Information Security, some illustrated principles

Information security some illustrated principles

Waarom security?

Geheimen “aan niemand doorvertellen he!”

Controle “_Wie_ weet dat allemaal?”

Information wants to be free

Problemen?

www.facebook.net phishing

OMG pink poniezzz trojan horses

Botnets

crack!

sniffers

spam

Concepten

Data conﬁdentiality

Entity Authentication (Identiﬁcation)

Data authentication (integrity + who sent it)

Non-repudiation (origin vs receipt)

Denial of Service

Terminology & deﬁnitions • Cryptographers and computer security people talk a different language (e.g. ‘authentication’ vs ‘authorisation’) • Integrity(Data authentication? Entity authentication?) • Availability (Denial of Service? Non-repudiation?) • Conﬁdentiality • Trust

Vertrouwen (trust) ➡ Dieter Gollman: “Trust is not the ➡ Based on concept that ➡ reputation uniﬁes security, it ➡ control and is an absolute punishment mess.” ➡ policy enforcement ➡ “If it is trusted, it ➡ ... or blind can hurt you.”

Vertrouwen Nieuws.be 27/11/’08 18u13: “A320 crasht in de Middellandse Zee.”

Vertrouwen Luchtvaartnieuws.nl op 5/10/’07: “US Airways bestelt 92 Airbussen.”

Nieuws.be: A320 Luchtvaartnieuws.nl: A350

Vertrouwen Nieuws.be 27/11/’08 20u25: “A320 crasht in de Middellandse Zee.”

Vertrouwen • In de praktijk: • cryptograﬁsche sleutel (bvb. encryptie) • toegangsrechten • digitale handtekeningen • “trusted computing”

Information Security Principles • Be clear about deﬁnitions

Don’ts

Don’ts • Security and complexity do not mix

Don’ts • Security and complexity do not mix: • operating system • network architecture • applications • mobile code • services: XML, SOAP, VoIP (through the ﬁrewall!) • always on connections (botnets!)

Don’ts • Security through obscurity: • mobile phone systems: GSM in US • DVD copyright protection (DVD Jon!) • Sony rootkit • Diebold voting machines • Microsoft • Cisco router OS • physical locks • blacking out text in PDF (hack: “read out loud”)

Don’ts • Risk avoidance: • accept the risk • reduce risk with technology • reduce risk with procedures • reduce risk with insurance • reduce risk with disclaimers • transfer the risk (e.g.: from data to key)

Don’ts • Security is not forever: • Cryptography: • 1958 vs now : peanuts • now vs 2058 : ? • Advances in: • reverse engineering • side channel attacks

Don’ts • Security and complexity don’t mix • Security through obscurity does not work • 100% security doesn’t exist • Security is not forever

Do’s

Assumptions • Clearly state the assumptions behind the system. • Code re-use can be dangerous: design assumptions might no longer be valid!

Assumptions • GSM: • encryption until the base station • no need to authenticate the network (in Soviet mobile nation, network authenticates YOU!)

Assumptions • e-ID: • PIN code is kept secret by the user

Assumptions • RFID: • opponent cannot eavesdrop > 1 meter

Do’s • Clearly state the assumptions behind the system. • Need for integrated approach

Integrated approach

Do’s • Clearly state the assumptions behind the system. • Need for integrated approach • Find the right mix of technology and law

“Gentlemen don’t go in through the exit”

Digital Rights Management

Digital Millenium Copyright Act

Spam

Legislation • Electronic Signatures • Data retention • Eavesdropping • Computer Crime

Do’s • Clearly state the assumptions behind the system. • Need for integrated approach • Find the right mix of technology and law • Need for secure implementations

Secure implementations • “Nothing is more practical than a good theory” • “Theory is important, at least in theory”

Secure implementations • Consider: • Secure software/hardware (orlly?) • Side channel attacks • Buffer overﬂows • API errors • Random number generators • Model vs reality

Model vs Reality

Challenges

Challenges • Always room at the bottom: • RFID • Sensor networks • Smartphones

Challenges • Always room at the bottom • Human Factors: • usability (“This certiﬁcate is invalid.” - “OK”) • social engineering

Challenges • Always room at the bottom • Human Factors • It’s the economy, stupid!

Challenges • It’s the economy, stupid! • “No gain, no pain” • Examples: • Software (no liability) • Credit cards in France

Questions to you

1. Did you _really_ implement secure software?

2. Do you trust your news service(s)?

3. Do you use Facebook’s privacy features?

4. Do you respect someone else’s privacy on Facebook?

5. Do you care?

Questions?

Disclaimer

Credits • Introduction to security and course overview, prof. dr. ir. Bart Preneel, Intensive Program on Information and Communication Security, July 2006 • Google Images (most of the images) • Sigridschrijft.be / Sony (Terminator 4 poster)

Information Security, some illustrated principles

1 comments

Notes on slide 1

4 Favorites & 2 Events