Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Chapter 9 – Securing Business Services


Published on

Published in: Technology
  • Be the first to comment

  • Be the first to like this

Chapter 9 – Securing Business Services

  1. 1. <ul><li>Securing Business Services </li></ul>
  2. 2. Presentation Structure <ul><li>Securing Internet servers. </li></ul><ul><li>Securing Web servers. </li></ul>
  3. 3. Internet Servers <ul><li>Internet servers (Web, Telnet, Ftp, etc), by their very nature, will be likely targets for intruders. </li></ul><ul><li>This is because these systems are visible and advertised to the entire Internet community. </li></ul>
  4. 4. Securing Internet Servers <ul><li>Host security. </li></ul><ul><li>This is how to secure individual hosts (machines) as described in Securing the Internet Connection. </li></ul><ul><li>This is a precondition for any of the other security mechanisms to use. </li></ul><ul><li>File access control. </li></ul><ul><li>This is how you set permission over files on the server. </li></ul>
  5. 5. Securing Internet Servers <ul><li>Architecture (e.g., the proper design and placement of an Internet server). </li></ul><ul><li>An architecture used can greatly affect organisational security. </li></ul><ul><ul><li>E.g., without a firewall before the Internet servers, they may be exposed to Internet attack. </li></ul></ul>
  6. 6. Securing Internet Servers <ul><li>Authentication. </li></ul><ul><li>Selecting a proper type of user authentication is important to protect against Internet intrusion. </li></ul><ul><li>Integrity tools. </li></ul><ul><li>The use of integrity software tools is to ensure that the stored data on the server is not changed without proper authorisation. </li></ul>
  7. 7. Securing Internet Servers <ul><li>Digital signature. </li></ul><ul><li>This is the primary means for providing nonrepudiation. </li></ul><ul><li>Encryption. </li></ul><ul><li>Encryption provides the greatest protection for information confidentiality, while it is stored and in transit. </li></ul>
  8. 8. Host Security <ul><li>Host security is the fundamental security mechanism required to protect your Internet servers. </li></ul><ul><li>If you don’t individually protect them first, then all of the other security mechanisms currently used (or to use) are worthless. </li></ul>
  9. 9. Weak Host Security: What would happen? <ul><li>E.g., assume you’ve implemented a foolproof confidentiality mechanism using public key encryption techniques. </li></ul><ul><ul><li>You are sure that there is absolutely, positively no way for anyone else, other than the proper recipient to decrypt the data. </li></ul></ul><ul><ul><li>If your host security is weak, then the intruder doesn’t need to bother with decryption and s/he can simply break into the server and steal your private key. </li></ul></ul><ul><ul><li>With the private key in hand, the intruder can read confidential messages easily. </li></ul></ul>
  10. 10. Securing Individual Hosts <ul><li>Verify that the host is configured correctly using both automated systems (e.g., Bastille, COPS) and by hand using a checklist. </li></ul><ul><li>Install host-based packet filters (like iptables). Their logs should be regularly examined. </li></ul>
  11. 11. Some Features of Bastille <ul><li>File permission security: set more restrictive permissions on the administration utilities, disable SUID status for mount/umount, disable SUID status for ping? </li></ul><ul><li>Account security: e.g., password aging, the use of cron to administrative accounts. </li></ul><ul><li>Boot security: e.g., password-protected boot, disable CTRL-ALT-DELETE, password protected single-user mode. </li></ul><ul><li>Secure Inetd: disable Telnet, disable Ftp. </li></ul>
  12. 12. Some of the Features in COPS <ul><li>file, directory, and device permissions/modes. </li></ul><ul><li>poor passwords. </li></ul><ul><li>content, format, and security of password and group files. </li></ul><ul><li>the programs and files run in /etc/rc* and cron(tab) files. (There are a number of services controlled by scripts under /etc/rc.d, such as: </li></ul><ul><ul><li>sendmail, cron, lpd, sshd, dhcpd, etc…) </li></ul></ul><ul><li>existence of root-SUID files, their writeability, and whether or not they are shell scripts. </li></ul>
  13. 13. Root-SUID Files <ul><li>An examination of the permission bits of the passwd program (a root SUID file) by: </li></ul><ul><li>ls -l /usr/bin/passwd </li></ul><ul><li>would probably show an 's' flag for the owner's execution rights, i.e., -r-sr-xr-x. </li></ul><ul><li>This indicates that the passwd command is a root SUID program. </li></ul>
  14. 14. Securing Individual Hosts <ul><li>Activate logging programs available with the operating system. </li></ul><ul><ul><li>Regularly examine the logs and pay particular attention to unsuccessful attempts to access restricted documents. </li></ul></ul>
  15. 15. Securing Individual Hosts <ul><li>Turn off any service on the host that is not used. </li></ul><ul><li>Limit the number of login accounts on the servers. </li></ul><ul><ul><li>The more accounts on the server you have, the more likely it is to be broken into. </li></ul></ul><ul><li>Constantly monitor Internet security mailing lists for any new vulnerabilities. </li></ul><ul><ul><li>Install patches, e.g., OS patches. </li></ul></ul><ul><ul><li>E.g., users can register with ThaiCERT at to receive security news through email. </li></ul></ul>
  16. 16. File Access Control <ul><li>Set file/directory permission in the right mode to protect against unauthorised attempts, e.g., to overwrite files, change modes. </li></ul>
  17. 17. Architecture <ul><li>There are a number of issues in designing an appropriate architecture: </li></ul><ul><ul><li>placing an Internet server, </li></ul></ul><ul><ul><li>server ownership (the organisation or a service provider owns the server???) </li></ul></ul><ul><ul><li>choosing a server platform, </li></ul></ul><ul><ul><li>selecting a firewall architecture, and </li></ul></ul><ul><ul><li>availability. </li></ul></ul>
  18. 18. Placing an Internet Server <ul><li>The placement of an Internet server has a strong effect on overall security of the Internet server. </li></ul><ul><li>In Fig. 8.1, pg 269, there are 3 possible locations for a server: </li></ul><ul><ul><li>inside your corporate network, </li></ul></ul><ul><ul><li>in the demilitarised zone (DMZ) of a multitiered firewall system (in the screened subnet area), and </li></ul></ul><ul><ul><li>elsewhere on the Internet with a third party. </li></ul></ul>
  19. 19. Server Ownership <ul><li>You may want to offer Internet services, and in this way, you have to purchase your own hardware and provide all the services by yourself. </li></ul><ul><ul><li>You own the server by yourself. </li></ul></ul><ul><li>Or you may use an Internet service provider that gives you Internet server space for providing Internet services. </li></ul><ul><ul><li>The service provider owns the server. </li></ul></ul>
  20. 20. Ownership and Placement of a Server <ul><li>There are 3 architectural options for you to select in providing Internet services: </li></ul><ul><li>1. Provide your own server and network connection. </li></ul><ul><ul><li>In this option, you are responsible for everything, including the Internet connection, the network, and the server. </li></ul></ul>
  21. 21. Ownership and Placement of a Server <ul><li>2. Provide your own server, but put it on the service provider’s network. </li></ul><ul><ul><li>In this option, you supply and maintain the server, but the Internet connection is done through the service provider’s high-speed connection. </li></ul></ul>
  22. 22. Ownership and Placement of a Server <ul><li>3. Lease space on a server provided by an Internet service provider. </li></ul><ul><ul><li>Many service providers maintain very large Internet servers running Web and FTP servers. </li></ul></ul><ul><ul><li>You can rent their disk space on a service provider server and put your information/applications thereon. </li></ul></ul><ul><ul><li>Sometimes this leasing service is marketed as a cyberspace in a virtual mall. </li></ul></ul>
  23. 23. The Trade-offs: Security, Flexibility, Control, and ….among the 3 Options <ul><li>Table 8.1, pg 271 shows a comparison among the three architectural options, namely: </li></ul><ul><li>Own server and own network, </li></ul><ul><li>Own server but lease network, and </li></ul><ul><li>Lease server space. </li></ul>
  24. 24. Choosing a Server Platform <ul><li>UNIX is perhaps the most common platform in use nowadays for servers. </li></ul><ul><li>From a source: Gartner Dataquest, March 2003 (sale in billions of dollars) </li></ul><ul><ul><li>OS 2001 2002 </li></ul></ul><ul><ul><li>Linux $1.3 $2.1 (double the sale) </li></ul></ul><ul><ul><li>UNIX $19.4 $17.2 </li></ul></ul><ul><ul><li>Windows $13.1 $12.4 </li></ul></ul><ul><ul><li>From </li></ul></ul>
  25. 25. Choosing a Server Platform <ul><li>For small businesses with minimal UNIX expertise, the Macintosh or Windows-based solutions are probably suitable due to ease of use. </li></ul><ul><li>But if you are planning for a very large Internet service with many people accessing it, UNIX is probably the way to go. </li></ul>
  26. 26. Selecting a Firewall Architecture <ul><li>If you decide to deploy your own server on your own network, the next step is to select an appropriate firewall architecture. </li></ul><ul><ul><li>You have various architectures to select, depending on your security requirements. </li></ul></ul><ul><ul><li>E.g., if security is of great concern, a screened subnet firewall is recommended and your server is placed in the DMZ. </li></ul></ul>
  27. 27. Availability <ul><li>There are several precautions you can take to ensure system availability, including: </li></ul><ul><li>Redundant systems </li></ul><ul><li>You can have two or more identical servers provide the same information. If one breaks down or is penetrated, the other is still available. </li></ul><ul><li>Storage backup tools can be used to create a mirror image of the primary server at regular intervals. </li></ul>
  28. 28. Availability <ul><li>Geographic separation </li></ul><ul><li>Two servers are configured identically, but in this scheme, they are located in different places. </li></ul><ul><li>Each place would have its own separate Internet connection. </li></ul>
  29. 29. Availability <ul><li>Ultrareliable hardware </li></ul><ul><li>Installing Internet services on ultrareliable hardware with built-in redundancies (double CPUs, double UPSs, RAID) will reduce the chance that a server with redundancies will go down. </li></ul>
  30. 30. Authentication <ul><li>(A number of user authentication methods were already described in SecIntCon.) </li></ul><ul><li>The more secure the system, the harder or more expensive it is to use. </li></ul><ul><ul><li>In other words, the higher the security, the lower the ease of use (usability). </li></ul></ul><ul><li>When deploying Internet services, you need to decide a proper balance between the usability and security of an authentication technique used. </li></ul>
  31. 31. Authentication Used Depends on Types of Information <ul><li>Very important information , such as corporate databases , should be protected with extremely strong authentication , regardless of the difficulty/cost to use. </li></ul>
  32. 32. Authentication Used Depends on Types of Information <ul><li>Subscriber information : Information provided to customers for a fee paid requires some authentication to ensure that only subscribers can access the information. </li></ul><ul><li>But t he authentication system can’t be too expensive or difficult to use or else people may not sign up for the service. </li></ul><ul><li>An authentication scheme using traditional passwords is usually appropriate for this type of service. </li></ul>
  33. 33. Authentication Used Depends on Types of Information <ul><li>Marketing/advertising information: Regarded as public information, this kind of information has minimal authentication needs and strong usability requirements. </li></ul><ul><li>There is little or no authentication at all for this type of information. </li></ul>
  34. 34. Server Data Integrity <ul><li>Maintaining and ensuring the integrity of Web pages is a major concern of many organisations. </li></ul><ul><li>They worry that an intruder will break into a Web server and change the data stored there. </li></ul><ul><li>If this goes unnoticed, it could be a disaster for the organisation because it may lose a good image of high security. </li></ul>
  35. 35. Integrity Tools: Message Integrity <ul><li>Message integrity or hash functions are the most common method used to combat this problem. </li></ul><ul><li>Hash codes are computed for all the data on the server and stored in a secure place to ensure that hash codes are not altered. </li></ul><ul><li>At regular intervals, the hash codes should be recomputed and compared with the original computed codes. </li></ul><ul><ul><li>If they don’t match, then something has changed and should be immediately investigated. </li></ul></ul>
  36. 36. Integrity Tools (cont…) <ul><li>Any time data is added, deleted, or modified, the hash code database needs to be updated to reflect the changes. </li></ul><ul><li>Several public domain programs can be used for this purpose, including Tripwire, developed at Purdue University. </li></ul>
  37. 37. Digital Signatures <ul><li>If you plan on opening a cybershop or conducting business on the Internet, then PKI (public/private key infrastructure) will be very important to you and should be implemented on your server. </li></ul><ul><ul><li>The server will have a private key (digital signature) and provide its public key for the customers to download and install in his browser. This is to verify if the server they are doing transactions with is authentic (not spoofed). </li></ul></ul>
  38. 38. Encryption <ul><li>To securely communicate between a client and an Internet server, there are 3 encryption schemes available for use with WWW: </li></ul><ul><ul><li>EIT’s Secure Hyper-Text transfer Protocol (S-HTTP), </li></ul></ul><ul><ul><li>Netscape’s Secure Socket Layer (SSL), and </li></ul></ul><ul><ul><li>Microsoft’s Private Communication Technology (PCT). </li></ul></ul><ul><li>Make sure to configure the server to transmit data in an encrypted format. </li></ul>
  39. 39. Securing Web Servers <ul><li>Web servers have a few security issues of their own, including: </li></ul><ul><ul><li>Configuring the server securely. </li></ul></ul><ul><ul><li>Using Common Gateway Interface (CGI) securely. </li></ul></ul><ul><ul><li>CGI allows you to add custom services to your Web server. If you’re not careful enough however, you could inadvertently open security holes to the intruder. </li></ul></ul>
  40. 40. Configuring the Server Securely <ul><li>Below are the steps you should take when running a server under UNIX (as the most commonly used server platform nowadays). </li></ul><ul><ul><li>Do not run your Web server as a privileged user (root). </li></ul></ul><ul><ul><li>If an intruder finds a security hole in the server, this will give them complete access to your server!!!. </li></ul></ul><ul><ul><li>You may run it under a special account, like www. </li></ul></ul>
  41. 41. Configuring the Server Securely <ul><ul><li>Appropriately set the directory hierarchy (Fig 8.4, pg286) and permission of the server so that they are owned by a special user and group, e.g., www. </li></ul></ul><ul><ul><li>See an example of permission setting at </li></ul></ul><ul><ul><li>Also at times double-check to verify that noone has ever changed your setting or inserted a Trojan horse into the server directories. </li></ul></ul>
  42. 42. Configuring the Server Securely <ul><ul><li>Turn off the features of the Web server that you really don’t use. </li></ul></ul><ul><ul><li>The more features a server provides, the more trouble (security holes) it may introduce. </li></ul></ul><ul><ul><li>E.g., turn off using server-side includes. This feature opens security holes, most notably, the possibility of allowing an intruder to execute any command (embeded in an HTML document) on the server with the ‘exec’ include. </li></ul></ul>
  43. 43. Common Gateway Interface (CGI) <ul><li>The CGI protocol allows you to add custom services (programs) to your Web server. </li></ul><ul><li>This protocol acts as interface between software that you write in a standard programming or scripting language and the Web server. </li></ul>
  44. 44. How CGI Works <ul><li>The CGI process works as follows: </li></ul><ul><ul><li>1.The user, using a Web browser, selects an item that activates a CGI program. The client (user) sends the server the name of the program and any associated data, such as information entered on a form. </li></ul></ul>
  45. 45. How CGI Works <ul><ul><li>2.The server sets up the proper operating environment and calls the CGI program. </li></ul></ul><ul><ul><li>-- The environment allows the exchange of data between the server and the CGI program. </li></ul></ul><ul><ul><li>-- The server may have to send the input data from the client (user) to the CGI program to process there. </li></ul></ul><ul><ul><li>3.The CGI program executes, using the input data, and returns any output back to the server. </li></ul></ul><ul><ul><li>The server in turn passes the output (information) to the client (user). </li></ul></ul>
  46. 46. Threats of CGI <ul><li>CGI is a major source of security problems in Web servers, since it allows a client to activate (execute) custom programs on the server. There are several potential vulnerabilities, including: </li></ul><ul><ul><li>A legitimate CGI program may have security holes that allow an intruder to execute unauthorised commands or to discover information about the system. </li></ul></ul><ul><ul><li>If uploading of files is allowed, intruders may manipulate to place their own malicious CGI programs on your server without your knowledge. </li></ul></ul>
  47. 47. Guidelines for Creating CGI Programs <ul><li>Don’t make assumptions about the program’s operating environment. Instead, set the environment variables (such as PATH on UNIX) within your program or use complete path names. </li></ul><ul><ul><li>This is because if you don’t, the intruder may be able to redirect executing a system command specified in your program to executing the Trojan horse program (command) instead that they manipulated to upload to your server. </li></ul></ul>
  48. 48. Setting the PATH Variable <ul><li>The command in your CGI script like: </li></ul><ul><ul><li>system(&quot;ls -l /local/web/foo&quot;); </li></ul></ul><ul><li>will look for program ‘ls’ from PATH. </li></ul><ul><li>Do set PATH at the beginning of your CGI script: </li></ul><ul><li>putenv(&quot;PATH=/bin:/usr/bin:/usr/local/bin&quot;); </li></ul><ul><ul><li>In general it's not a good idea to put the current directory (&quot;.&quot;) into the path. </li></ul></ul><ul><li>However, if possible, use this instead. </li></ul><ul><ul><li>system(&quot;/bin/ls -l /local/web/foo&quot;); </li></ul></ul>
  49. 49. Guidelines for Creating CGI Programs <ul><li>Don’t use root SUID (SuperUser) shell scripts within UNIX as your CGI programs. Instead, use other equivalent executable code or PERL scripts. </li></ul><ul><ul><li>These shell SUID scripts do not work securely in most versions of UNIX and can be abused by an intruder to gain root access. </li></ul></ul>
  50. 50. Guidelines for Creating CGI Programs <ul><li>Store CGI programs in a central location. Don’t scatter them throughout your system. </li></ul><ul><ul><li>Placing all of your CGI programs in one location makes it easier to maintain and control. </li></ul></ul><ul><ul><li>This prevents someone from intentionally or accidentally placing insecure scripts in one of the scattered Web directories without your knowledge. </li></ul></ul><ul><li>Evaluate public domain CGI programs before using them. </li></ul>