Introduction to Computer Security - Course Introduction

Introduction to Computer Security Course Introduction Pavel Laskov Wilhelm Schickard Institute for Computer Science

Computer security in headlines

» Internet als Risikofaktor? » Omnipräsenz von Computer in und numbers Angriffen,security Würmern Viren » Massive Schäden bei Unternehmen und Bürgern » Zunehmende Kriminalisierung von Schadsoftware Schadcode pro observed Jahr (Symantec) NewNeuer malicious code samples (Symantec) 3.000.000 2.250.000 1.500.000 750.000 0

2002 2003 2004 2005 2006 2007 2008 2009

Technische Universität B

What lurks behind the statistics?

Malware previously used for fun is now used for profit. 78% of end user attacks involved stealing of login data 76% of phishing attacks targeted financial sector Average cost of data breach in 2008 in the USA: 6.7M $.

Hacking is no longer the realm of “script-kiddies”. 60% of malicious code threats represent new attacks.

The biggest risk resides not in but in front of a computer. Why would anyone want something from me? What does my Windows want to update again? I have already bought an antivirus, so I am safe.

Why are computer systems insecure?

Growing complexity of computer systems large number of components, complex interaction

High competition short “time-to-market”, high ROI

Leveraging of risks through high connectivity worm outbreaks, botnets

Slow incident response “incident hiding”, manual handling

Human error

What can go wrong will go wrong!

Human error: a case study

Human error: a case study

Human error: a case study

Human error: a case study

Human error: a case study

Human error: a case study

Human error: lessons learned

Users make errors elaborate social engineering design time pressure

Significant monetary motivation Business efficiency via Internet

Acrobat Reader exploit

Acrobat Reader JBIG2 exploit: a timeline

Exploit discovered: ??? First public warnings: 19.-20.02 Adobe Reader 9.0 patched: 10.03 Adobe Reader 8.1.3 patched: 18.03 Adobe Reader Linux patched: 26.03 Recognition by antivirus system as of mid-April 2009: 6/39 (15.39%)

Infection without a click

Select a thumbnail view. Hover a mouse over a document. Do nothing: the Windows Desktop Search (if not de-activated) will find it and open!

Potential consequences of an infection Start a keylogger Start a botnet (zombie) client Download further code from a remote site

Security instruments

Security instruments

Prevention

Security instruments

Detection

Prevention

Security instruments

Reaction

Detection

Prevention

What will you learn?

Findamental concepts of computer security dry, but important!

Basic security goals and mechanisms authentication, access control, encryption, etc.

Practical security instruments Windows and Linux security.

Further selected topics network security software security web application and browser security

‘

Coarse administration Lectures: Wed, 10:00–12:00 (ct), A301

Formalities: Credit hours (diploma): 2 SWS (lectures) + 1 SWS (exercises) Credit points (B.Sc.): 3 LP (lectures) + 1 LP (exercises)

Exams and grading: diploma: oral exam by appointment, graded certificate for exercises B.Sc: written exam at the end of semester, 30% of the final grade from exercises

Office hours: by appointment Course web page: http://www.cogsys.cs.unituebingen.de/lehre/ss11/introd comp sec.html

Homework assignments

Meetings: Tue, 10:00–12:00 (ct), A301 First meeting: 26.04

4 homework assignments to be solved individually Evaluation and grade: diploma: a grade reflects the percentage of points acquired. B.Sc.: a grade contributes 30% to the final grade.

Bibliography

Dieter Gollmann. Computer Security. Wiley & Sons, 2006. Ross Anderson. Security Engineering. Wiley & Sons, 2001. Bruce Schneier. Secrets and Lies: Digital Security in a Networked World. Wiley & Sons, 2004. (fun to read)

A typical web application

Legitimate user

Internet Browser Webserver

Attack: interception of communication

Legitimate user

Internet Browser Webserver Credit card number

Attacker

Security goal: confidentiality

Prevention of unauthorized reading of data Prevention of unauthorized learning of information Potential abuse scenarios: Discovery of confidential information (e.g. details of a business contract) Discovery of authentication credentials (e.g. password sniffing)

Enforcement intruments: Symmetric or asymmetric cryptography Anonymization techniques

A typical web application

Legitimate user

Internet Browser Webserver

Attack: identity spoofing

Legitimate user

Internet Browser Webserver

Attacker Fake webserver

Security goal: authentication

Verification of an identity of a person or a computer Prerequisite for access control Authentication methods: Shared secrets (e.g. password or PIN) Ticket systems (identity cards, digital certificates) Challenge-response techniques Biometric techniques Human authentication: CAPTCHA’s, Turing test, etc.

Authentication risks: identity theft

A typical web application

Legitimate user

Internet Browser Webserver

Attack: injection of malicious code

Legitimate user

Internet Malware Browser Webserver

XSS attack

Attacker

Security goal: integrity

Prevention of malicious tampering of data Potential abuse scenarios: Fraudulent modification of data (e.g. 100,000¤ instead of 100¤ in an online transaction request) Injection of malicious code in downloaded software Evading detection by modification of a compromized operating system

Enforcement instruments: Integrity checking using cryptographic hash functions

A typical web application

Legitimate user

Internet Browser Webserver

Attack: server overload

Server overloaded Legitimate user

Internet Browser

Security goal: availability

A joint objective of security and dependability May be caused by attacks as well as natural phenomena, such as design errors or flash crouds. Enforcement instruments: Detection of DoS-attacks Router and firewall reconfiguration Service redundancy Virtualization

A typical web application

Legitimate user

Internet Browser Webserver

Attack: transaction denial by a user

Legitimate user

Internet Browser Webserver Transaction cancelled Credit card charded

Security goal: accountability

An audit trail of security-related events A key instrument of detection/response A stronger form of accountability is non-repudiation: unforgeable evidence that a certain action occurred. Similar attacks as integrity Enforcement instruments: Integrity checks Read-only audit Digital certificates and trusted third parties

Summary

Security is not a solution but an ongoing process. Security can only be achieved by a combination of technical and organizational measures. One of the biggest security risks is a user. Security is a big challenge but lots of fun as well: a great field of study and research.

Next lecture

The economics of computer security Security threats Security design principles