Cyber Security - Brookdale Community College

collarlimabeansΑσφάλεια

23 Φεβ 2014 (πριν από 3 χρόνια και 8 μήνες)

69 εμφανίσεις

Cyber Security



By

Dr. Robert Statica

CCS Internet Operations Manager

Associate Director of Cryptography &
Telecommunication Laboratory

College of Computing Sciences

New Jersey Institute of Technology

Email:
Robert.Statica@njit.edu

www.ccs.njit.edu/statica




Robert Statica


Cybersecurity

Cyber Security



The events of Sept. 11 2001 proved that terror attacks
on nonmilitary targets could be crippling to our
national infrastructure.

A week after the first anniversary of the day that
changed everything, the White House released a 60
-
page draft plan called the National Strategy to Secure
Cyberspace, which also points out that US businesses
-
-
and individuals
--
are potential targets for cyber
-
terrorism.

The experts say we can't rule anything out, but are
advising us to be realistic.


Robert Statica


Cybersecurity

What is Cyberspace?



Cyberspace is a worldwide network of computers and
the equipment that connects them, which by its very
design is free and open to the public (the Internet)








As Stanley Konter, CEO of Savannah's Sabre
Technologies, notes, "The problem has gotten more
prevalent with always
-
on, high
-
speed internet access.
Attackers are always out there looking for that type of
computer."


We've become increasingly
reliant on the net, and it's
being used right now to
transfer everything from
friendly emails to
hypersensitive data.

Robert Statica


Cybersecurity

What is Cyberspace?



Konter is referring to that fact that as long as your
computer is connected to the internet, that connection
can go both ways.

The attackers are mostly malicious pranksters, looking
to access personal and business machines or disrupt
net service with virus programs proliferated via email,
usually just to prove they can.

However, there are also more serious attackers out
there whose goals could range from mining valuable
data (your credit card or bank information, design
secrets, research secrets, etc) to even disrupting
critical systems like the stock market, power grids, air
-
traffic controllers programs, and the most dangerous
-
our nuclear weapons


Robert Statica


Cybersecurity

Cyberspace as a Battleground?



Each day, there is an increase in the number of threats
against our nation's critical infrastructures.

These threats come in the form of computer intrusion
(hacking), denial of service attacks, and virus
deployment. Because of this problem, the
National
Infrastructure Protection Center (NIPC)

was created.

Located in the
FBI
's headquarters building in
Washington, D.C., the NIPC brings together
representatives from U.S. government agencies, state
and local governments, and the private sector in
partnership to protect our nation's critical
infrastructures.


Robert Statica


Cybersecurity

What are the Threats?



Q:

What's the biggest cyber threat facing America
today? Organized terrorism, or a bored, curious
kid?

FBI:

At this point it is difficult to quantify since
computer intrusions occur daily originating from
several sources. The origination of these intrusions
and the intent of the intruders is often not obvious.


These threats come in the form of:

1.
Computer Intrusion (hacking
-
passive or active)

2.
Denial of service attacks (DOS)

3.
Virus & Worms deployment.




Robert Statica


Cybersecurity

State of the Industry


According to the 2003 Computer Security Institute
and FBI annual study on security, 95% of
respondents detected computer security breaches in
the last 12 months.






Companies will spend nearly $24 Billion on network
security in 2004 and it is expected this amount could
triple in the next two years.


Robert Statica


Cybersecurity




The British security consulting firm mi2g
calculates that the number of malicious hacking
attacks worldwide jumped from about 8,000 in
2000 to 31,000 in 2001, and projects attacks to
exceed 60,000 in 2004.





Cyber Security Risks

0
10000
20000
30000
40000
50000
60000
2000
2001
2002
2003
Attacks
Robert Statica


Cybersecurity

Clean up cost of Cyber
-
attacks







SirCam: 2.3 million computers affected



Clean
-
up: $460 million



Lost productivity: $757 million




Code Red: 1 million computers affected



Clean
-
up: $1.1 billion



Lost productivity: $1.5 billion




Love Bug: 50 variants, 40 million
computers affected



$8.7 billion for clean
-
up and lost
productivity



Nimda



Cost still to be determined


Virus Profiles



Nimda (note the
garbage in the
subject)

Sircam

(note the “personal” text)


Both emails have
executable attachments
with the virus payload.

Robert Statica


Cybersecurity


Trojan Horse Attack

Trojan Horse
arrives via email
or software like
free games.

Trojan Horse is
activated when
the software or
attachment is
executed.

Trojan Horse releases
virus, monitors
computer activity,
installs backdoor, or
transmits information
to hacker.

Source
-

Robert Statica, Lecture Notes Robert
Statica


Cybersecurity


Denial of Service Attacks

In a denial of service attack, a hacker compromises a
system and uses that system to attack the target
computer, flooding it with more requests for services
than the target can handle. In a distributed denial of
service attack, hundreds of computers (known as a
zombies) are compromised, loaded with DOS attack
software and then remotely activated by the hacker.

Robert Statica


Cybersecurity

Spamming Attacks





Sending out e
-
mail messages in bulk. It’s
electronic “junk mail.”


Spamming can leave the information system
vulnerable to overload.


Less destructive, used extensively for e
-
marketing
purposes.


Robert Statica


Cybersecurity

What Does it Mean
-

“Security”?







Security”

is the quality or state of being secure
--
to be free
from danger. But what are the types of security we have to be
concern with?



Physical security

-

addresses the issues necessary to
protect the physical items, objects or areas of an organization
from unauthorized access and misuse.



Personal security

-

addresses the protection of the
individual or group of individuals who are authorized to
access the organization and its operations.



Operations security
-

protection of the details of a
particular operation or series of activities.

Robert Statica


Cybersecurity

What Does it Mean
-

“Security”?






Communications security

-

concerned with the protection
of an organization’s communications media, technology, and
content.



Network security

is the protection of networking
components, connections, and contents.



Information Security


protection of information and its
critical elements, including the systems and hardware that
use, store, or transmit that information.



Robert Statica


Cybersecurity

The Need for Security


Industry Need for Information Security


An organization needs information security for
four important reasons:


1. To protect the organization’s ability to
function,


2. To enable the safe operation of applications
implemented on the organization’s IT systems,


3. To protect the data the organization collects
and uses, and


4. To safeguard the technology assets in use
at the organization.




Robert Statica


Cybersecurity


Information Security Threats







Act of Human Error or Failure

(accidents, mistakes)


Compromises to Intellectual Property

(piracy,
copyright infringement)




Acts of Espionage or Trespass

(unauthorized access
and/or data collection)



Acts of Information Extortion

(blackmail of
information disclosure)



Acts of Sabotage or Vandalism

(destruction of
systems or information)



Software Attacks

(viruses, worms, macros, denial of
service)

Robert Statica


Cybersecurity


Information Security Threats







Forces of Nature

(fire, flood, earthquake, lightning)




Quality of Service Deviations from Service
Providers

(power & WAN service issues)



Technical Hardware Failures or Errors

(equipment
failure)



Technical Software Failures or Errors

(bugs, code
problems, unknown loopholes)



Technological Obsolescence

(antiquated or outdated
technologies)




Robert Statica


Cybersecurity

Acts of Human
Error or Failure

Robert Statica


Cybersecurity

Shoulder surfing
takes many forms.

Some may not be
obvious.

Robert Statica


Cybersecurity


Traditional Hacker Profile*:


“juvenile, male, delinquent,
computer genius”

*Source: Parker, D. B.
Fighting Computer Crime
, Wiley, 1998.


Modern Hacker Profile:


“age 12
-
60, male or
female, unknown
background, with varying
technological skill levels.
May be internal or external
to the organization”

?

Robert Statica


Cybersecurity

Information Security






Tools, such as
policy
,
awareness, training, education,

and
technology
are necessary for the successful application
of information security.



The NSTISSC (National Security Telecommunications and
Information Systems Security Committee) model of
information security is known as the
C.I.A. triangle
(C
onfidentiality, Integrity, and Availability)


these are
characteristics that describe the utility/value of information

Robert Statica


Cybersecurity

Figure 3

INFORMATION

Integrity




Availability

Confidentiality

C.I.A. TRIANGLE

Robert Statica


Cybersecurity

The Dilemma of Security






The problem that we cannot get away from in computer
security is that we can only have good security if everyone
understands what security means, and agrees with the need
for security.



Security is a social problem, because it has no meaning
until a person defines what it means to them.



The harsh reality is the following: In practice, most users
have little or no understanding of security.
This is our
biggest security hole.



Robert Statica


Cybersecurity

Meaning of Security Lies in Trust






Every security problem has this question it needs to answer
first:
Whom or what do we trust?




On our daily lives, we placed some sort of technology
between us and the “things” we don’t trust. For example lock
the car, set the house alarm, give Credit Card number only to
the cashier, etc.



So we decided to trust somebody/something to have some
sort of security (trust the lock, trust the police, trust the
cashier).



We have to have the same scenario for computer & network
systems we use today.



Robert Statica


Cybersecurity


Components of an

Information System







People
are the biggest threat to information security!!!
(WHY?


Because WE are the weakest link)


Social Engineering

. It is a system that manipulates the
actions of people in order to obtain information about a
system in order to obtain access.



Procedures

are written blueprints for accomplishing a
specific task; step
-
by
-
step descriptions.

The obtainment of the procedures by an unauthorized user
would constitute a threat to the integrity of the information.







Robert Statica


Cybersecurity

Figure 5

Components of an Information System

Data

Software

Hardware

People

Procedures

Robert Statica


Cybersecurity

Figure 6

Hacker

Internet

Remote System

Computer as Subject of Crime


Computer as Object of Crime

Robert Statica


Cybersecurity

Access vs. Security







When considering security it is important to realize that it is
impossible to obtain perfect security. Security is not an
absolute. Instead security should be considered a balance
between protection and availability.



It is possible to have unrestricted access to a system, so that
the system is available to anyone, anywhere, anytime,
through any means. However, this kind of random access
poses a danger to the integrity of information.



On the other hand complete security of an information
system would not allow anyone access at any given time.




Robert Statica


Cybersecurity

Figure 7

Security Access

Balancing Security and Access
-

Too much security might
make access hard to get and people will stop using the
system. On the other hand, a too easy access protocol,
might be a security hole for the network. A balance must be
achieved between those two major “players”

Robert Statica


Cybersecurity

Figure 8

CEO

CFO

COO

Systems

Tech

Security

Tech

Network

Tech

Top
-
Down Approach


By Upper Management

Bottom
-
Up Implementation


By Network Administrators

Systems

Mgr

Systems

Admin

Security

Mgr

Security

Admin

Network

Mgr

Network

Admin

CISO

VP
-

Networks

VP
-

Systems

CIO

Robert Statica


Cybersecurity

What is Encryption ?

Encryption

is the process of converting
messages, information, or data into a form
unreadable by anyone except the intended
recipient. As shown in the figure below,
Encrypted data must be deciphered, or
decrypted, before it can be read by the
recipient.




The root of the word encryption

crypt

comes from the Greek word
kryptos
,
meaning hidden or secret.


Robert Statica


Cybersecurity

History of Cryptography

1900 BC: A scribe in Egypt uses a derivation of the
standard hieroglyphics


ABCDEFGHIJKLMNOPQRSTUVWXYZ

ZYXWVUTSRQPONMLKJIHGFEDCBA

Figure 1: ATBASH Cipher

100
-
44 BC: Julius Caesar uses a simple
substitution with the normal alphabet in
government communications.


ABCDEFGHIJKLMNOPQRSTUVWXYZ

DEFGHIJKLMNOPQRSTUVWXYZABC

Figure 2: Caesar Cypher

Robert Statica


Cybersecurity

In 1518 Johannes Trithemius wrote the first printed
book on cryptology. It was also known as changing
key cipher.


ABCDEFGHIJKLMNOPQRSTUVWXYZ Plaintext

FGUQHXSZACNDMRTVWEJBLIKPYO T00

OFGUQHXSZACNDMRTVWEJBLIKPY T01

YOFGUQHXSZACNDMRTVWEJBLIKP T02

PYOFGUQHXSZACNDMRTVWEJBLIK T03

...

GUQHXSZACNDMRTVWEJBLIKPYOF T25


Figure 3: Changing Key Cipher


History of Cryptography

Robert Statica


Cybersecurity

History of Cryptography

1790: Thomas Jefferson invented the wheel cipher


GJTXUVWCHYIZKLNMARBFDOESQP

W1

IKMNQLPBYFCWEDXGZAJHURSTOV

W2

HJLIKNXWCGBDSRVUEOFYPAMQZT

W3

...

BDFONGHJIKLSTVUWMYEPRQXZAC

Wn


Figure 4: A Wheel Cipher

Robert Statica


Cybersecurity

Modern Encryption Algorithms


Private Key Encryption


Public Key Encryption


Quantum Cryptography

Robert Statica


Cybersecurity

Private Key

Algorithms


Private key encryption algorithms use a
single key for both encryption and
decryption. In order to communicate
using this class of ciphers, the key must
be known to both sender and receiver of
the message.


Robert Statica


Cybersecurity

Public Key

Algorithms

Public key methods require two unique
keys per user; one called the public key,
and the other called the private key.


The private key is mathematically linked to
the public key. While public keys are
published, private keys are never
exchanged and always kept secret.

Robert Statica


Cybersecurity

Mathematical Basis of

Public Key

Algorithms


Factoring of large integers


RSA Algorithm



Discrete Log Problem


DSA Algorithm

Robert Statica


Cybersecurity

Quantum Cryptography


Method of secure key exchange over an
insecure channel based on the nature
of photons



Polarized photons are transmitted
between sender and receiver to create
a random string of numbers, the
quantum cryptographic key


Perfect encryption for the 21
st

century


Experimental stages


Very secure

Robert Statica


Cybersecurity

Modern Encryption

Methods and
Authentication Devices

Cryptographic Accelerators

Authentication Tokens

Biometric/Recognition Methods

Robert Statica


Cybersecurity

Examples

Type

Cryptographic
Accelerator

Authentication
Token

Biometric/
Recognition

Definition

Coprocessor
that calculates
and handles the
Random
Number
Generation

External device
that interfaces
with device to
grant access. 2
types: contact
and
NonContact

External
device that
measures
human body
factors to
allow access

Examples

PCI coprocessor

Credit Card,
RSA SecurID

Fingerprint,
Optical,
Voice and
Signature
recognition

Robert Statica


Cybersecurity

Biometrics Devices









The iris of your eye is the colored
part that surrounds your black pupil,
the black part. Every iris is different.
If a scan of a user’s iris matches the
one in the security system’s memory,
access is allowed.

Robert Statica


Cybersecurity

Biometrics Devices










Another trait unique to every individual is his or her
voice. The user speaks a specified word or
sentence to gain access to a secured computer.
Distinct patterns, tones, and other qualities in the
voice must match the authorized user’s voice in the
computer’s security system.

Robert Statica


Cybersecurity

Biometrics Devices












Another biometric option is
the fingerprint and its unique
identifying characteristics.
Placed on a special reading
pad, a designated finger’s
print is recognized by a
computer. A similar
biometric device scans a
person’s whole hand

Robert Statica


Cybersecurity

Biometrics Devices










The blood vessels in a person’s face radiate heat.
The patterns of those vessels, and the heat scan,
are completely individual and could be recognized
and required for computer access.


Robert Statica


Cybersecurity

Active in Internet Start
-
Ups

0 2 4 6 8 10%

US

Canada

Israel

Italy

UK

Germany

Denmark

France

Japan

Finland

Robert Statica


Cybersecurity

USA On
-
Line Shopping Revenues

$0
$1,000
$2,000
$3,000
$4,000
$5,000
$6,000
$7,000
$8,000
$9,000
$10,000
1995
96
97
98
99
2000
1
2
3
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
Web

Users

$ x Millions

Forrester Research

Robert Statica


Cybersecurity



A multimedia world..
in transition..


Copper to glass

Radio + Satellite + IR

Fixed to mobile

Robert Statica


Cybersecurity

2010

1990

1985

1980

2005

2000

1995

2015

50

75

100

25

0

% Network Traffic

Mankind

Machines

Machines Overtake Mankind

Machines

6Bn

20Bn

Robert Statica


Cybersecurity

1%

Trust is a key issue limiting

adoption of e
-
technology…





Language

Training

Lack of skills

Cost

Implementation difficulty

Lack of knowledge

Technology resistance

Customers not connected

Security worries

3%

7%

9%

10%

24%

25%

10%

10%

Robert Statica


Cybersecurity

Time

Rate of change

Today

Technology

Society

People

Companies

Business

Legal Systems

Governments

It’s not about $
-

It is about time

Robert Statica


Cybersecurity

Region

Campus



Building

Body

World

Continent

Everything will be in Cyberspace

covered by a hierarchy of computers!

Fractal Cyberspace: a network
of … networks of … platforms


Car

Home

Cell

Original by Gordon Bell

Robert Statica


Cybersecurity

Survival…..




“It is not the strongest of the
species that survive, nor the most
intelligent, but the one
most
responsive to change



Charles Darwin


Robert Statica


Cybersecurity

Thank You!