Outline

The main subject areas of this course and of the textbook are:

• Cryptography
• Access control
• Protocols
• Software

We start by introducing through some examples the issues involved in information security, and then talk about each of these areas briefly.

The Cast of Characters

• Alice and Bob are often used names for generic good guys in information security.
• They are also known as A and B.
• Trudy (the intruder) is the bad guy.
• Sometimes we will also talk about Eve who is an eavesdropper.

Alice's Online Bank

• Alice opens Alice's Online Bank (AOB)
• What are Alice's security concerns?
• If Bob is a customer of AOB, what are his security concerns?
• How are Alice's and Bob's concerns similar? How are they different?
• How does Trudy view the situation?

CIA - Confidentiality

• CIA == Confidentiality, Integrity, and Availability
• AOB must prevent Trudy from learning Bob's account balance
• Confidentiality: Prevent unauthorized reading of information
• Cryptography is used for confidentiality

CIA - Integrity

• Trudy must not be able to change Bob's account balance
• Bob must not be able to improperly change his own account balance
• Integrity: Detect unauthorized writing of information
• Cryptography is used for integrity

CIA - Availability

• AOB's information must be available whenever it's needed
• Alice must be able to make transaction
• If not, she'll take her business elsewhere
• Availability: Data is available in a timely manner when needed
• Availability is a "new" security concern with the advent of slightly newer attack forms such as Denial of service (DoS) attacks

Beyond CIA: Crypto

• How does Bob's computer know that "Bob" is really Bob and not Trudy?
• Bob's password must be verified
• This requires some clever cryptography
• What are the security concerns that come with using passwords?
• Are there alternatives to passwords?

Beyond CIA: Protocols

• When Bob logs into AOB, how does AOB know that "Bob" is really Bob?
• As before, Bob's password is verified
• Unlike the previous case, network security issues arise
• How do we secure network transactions?
• Protocols are critically important
• Crypto plays a critical role in protocols

Beyond CIA: Access Control

• Once Bob is authenticated by AOB, then AOB must restrict the actions of Bob
• Bob can't view Charlie's account info
• Bob can't install new software, etc.
• Enforcing these restrictions is authorization.
• Access control includes both authentication and authorization

Beyond CIA: Software

• Cryptography, protocols, and access control are implemented in software
• Software is the foundation on which security rests
• What are security issues of software?
• Real world software is complex and buggy
• Software flaws lead to security flaws
• How does Trudy attack software?
• How can we reduce flaws in software development?
• What about malware?

The People Problem

• People often break security - both intentionally and unintentionally
• As an example of the latter, suppose you want to buy something online
• To make it concrete, suppose you want to buy Information Security: Principles and Practice, 2nd edition from amazon.com

The People Problem

• If you buy from amazon.com...
  • Your Web browser uses the SSL protocol
  • SSL relies on cryptography
  • So access control issues arise
• All security mechanisms are in software
• Suppose all of this security stuff works perfectly
• Would you be safe?

The People Problem

There are several things that could go wrong... For example,

• Trudy tries man-in-the-middle attack
• SSL is secure, so the attack doesn't "work"
• But, your web browser only issues a warning that the certificate seems weird...
• If you ignore the warning, attack works!
• None of the security mechanisms failed
• But you unintentionally broke the security of this protocol

Cryptography

This will be the first main topic we consider this semester. It concerns secret codes and we will discuss:

• Classic cryptography
• Symmetric ciphers
• Public key cryptography
• Hash functions and more
• Advanced cryptanalysis

Access Control

This is the second topic we will discuss this semester. We will be interested in:

• Authentication
  • Passwords
  • Biometrics
  • Etc.
• Authorization
  • Access Control Lists/Capabilities
  • Multilevel security (MLS), security modeling, covert channel, inference control
  • Firewalls, intrusion detection (IDS)

Protocols

• "Simple" authentication protocols
  • Focus on basics of security protocols
  • Lots of applied cryptography in protocols
• Real-world security protocols
  • SSH, SSL, IPSec, Kerberos
  • Wireless: WEP, GSM

Software

We will consider several aspects of software are related to security:

• Security-critical flaws in software such as buffer overflows, race conditions, etc.
• Malware - We will consider viruses and worms, and how to prevent and detect them.
• Software reverse engineering (SRE) - How hackers "dissect" software
• Digital rights management (DRM)
• Software testing
• Open source, closed source, and its relationship to security
• Operating systems - What are the requirements of a trusted OS?

Ethics

• In order to build secure systems, an information security specialist has to often think like Trudy.
• That is, the specialist should try to think of ways to attack a system, exploit its weaknesses, etc.
• A specialist though should try to use this information to help Alice and Bob make their systems more secure, and not use the information gained through analysis for malicious purposes.
• The specialist should also be careful not to inadvertently hurt production systems in the process of helping Alice and Bob.
• In general, the specialist should try to avoid becoming Trudy.