3. u10a1
3
Executive Summary
ALPHA organization has global presence and has over three hundred thousand
employees (including contractors and interns). There will be services that are pertaining to
confidentiality and non-repudiation that will be provided to employees. ALPHA and the fictional
Information Technology (IT) work environment uses cryptography to safeguard the data so that
it is not altered or misused. Organization provides Application Infrastructure Service (AIS) to its
customer base. The AIS team strictly follows role-based access to the applications that are hosted
in the environment. A vendor software i.e. Computers Associates (CA) eTrust SiteMinder v12 is
used to define this identity and role based access management via proper definition of
Authentication, Authorization and Administration for the various user base and their access to
various applications of the organization.
4. u10a1
4
Introduction
Analysis has gone towards in accessing encryption and its use in the discussed
organization. The database vulnerabilities is mentioned and explained to help understand how
important it is to avoid such risks. Efforts has been put forth to explain the use of ciphers and
how it can be applied. Various methods used in cryptography and the way it is important to safe-
guard the data of the organization is explained. The main types of cipher attacks and ways to
defend it from falling to this organization are discussed in detail. The application architecture
and operating systems design issues has been discussed in great detail with an evaluation done to
mitigate risks associated to it. Graphics has been integrated to explain each concept better.
Cryptography ensures that it protects the confidentiality of the data and prevents it from
being misused or used illegally. It also helps to protect the data with its required integrity and
provides authenticity of its contents.
Not all users require the same access to an application. There is different level of access
permission defined by the business or stake holders hence pertaining to this requirement level of
application access is defined and granted. An example, there are super users that is required for
the application to reset the account password and or edit (i.e. add/delete/modify) application
access to certain section of the application. On the other hand there might be a set of users whose
job is to maintain report the sales done using the application. Therefore, it becomes a challenging
task to maintain these levels of application access.
5. u10a1
5
Encryption and its use in ALHPA organization
Today a customer needs confidence when investing their dollars purchasing any product.
IT business operates in “anytime, anywhere” concept, meaning data is made available to
customers anytime (be it over laptop/handheld device/sophisticated Android/iPhones etc) and
anywhere that they are located (be it in a corporate business meeting, hotel lounge, airport etc).
Few of them keeps track of the products that they need by updating themselves on the product
launch, enhancement and self-educate to learn the product before actually investing on the
product. Information compiled within the product must be fully acknowledged to be used safely.
The major challenge that an organization faces today is that most often security is
afterthought. Security must be built into the network and/or application from initial stages of
application development. Once the application is released and in production it becomes near
impossible to make the corrections. At this stage it might be an issue to get the change done from
the cost per say as well. Therefore, the organization ensures that security is getting implemented
from the initial stage of the development life cycle. Developers and management keeps a close
watch about the legacy applications as those are few of them that needs to be taken care from the
security aspects. Organization has put forth efforts to build firewalls, induct intrusion detection
equipments for the corporate network, encrypt data that is send and received both inside and
outside the company network, enable Secure Socket Layer (SSL) guided web layer and its
communication.
The organization’s security system consists of two services: the Enterprise Directory
(ED) and the Public Key Infrastructure (PKI) that is used to provide application security. ED
provides information about the people and resources (viz. Employees, Partners/Customers,
Servers, and Roles). The PKI helps the work environment to be trusted and secured by issuing,
6. u10a1
6
revoking, and managing the digital certificates defined per the X.509 standards. The organization
uses ED and PKI to perform registration of users to obtain digital badge certificates. The PKI
concept makes use of asymmetric cryptography. Here the private key need to be kept secured by
a single party and does not need to transmit over the network to other parties. Using public key
the organization implements digital signature and by which the information once sent or received
cannot be denied on a later stage. The total number of keys required in a large network is smaller
as one party just needs hold the private key and rest the public key for authentication,
authorization and administration (Dunning, 2012). PKI involves the Certificate Authority (CA)
which institutes the identity of the sender/receiver’s key. The validation is done with the CA and
to the process that confirms the authenticity of the certificate holder to his or her credentials and
confirms the identity validation. The CA confirms the use of the public key and confirms the
valid usage that is included per the access that is granted for that particular user or user base
(Rouse, 2006).
The web services that are built are ensured to run via SSL. It ensures that required
algorithm is in play when the web requests are being sent or received from the business and only
the trusted or allowed IP addresses are granted access to the network/corporate application. The
organization’s Mission Critical application runs in SSL mode. It uses ED and PKI to perform
registration of users to obtain digital badge certificates. The PKI is responsible for issuing 2048
bits of CA certificates to the application owners/partners/customers or for the business units and
their resources. Each of these certificates has a public and private key. As the name suggest for
itself, public key is information that is made public and is shared with all. The private key on the
other hand is kept secret and is known only to the key holder. PKI controls the security of this
private key by enforcing policies and procedures. Digital signature is obtained by the construct
7. u10a1
7
of the private key and the related data object. Using this digital signature is what the original data
is sent. The digital signature is verified based on the data object, digital signature and the public
key. If any of them does not match, the signature will fail to verify. This is vital when it comes to
establishing a proper SSL handshake, application programming and its communication/operation
with the web services as a whole.
Systems that host the web application are more prone to attacks. The developer and the
management ensures that in the Software Development Life Cycle (SDLC) there is a clear
strategy to secure the web application and assures of no or minimal attack seen from any feasible
target. Vulnerabilities caused by mistake or by a poor SDLC practices are a serious concern and
involve much cost to mitigate the issue on a later stage. They are increasingly complicated in
their ability to insert malicious code into the mission critical software or application. An
example, in cancer disease the damage is invisible to a person from outside but it is energetically
damaging the system from within the system. There are preventive actions taken to minimize the
damage and to get to normalcy, if possible. Same way SDLC helps in lying down a strong
foundation to assist the organization to minimize and manage the developed applications.
Application will tend to have code defects but it is wise to detect the code as early as possible in
the SDLC lifecycle and fix it. There are set standards which are required to be followed to build
secure software. It is recommended to conduct regular tests throughout the development cycle
and independent testing prior to the actual software release. Customers look for software vendors
who endorse their developed product to the compliant with security norms and have followed the
secure way of creating software using the proven SDLC methodology (Wood, 2009). An
example, an unchecked buffer for Internet Server Application Programming Interface (ISAPI)
extension can compromise the Internet Information Server (IIS) web server. When installing IIS
8. u10a1
8
it installs several .dll’s that provides extended functionality for the web services. One of .dll file
is the idq.dll. It is a component of Windows 2000 Index Server and provides support for the
administrative scripts and web data queries. Here security vulnerability occurs where the web
invader establishes a session with a web server on which this idq.dll exists and executes cod eon
the web server. The idq.dll runs with system privileges and can make the most use of server
components and take an action that will be decisive from the security point of view ("Microsoft
security bulletin," 2003). ALPHA organization follows a secure mode of application
development methodology within the various SDLC phases.
Database access has become as simple as browsing it via the internet browser interface.
The important aspect of protecting a database is through the use of excellent security principles.
For example, it could be defining the access/authorization towards the information that is
contained in the database. ALPHA organization follows the good practices such as using strong
passwords, account and role permissions, elimination of default accounts and passwords etc
collectively plays an ample security towards the database functionality. Additionally, access for
the database over the network requires more security features to be enabled with adequate
amount of credential verification. This is similar to implementing a Defense in Depth type
methodology where various layers provide protection to the specific application or device in
question. The database is often posed to security risks because it is has weakly designed
architecture and thereby has a poor code for its SQL transaction. The top ten database
vulnerabilities are listed below-
Default, Blank & Weak Username/Password
SQL Injections
Extensive User & Group Privilege
9. u10a1
9
Unnecessary Enabled DB Feature
Broken Configuration Management
Buffer Overflows
Privilege Escalation
Denial of Service Attack DoS
Unpatched Databases
Unencrypted sensitive data – at rest and in motion
(Westervelt, 2010)
The mistake made by DBA’s results in the intruder to pave into the database systems and
create security risks. Some of the common mistake is not to read the installation procedure by
which the default username and password are left unchanged. DBA’s often fails to determine the
number of users requiring access to the database and fails to limit such user lists and keeps it
unlimited. This opens doors for the intruder.
Ciphers and its application
Cryptography “is the field that offers techniques and methods of managing secrets”
(Raval & Fichadia, 2007). Cryptography can be implemented by having the raw data used in
terms of mathematical expression (i.e. encrypt it) so that this form of data is not easily known
when transmitted to the receiving end. Cryptography can be used to make the data unintelligent
and intelligent. It can be broken down into different components while sending it to the recipient.
The sender is the entity that encrypts the data and the receiver is the entity that decrypts the data.
The zone that this data travels is through the unsecured surroundings hence the message needs to
transit in garbled form (Raval & Fichadia, 2007).
10. u10a1
10
In ALPHA organization, the PKI is responsible for issuing 2048 bits of CA certificates to
the application owners/partners/customers or for the business units and their resources. Each of
these certificates has a public and private key. As the name suggest for itself, public key is
information that is made public and is shared with all. The private key on the other hand is kept
secret and is known only to the key holder. PKI controls the security of this private key by
enforcing policies and procedures. Digital signature is obtained by the construct of the private
key and the related data object. Using this digital signature is what the original data is sent. The
digital signature is verified based on the data object, digital signature and the public key. If any
of them does not match then the signature fails to verify. A typical stage of web browser/server
communication with encrypted messages being transmitted from either end is shown below
(Figure 1)-
Figure 1
11. u10a1
11
This is vital in the proper SSL handshake and communication/operation of the web
services, the application programming code and the servers that are directly or indirectly related
to the PKI for normal operation.
Cryptography methods and the way to use it
For ALPHA organization, most (if not all) of the communication happens over the
internet and via email mode of communication. Organization ensures that the latest (or most
recent tested and proven) version of browser is used when establishing communication over the
internet. The organization releases different patches to the products that are tested and proven to
overcome any vulnerability associated to the related products. The IT infrastructure team ensures
that regular update for the products are done. It might be required to co-ordinate this effort with
the required product vendor in order to get the update done successfully. The symbol that is used
when transacting over the web is 128-bits. Organization know of that fact that anything less than
this number of bits will open doors for the hackers to crack the encryption code and view
confidential information (Slack, 2012).
The PKI concept makes use of asymmetric cryptography. Here the private key need to be
kept secured by a single party and does not need to transmit over the network to other parties.
Using public key one can implement digital signature through which the information once sent or
received cannot be denied on a later stage. The total number of keys required in a large network
is smaller as one party just needs hold the private key and rest the public key for authentication,
authorization and administration (Dunning, 2012).
PKI involves the Certificate Authority (CA) which institutes the identity of the
sender/receiver’s key. The validation is done with the CA and to the process that confirms the
authenticity of the certificate holder to his or her credentials and confirms the identity validation.
12. u10a1
12
The CA confirms the use of the public key and confirms the valid usage that is included per the
access that is granted for that particular user or user base (Rouse, 2006).
Both the ED and PKI provide confidentiality, integrity, and availability of the CIA triad to
the organization’s secure IT infrastructure. There is a level of authentication which is provided
by the PKI managed private key. This avoids the usage of passwords which more susceptible to
loss or theft, may cause severe vulnerability towards the entire organization and bring down the
revenue and ultimately the hard earned brand image of the organization. The PKI provides the
data integrity by transacting the documents electronically to the desired parties. This greatly
evades the risk of the documents getting tampered in its way of transit. Data that is getting
transmitted over the network, being accessed and stored (both for short and long term) is marked
and stored as confidential. Organization has all its data marked confidential and is taken care by
properly validating the sender and receiver identity via the public/private key pairs. Data stored
is safe guarded and protected from malicious attackers by ensuring the storage medium to be
confidential and software secured by good known vendor third party products. The
organization’s PKI moves ahead and provides non-repudiation by ensuring that the person who
digitally signs while accessing the company application cannot later disclaim that they have not
signed it.
The data transmission and its storage in the hybrid environment is the key element.
Organization ensures that any data transmitted and or any transaction that takes place in the
cloud is secure and follows CIA triad. Organization has Virtual Private Network (VPN) to
manage security of data moves in the hybrid environment. A VPN allows the data to follow into
organization and its implemented firewall that is between the public (i.e. the internet) and
corporate network. It has adequate amount of encryption enabled for the sensitive data that gets
13. u10a1
13
transmitted where hackers have little or no evidence to decode the data. The data received may
needs to be stored for a little time or needs to be stored for longer duration. Whichever the case
may be, the related data gets stored securely and helps in preventing any leakage of the sensitive
data. Due to encryption on the data storage the servers are performing slowly in their actual
performance throughput. Investigation is currently underway to mitigate this risk over
unencrypted and encrypted data on storage devices/servers (Hurwitz, Kaufman, Halper & Kirsch,
2012).
Main types of cipher attacks and ways to defend it
Depending on what a cryptanalyst has to work on, attacks can be categorized into
following types-
Cipher only attack – the ONLY data available is the ciphertext
Known plaintext attack – contains ciphertext and plaintext
Chosen plaintext attack – a target ciphertext that can get the encryption algorithms with
plaintexts and identical ciphertext(s)
Chosen ciphertext attack – a target ciphertext that can get the decryption algorithms with
plaintexts and identical ciphertext(s)
Out of these the most severe is the last one i.e. chosen ciphertext attack (P. N., 2012).
The ways to defend cipher attack is by improving Data Encryption Standard (DES) and
the related cryptographic protocols. Transport Layer Security (TLS) requires use of RC4 cipher
for application security. A way to safe guard the system if TLS is in use is to prioritize RC4
cipher suites (Ristic, 2012). Man-in-the-middle (MITM) attack can be evaded if SSL/TLS is used
correctly. The encryption in SSL/TLS is achieved using symmetric cryptography and for
authentication it uses asymmetric cryptography. ALHPA organization uses SSL certificates
14. u10a1
14
primarily for application that are external facing. Use of HTTPS protocol is recommended than
HTTP protocol.
The multi-factor authentication (MFA), a security system and its access controls is used
in the project that the organization and its developers construct/manage. There are many aspects
considered when implementing the MFA in the organization’s managed infrastructure services
(viz. application, remote access method etc). This helps keep the identity of the user and ensures
who they claim to be. A secured solution is offered to the user base which gives worry free usage
of the credentials and make use of the application and or equipments that is MFA enabled
(Barreiro, 2011).
Application architecture and operating systems design issues and how to mitigate risks
Designing and developing application to run in a secure environment poses many
challenges to the developer community. ALPHA organization and the developers ensure that the
application is able to identify user by leveraging a form of authentication mechanism. The
authentication process is secure and the user once authenticated is well protected and managed
for their permitted/allowed session. Developers face challenges in managing the authentication
and session management mechanisms. Other issues are data flow within the corporate
environment and outside the corporate network. Few of the issues that is looked when addressing
a secure environment is shown in the figure below (Meier, Mackman, Dunner, Vasireddy,
Escamilla & Murukan, 2003)-
15. u10a1
15
Figure 1
As can be seen from the figure there are several issues that crop up while designing a
secure application viz. authentication of users, managing parameter, sensitive data, preventing
session from getting hacked, safe guarding the cookie, exception handling, level of
authentication and authorization of identities, auditing the log activity, protecting sensitive data
and encrypting the sensitive data.
From experience it is seen that a poor application design leads to security vulnerabilities
and thereafter causes its related threats. In the design phase management and team adheres to the
corporate policies, procedures and its set standards. There is no compromise made for its
integrity. Application has to be developed in such a way that it adopts to the AIS team set
guidelines. An example, port 80 usage is disabled and application makes use of non-default ports
to prevent any level of hacking that might be devised for default ports. Security policies and
procedures deem what the application and user are allowed to perform. Application is deployed
per the terms and conditions determined by such policies. A proper definition or know-how of
the network infrastructure is known when designing the application. An example, the
16. u10a1
16
authentication options that are required from the web server to application and database servers
may vary depending on the firewalls. For applications that are open to external network is paid
extra caution at the time of deployment as it might pose network spy and threat to integrity of
sensitive data. There is proper input validation done without which the application is incorrectly
placed to defend from the malicious attackers. Proper and adequate level of input validation will
yield effective countermeasure and will assist to avert threats such as cross-site scripting, SQL
injection, buffer overflows, and other input attacks. Below best practice are followed in ALPHA
organization and AIS team to evade from insecure application design-
Imagine all input is spiteful;
Input validation is centralized;
Restrict validation at client-side;
Be alert and keep coding to accepted principles or standard practice; and
Confine, discard and clear the input.
Web application requires the multi-factor authentication scheme which allows safe and
secure transaction and or user data management in the web-tier. Here the user credentials (i.e. the
user name and password) is captured and sent in encrypted form so that the communication
occurs via the SSL between the web/application and database server. End user uses data
encryption when performing transaction on the web. Data send and received is encrypted via
cryptographic methods. These once bundled with the required encryption travels through secure
channel (viz. firewall, virus protection etc) and gets delivered to the intended recipient. Systems
used by end user are protected and the data within it is stored in encrypted format.
There is adequate amount of training imparted to the end users in regard to the
importance of securing the work area and the related environment ("Contingency access to,"
17. u10a1
17
2006). Organization takes adequate care to secure the data and marks it as confidential so that no
external or unauthorized access is permitted to such vital company assets. If this step is not
ensured to be applied then organization might pose a great risk to the company confidential
information files/data and might lead to data loss thereby bring loss to company reputation and
revenue.
Measures are taken to protect the company information from unauthorized modification
of the information by unknown users. It is ensured that only authorized user is allowed to
perform authorized and approved company changes and prevent from any unauthorized changes
to occur. Changes to the system are not made unless and until it is requested and approved by the
change review board. Inaccurate adherence of which may lead to unwarranted disruption in the
normal delivery model as per the agreed service level agreement and might pose a great risk to
lose the business. Systems providing access to the data are ensured to be made available round
the clock. There is High Availability and Disaster Recovery (HADR) plan that is incorporated to
improve data availability. In an event of disaster or a given site failure there will exists no way to
bring back up the normal operations if such availability is not planned, devised and applied.
The organization provides its employees systems (Desktop for stationed workers &
Laptop for mobile workers) to perform their daily job. All these systems carry Microsoft
Windows 7 Operating System (OS) which is installed and configured along with Microsoft
Office Suites. These systems may carry vital information pertaining to the business. Therefore, to
safeguard it from theft and or usage by intruders it is locked from the very initial stage of boot
itself. This system encryption gives the highest level of security for the various OS level file
systems and the different files that an employee uses in his daily operation. The system maintains
log files and its registry entries that can be used to fall back in case of trouble. This level of
18. u10a1
18
encryption challenges for password as an authentication before Windows boots to cross-verify
the identity of the user trying to access the system and its resources. Once an employee crosses
this initial stage of encryption successfully, it is now on the OS to safe guard the underlying file
systems. Organization decided to incorporate OS as Microsoft Windows 7 because this OS has
the most efficient and effective security that any Microsoft client OS have ever yet provided.
On top of this OS level security that comes by default, few more implementation that can
be done to further tighten the security of the systems. User account is not by default given
privileges as local administrator. This is inducted to enhance the security feature of the OS. A
user is not by default now granted access to change permission and or settings of the system. An
example, the Microsoft Windows 7 and its “Run As” utility if anyone tries to use will prompt for
valid administrator credentials and does not allow ordinary user to execute this administrator
level access oriented command and eliminates the risk of unwarranted software, malware, and or
plug-ins being installed on the system. Therefore, the lesser the user has access privileges on the
system the more will improve the system security.
Another implementation that can enhance security mechanism on this client OS is to
change the network type to “Public”. There are three kind of network that a system can be
connected i.e. Home Network; Office Network; Public Network. Today wireless hot spot and its
access points are available and many a times it is open. So, it is important that the system runs
with a secured network. The most secured from amongst these three networks is the “Public”
network. This restricts any user that is trying to get access to the system and keeps it secured by
avoiding any level of access to the files and folders. It is recommended that all systems used in
the organization is configured to enable Windows update and is set to download such update post
19. u10a1
19
the notification. This greatly helps the system to be up-to-date with the latest patch and many
times with the most recent security patch as well.
Another important step to secure the system is to enable Windows firewall and ensure to
get all inward flowing traffic to be dropped. The outgoing traffic can be filtered with enablement
of security done from the application access level which helps in protecting the system as well as
the application installed on it. It is recommended to all users to enable Data Execution
Prevention (DEP). This helps system to notify if any unwarranted program tries to use the
system’s reserved memory and prevents the system to be attacked and used by viruses and other
security threats related to it. The remote assistance and remote desktop connections can be
disabled to ensure that no intruder makes an attempt to get a connection to the system. It is good
to set the Account Control Settings to the highest level. It might seem to be annoying by getting
prompted for each program that is running on the system to be allowed to execute or not. But this
feature greatly helps the system owner to check and validate the stand so as to confirm to have
such program or application to be allowed to run on the system or not. Now, without such
notification the user will not even know when any programs or application gets installed and
ever get executed on the system which is a great security concern.
Employees working in the data center are told to secure their systems by disabling the
sharing and the NetBIOS protocol. This helps to restrict connections to insecure ports.
Furthermore it is recommend disabling services that are unnecessary and less important from the
security of the system and from a usage perspective (Nexo, 2009).
20. u10a1
20
References
Dunning, D. (2012, July 26). Explain symmetric & asymmetric encryption. Retrieved from
http://www.ehow.com/info_8725600_explain-symmetric-asymmetric-encryption.html
Rouse, M. (2006, October). What is pki (public key infrastructure)?. Retrieved from
http://searchsecurity.techtarget.com/definition/PKI
Wood, P. (2009, May). Build security into the entire software development life cycle. Retrieved
from http://www.computerweekly.com/opinion/Build-security-into-the-entire-software-
development-life-cycle
Microsoft security bulletin ms01-033. (2003, November 04). Retrieved from
http://technet.microsoft.com/en-us/security/bulletin/ms01-033
Westervelt, R. (2010, June 03). Database security: Top 10 database vulnerabilities list.
Retrieved from http://itknowledgeexchange.techtarget.com/security-bytes/database-
security-top-10-database-vulnerabilities-list/
Raval, V., & Fichadia, A. (2007). Risks, controls, and security. (1st ed., p. 122). Hoboken, NJ:
John Wiley & Sons, Inc.
Raval, V., & Fichadia, A. (2007). Risks, controls, and security. (1st ed., p. 124). Hoboken, NJ:
John Wiley & Sons, Inc.
Slack, S. E. (2012, June 01). 4 tips to protect yourself when conducting research on the web.
Retrieved from http://www.newsflash.org/2004/02/si/si002748.htm
Dunning, D. (2012, July 26). Explain symmetric & asymmetric encryption. Retrieved from
http://www.ehow.com/info_8725600_explain-symmetric-asymmetric-encryption.html
Rouse, M. (2006, October). What is pki (public key infrastructure)?. Retrieved from
http://searchsecurity.techtarget.com/definition/PKI
Hurwitz, J., Kaufman, M., Halper, F., & Kirsch, D. (2012, August 4). Hybrid cloud for dummies.
Retrieved from
http://books.google.com/books?id=UyGBpQUH6OAC&pg=PA158&lpg=PA158&dq=bl
&ots=c2Ya6_2C2y&sig=Wd3OP4sWMCo4spb8xVALGRw9Do8&hl=en&sa=X&ei=80
YdUO-MA-bK2AXvg4GABw&ved=0CGkQ6AEwBQ
P. N., R. (2012, August 25). 4 types of attacks (2) for everything in cryptography. Retrieved from
http://www.scribd.com/doc/51580839/9/types-of-attacks-2
Ristic, I. (2012, August 25). Tls attack requires use of rc4 cipher for application security.
Retrieved from https://www.aspectsecurity.com/news/application-security/tls-attack-
requires-use-of-rc4-cipher-for-application-security/
21. u10a1
21
Barreiro, A. (2011, December 06). Implementing multi-factor authentication: What to consider.
Retrieved from http://www.techrepublic.com/blog/security/implementing-multi-factor-
authentication-what-to-consider/6997
Meier, J. D., Mackman, A., Dunner, M., Vasireddy, S., Escamilla, R., & Murukan, A. (2003,
June). Design guidelines for secure web applications. Retrieved from
http://msdn.microsoft.com/en-us/library/ff648647.aspx
Contingency access to encrypted data. (2006, February 23). Retrieved from
http://www.continuitycentral.com/feature0308.htm
Nexo, T. M. (2009, November 23). Quick steps to windows 7 os hardening. Retrieved from
http://www.winfrastructure.net/article.aspx?BlogEntry=Quick-steps-to-Windows-7-OS-
hardening
