 We've gone through some of the concepts of computer and network security and we looked at six different attacks on network or communication security and they come up in computer security as well, releasing the message contents, which is really just, sometimes we say we intercept other people's data and see the data when you're not authorised to see it and traffic analysis, analysing the communication patterns, so not necessarily looking at the data but looking at how often you send messages, who do you send to, what times you send them and from that inferring some other information. We gave an example yesterday with that email that I sent or that the student sent to me, we showed that it's very easy to do a masquerade attack with many internet applications, there's no checking of who the real sender is, so with the email it's very easy to send an email with the fake from address, so if someone just checks the from address, they can be confused or tricked into thinking it's a message from someone else, so a masquerade attack. Replay is resending an old message to get some benefit, modification, modifying messages, so intercepting a message, not letting it go through to the destination but first modifying it and sending on the modified form, and denial of service attacks where someone overloads a server or causes a server to operate such that the normal users cannot access that server, they denied access to that service, so we saw an example of a masquerade attack, we have one topic that talks about, one lecture that talks about denial of service attacks and we'll see some examples there and over time we may see some of the others but just before we move on, a simple example of releasing the message contents, that is two users are communicating for example I'm going to communicate from my tablet in Bob's position to a website and access that website and then via my laptop I'm going to try and intercept those messages and see if I can see what the two users are communicating and it turns out it's quite easy especially with Wi-Fi, so I think most of you will do the networking lab with me this semester and in that we will do some, what am I about to do now, we'll learn the commands of how to intercept Wi-Fi traffic, I'm not going to show you the commands I'm just going to do it just to illustrate, what I've done is, there's nothing to see yet, what I've done is I set my computer up, my laptop to record all the packets that it sees, that it receives, now with Wi-Fi when I use my tablet which is also using Wi-Fi it sends a signal to our access point in the back of the room here or in the room behind me and the nature of most wireless transmissions especially for Wi-Fi is that signal goes in all directions, so when the signal goes from my tablet up to that access point the physical signal is also received by the antenna on my laptop and all I've done is configured my laptop such that any signal it receives record a copy of the packets contained by that signal, so when I send something and I'll access let's say the ICT web server, of course you cannot see it but on my tablet if I access and you can access the ICT web server on your phone and maybe I'll capture your packets as well, it's very hard typing, if I access the Moodle website or other websites on my tablet and I suggest if you have your laptop open access some different websites or your phone, you need to be using in this case the Wi-Fi, so WSIT and what my laptop is doing is trying to record everything that everyone else is sending, now let's see if this works, so I've been recording and I'll open some software of the record, I'll stop the recording and then show you what I see, this is a record and it's hard to see at the moment, this is a record of all the packets that my laptop recorded over the last couple of minutes, I was recording that when I started in the lecture and there's I think hundreds of thousands of packets have been recorded, they were not sent by my laptop, they were sent by other people nearby, including you, including my tablet, now there are many packets there and I don't have time to analyse them all, so I'm going to look specifically for my tablet, I don't want to look at your packets because that would be a bad thing to do, so my tablet had an IP address of 10.10.102.250 and filter out those 260,000 packets and get a subset of the packets, that was the packet sent by or received by my tablet using the Wi-Fi and there are many of them there, let's see if we can get something that we can recognise, put it out and just see the HTTP messages because I was using the web browser and specifically let's see if this works, TCP port 80, two equal signs and there's nothing there, hang on, as always with demonstrations in a network there's always something that will go wrong, let's see some packets first and see what we can see from others, let's look for some HTTP messages, some of these are not relevant but if we scroll down I'm sure we'll find some that you may recognise, one more try before I give up, here we go, here you may recognise some of them, these are HTTP messages, focus on I'll scroll down in a moment, these are get requests, if you recall how HTTP works the browser sends a get request to a server, get this web page and here I've recorded from other people's computers in this case from my laptop they're getting different pages and I will not look too closely as to what websites you are browsing but you'll see many requests for different websites and if we look in the detail of those we can actually see this was accessing Instagram for example so this was from a web browser or an application probably on someone's phone or tablet that was accessing Instagram to look at photos or to post photos and that was done by computer which was not my laptop in fact was not my tablet in that case it was computer on the SIT network with IP address 10.10.103.115 possibly one of you or it could be someone out nearby so the point is it's very easy with Wi-Fi to perform an attack where you release the message contents because I now as the attacker see the contents of the messages that other people are sending in the vicinity if we're using wired networks it's much harder for me to do that I need physical access to the wires but still possible so that's to illustrate that even though I may not have captured my tablets packets I need to search closer it's very easy to do a release the message contents attack and from that you can also do traffic analysis because from those 200,000 packets I just captured in a matter of several minutes I could then start analyzing and see which IP address sent to which other IP address which IP address sent to which websites at what times of the day did they do that and then if I could map back and find that this IP address belongs to this student I can now start analyzing what that particular person did so again a traffic analysis attack is quite easy we saw yesterday a masquerade attack was quite easy with email also with other services and in fact the replay and modification attacks are related to those too so they're a little bit more complicated to get them working well because you need to intercept before it gets to the destination but possible the point is it's easy in many cases for these attacks to take place therefore we need strong techniques to prevent them or detect them and that's what we'll get on to with the next topic so we listed some security services that we want to provide to try and prevent or detect attacks and how do we provide those services we use a set of security mechanisms and many of the mechanisms are based upon cryptographic techniques so what we're going to talk about in a moment is what are those cryptographic techniques encryption is the key or a very important technique the last couple of slides very quickly we can say with regards to a strategy for computer security or a set of principles normally what we start with for an organization or a set for a user we set up a policy what's our aim in terms of securing our computer system what are we supposed to do with the computer security techniques so we gave examples yesterday a policy for SIT one student cannot access the grades of other students and many other set of rules usually informally stated that we have an idea of what we want to achieve and in fact there may be many different rules that we want to define in setting up a security policy an organization needs to consider what are they trying to protect we said there are four types of assets software hardware data and the communication lines so which ones are the most which ones of those are the most important to the organization say for SIT the student grade information and student contact information is an important asset we shouldn't release it publicly the financial information of an organization is an important asset the software that we run on service is also another asset so we have a number of assets we want to protect and we need to consider which ones are most important try to allocate a value to those assets we need to try and consider what are the vulnerabilities what can go wrong how could someone get access to those assets when they shouldn't not supposed to what are some threats and what's the charts of a tax taking place what's the consequence if one student does get the grades of another student what happens then do we lose a lot of money or does a student get upset or something else happens and what's the probability that a tax will take place so an organization should consider all of these factors to come up with a security strategy and they often need to consider trade-offs like implementing security mechanisms to implement the strategy versus making it easy for the users to use the system and many of the security mechanisms will have a cost involved a direct or an indirect financial cost so we need to consider well what's the cost of implementing those security mechanisms versus the cost of an attack taking place us failing and having to recover so sometimes even though we should implement a security mechanism that may have a very high cost and it may be a cheaper option not to implement it and just recover if some attack does take place so that's what the policy tries to identify those trade-offs then the organization will implement a set of mechanisms to try to complete that policy and they would focus on how to prevent detect respond and recover to attacks and we'll look at techniques for implementing and then they need to do assurance they want to have some confidence that the techniques have used will work as intended and they want to do some evaluation to make sure that the techniques are working it's no good to implement the security mechanisms and then find out that they don't achieve our original policy ideas we will not cover these details of security policies in this course but be aware that there are a number of ways to develop a security policy for an organization doing risk analysis identifying the trade-offs and doing assurance checks to make sure that implementations work correctly we will stop this topic there are some information security principles listed there but they probably don't make much sense to you until we explain each of them I'll later provide you a document with a definition of each but I think as we go through the next few topics we'll come back and some of these principles will be identified especially things like privileges least and separation of privilege privilege open design we'll see when we talk about cryptography defense in depth so I'll explain them as we go through the next few topics not now they actually come from another document from NIST which I'll have a link to on the course website so that finishes our introduction to security in summary we want to achieve the objectives normally of confidentiality keeping our data secret integrity making sure it's not modified without permissions and availability making sure our computer system is available to the users and we want to protect different assets and there are a range of different attacks so far we've identified six different attacks releasing the message contents and traffic analysis and for what we call active attacks I think I didn't say the difference between passive and active maybe I should say it now passive attacks involve the attacker doing something that doesn't modify how the system works the attacker is passive and they don't need to make changes to the traffic in the network they don't need to send extra messages they just sit there and listen an active attack involves the attacker making some changes to how the system works for example they modify a message they inject a new message so the difference between those types of attacks passive and active is passive the attacker does not modify how the system works active is the attacker does make some changes the the significance of comparing the two is that passive attacks are usually easy for the attacker to perform and hard to detect whereas active attacks are easy to detect so the approaches that we use to defeat those attacks usually passive attacks we need to use techniques in advance to prevent them whereas active attacks we use techniques to detect them and we'll see that as we go through some cryptographic techniques we also said that we can talk about inside or outside attacks depending on who's doing the attack we mentioned that there are countermeasures or security mechanisms they are the techniques that we will use to implement the the security services so they will be the techniques to prevent detect recover from attacks and the prevention and detection in particular usually use cryptographic techniques encryption especially so the next topic we'll look at those cryptographic techniques am I finished there's two more slides I will not go through these most of the lecture topics I'll include two or three slides at the end giving some other areas that you may explore if you're interested you can explore on your own like different organizations which we involved in computer security and in some other sides you may see some future issues or research issues that that can be considered we can discuss maybe outside the class if you're interested