darth intercepted that one the old one and he recorded a copy of that message and Then this month Although Bob doesn't send a message to Alice saying increase the salary Bob replays the old message so that this month Alice receives the old message and Thinks that it's another request from Bob the director to increase the salary of Darth by 10,000 baht And now he's salaries gone up 20,000 baht in two months. So a replay attack involves an attacker Recording a copy of an old message and then resending it to perform some harm How could we prevent such an attack? Or detect an attack How could Alice detect that this message is a replay of the old message What would Alice need to do to do that to know that this is the this is the same as the old message You're going to need to implement these mechanisms. What would you do? How do you detect something's old? Date a timestamp so include the date and time on the messages being sent So every time Bob sends a message the first one was dated from last month if Darth replays that exact same message It would have the old date on it. So what Alice does is checks are the date of that message I just received is one month old. I'll ignore that Now we need more than just the date. We need to have some verified date Some date that Darth cannot modify So we need more that we'll see again encryption and timestamps play a role there Modification Bob sends a message decrease the salary of Darth by 10,000 baht before it gets to Alice Darth intercepts that message and changes DE to IN Instead of decrease to increase and forza on to Alice It originally came from Bob Alice trusts the message and increases the salary by 10,000 baht So by modifying the message before it gets to the destination. That's another type of attack Again, we need some way that the receiver can verify that the message we got Came from the right person and hasn't been modified Denial of service. There's no Alice in this case. We have a server a web server for example Which Bob normally accesses to get his job done But Darth is overloading that server may be sending many packets to the server so that the server slows down and eventually cannot respond to Darth's requests This is a denial of service attack in that Bob is denied access to the normal server And that's inconvenient or causes problems for Bob And denial of service attacks will look at in one topic and turns out in they in a number of cases very hard to stop Okay, very easy to perform from the attackers perspective. We have a topic on denial of service attacks We listed six security services Authentication data integrity Good data confidentiality access control availability and non-repudiation remember those six we've gone through six types of attacks and Maybe tomorrow we'll talk about the difference between passive and active But how do we stop the attacks? We use security mechanisms and there are many different types of security mechanisms But importantly most of them use cryptography So our next topic We'll cover cryptography and we'll talk about encryption or enceiphament digital signatures Authentication exchanges and so on in cryptography That lists some of the mechanisms that we'll cover but not all They'll come clear when we go through cryptography Let's stop there tomorrow. We'll talk about passive versus active and finish on computer security strategy before we look at cryptography