Network Security

By:

Dr. BHARGAVI H. GOSWAMI

Department of Computer Science

Christ University

+91 9426669020

bhargavigoswami@gmail.com

Network Security Essentials

Applications and Standards

Third Edition

William Stallings

Chapter 1

Introduction

Outline: Topics

1. Security Trends

2. The OSI Security Architecture

3. Security Attacks

4. Security Services

5. Security Mechanisms

6. A Model for Internetwork Security

7. Internet Standards and the Internet Society

Introduction:

• This book focuses on internet security consisting of measures to deter, prevent, detect & correct security violations that involve transmission of information.

Cases where security is needed:

1. AB, C who is unauthorized monitor & capture data during transmission.

2. D(Mngr) E(Comp), F(Intruder) adds/deletes/alters during transmission.

3. F(Intruder) alter message before reaching from D to E.

4. Fired employee inserts delay on msgs of mngr to reach system server to invalidate employee’s account.

5. Customer sends msg to broker for purchase & when share value degrades, denies his prior transactions made with broker.

Internetwork Security is both, Fascinating &

Complex

Reasons: • Confidentiality, Authentication, Non-repudiation,

Integrity. • Develop security mechanism or algo which always

consider potential attacks or security features, exploiting unexpected weakness in algo.

• Procedures providing particular services are counter intuitive.

• Imp to decide when & where to use designed algo or security mechanism. i.e Physical or Logical layer.

• N no. of algo. Use encryption key at creation, distribution & protection, time limits.

Information Security

• Requirements – Computer Security (System Security)

– Network Security (Internet Security)

• Security Violations

1. Security Trends • Internet Architecture Board (IAB)

– Issued report on “Security in the Internet Architecture” (RFC 1636), in 1994.

– Report Stated: Internet needs more and better security in areas like:

• Unauthorized monitoring of n/w infrastructure. • Unauthorized control of n/w traffic over end users. • Authentication Mechanism. • Encryption Mechanism.

• Then Computer Emergency Response Team (CERT) Coordination Center (CERT/CC) given Trends Report for 10 years. – Figure 1.1(a): Vulnerabilities in CERT Statistics – Figure 1.2(b): Incidents in CERT Statistics – Figure 1.2: Trends in Attack Sophistication and Intruder

Knowledge.

• Security related incidents reported include – Denial of service attacks. – IP spoofing (IP based security attack) – Eavesdropping – Packet sniffing (read packet info)

• Final analysis say that: Attacks have grown more sophisticated while skill & knowledge required to mount an attack has declined.

• Thus, wide range of technologies and tools are needed to counter the growing threat.

(Back Orifice)

High

Low

Conclusion:

• Over time, attacks have grown more sophisticated while skill and knowledge required to mount an attack has declined.

2. The OSI Security Architecture

• Requirement: • To access effectively the security needs,

choose & evaluate security products & Policies, systematic approach is needed.

• Solution? ITU-T2 Recommendation X.800, Security Architecture for OSI.

• OSI Security Architecture focuses on – Security Attacks – Security Mechanisms – Security Service

• Security Attack: Any action that compromises the security of information.

• Security Mechanism: A mechanism that is designed to detect, prevent, or recover from a security attack.

• Security Service: A service that enhances the security of data processing systems and information transfers. A security service makes use of one or more security mechanisms.

• RFC.2828: Threats & Attacks ……

3. Security Attacks • Use both, X.800 & RFC 2828 • Classified as:

– Passive Attacks – Active Attacks

• 1. Passive Attacks – Is the nature of eavesdroppers – Goal: Obtain Information – Types:

• Release of message contents (Fig 1.3 a) • Traffic analysis (Fig 1.3 b)

– Solution? – Mask content using encryption. – Passive attacks are very difficult to detect

because they do not involve any alteration of the data.

– How to deal with passive attacks? – Prevention rather than detection.

• 2. Active Attacks – Involve some modifications of the data

stream or creation of false stream. – Categorized into:

• Masquerade • Replay • Modification of message • Denial of service

Masquerade (1.4 a): One entity pretends to be a different entity. Obtain extra privileges by impersonating an entity.

Replay (1.4 b): Passive capture of a data unit & its Subsequent Retransmission.

Modification of Messages (1.4 c): Some portion of message is altered eg: “Allow John Smith” altered to “Allow Darth”.

Denial of Service (1.4 d): Entity may suppress all messages directed to particular destination.

• Conclusion:

• Prevention of active attacks is difficult.

• So, goal should be to deter them & to recover from any disruption or delays caused by them.

• Deter needs detection, detection contribute to prevention indirectly.

Security Goals (CIA)

Integrity

（真確性）

Confidentiality

（機密性）

Availability

（可取用性）

4. Security Services

• X.800 defines a security service that is provided by protocol layer of communicating open system.

• Security Service implement security policies and are implemented by security mechanism.

• X.800 divides services into 5 categories and fourteen specific services. (Table 1.2) – Data Confidentiality (privacy) – Authentication (who created or sent the data) – Data Integrity (has not been altered) – Non-repudiation (the order is final) – Access Control (prevent misuse of resources) – Availability (permanence, non-erasure)

• Denial of Service Attacks • Virus that deletes files

Availability Service: – Both X.800 & RFC2828 defined availability

property of system.

– System is available if it provides services according to the system design whenever user request them.

– Attacks results in loss of or reduction in availability.

– Can be associated with services property.

– Address security concerns raised by denial-of-services attacks.

– Depends upon: • Management & Control of system resources

• Access control service.

5 Security Mechanisms

• Defined in X.800. • Classification 1: • 1. Reversible Encipherment Mechanism:

– Simply encryption algorithm. – Allows data encryption & subsequent

decryption.

• 2. Irreversible Encipherment Mechanism: – Include hash algorithms. – Include message authentication codes. – Used in digital signature & message

authentication application.

• Classification 2:

• 1. Specific Security Mechanisms – May be incorporated into the

appropriate protocol layer in order to provide some of the OSI security services

• 2. Pervasive Security Mechanisms – Mechanisms that are not specific to any

particular OSI security service or protocol layer

X.800 indicates relationship between security services and security mechanisms given in the following table.

6. A Model for Network Security:

• The sender and receivers are Principals in transaction and they should co-operate.

• Logical channel using TCP/IP is developed between principals and needs security.

• Two components of technique providing security are: – Encryption of the message. – Encryption Key.

• General model shows that there are four basic tasks in designing a particular security service:

• Which four? Lets see...

• 1. Design an algorithm for performing the security-related transformation. The algorithm should be such that an opponent cannot defeat its purpose.

• 2. Generate the secret information to be used with the algorithm.

• 3. Develop methods for the distribution and sharing of the secret information.

• 4. Specify a protocol to be used by the two principals that makes use of the security algorithm and the secret information to achieve a particular security service.

• Need? Protect information system from unwanted access like...

• Human Attack: – Hacker: Someone who with no malign intent,

simply gets satisfaction from breaking and entering a computer system.

– Intruder: seeks to exploit computer assets for financial gain.

• Software Attack: – Virus & Worms: attacks can be introduced into

a system by means of a disk that contains the unwanted logic concealed in otherwise useful software.

• Solution? Defensive Methods

Methods of Defense • Gate-Keeper function: It includes password-based

login procedures that are designed to deny access to all but authorized users and screening logic that is designed to detect and reject worms, viruses, and other similar attacks. See next figure.

• System activity monitoring. • Encryption • Software Controls (access limitations in a data

base, in operating system protect each user from other users)

• Hardware Controls (smartcard) • Policies (frequent changes of passwords) • Physical Controls

7. Internet Standards and the Internet Society

• Protocols included in TCP/IP protocol suite are standardized.

• Who standardize the developed technology and publish?

• The Internet society. • Is composed of

– Internet Architecture Board (IAB): Responsible far defining the overall architecture of the Internet, providing guidance and broad direction to the IETF.

– Internet Engineering Task Force (IETF): The protocol engineering and development arm of the Internet.

– Internet Engineering Steering Group (IESG): Responsible far technical management of IETF activities and the Internet standards process

• IETF procedure: – Working group will make a draft version of the

document available as an Internet Draft, which is placed in the IETF's "Internet Drafts" online directory.

– The document may remain as an Internet Draft for up to six months, and interested parties may review and comment on the draft.

– The working-group may subsequently publish a revised version of the draft as RFC (Request for Comment) which are the working notes of the Internet research and development community.

– The IETF is responsible for publishing the RFCs, with approvaI of the IESG.

– Table 1.6 shows the IETF areas and their focus.

The Standardization Process:

• The decision of which RFCs become Internet standards is made by the IESG, on the recommendation of the IETF.

• To become a standard, a specification must meet the following criteria: 1. Be stable and well understood 2. Be technically competent 3. Have multiple, independent, and interoperable

implementations with substantial operational experience.

4. Enjoy significant public support . 5. Be recognizably useful in some or all parts of the

Internet

• The left-hand side of Figure shows the series of steps, called the standards track, that a specification goes through to become a standard; this process is defined in RFC 2026.

• IETF must make a recommendation for advancement of the protocol, and the IESG must ratify it.

• The white boxes in Figure 1.5 represent temporary states, used for small duration like 6 months.

• The gray boxes represent long-term states that may be occupied for years.

• After significant implementation and operational experience has been obtained,

• a specification may be elevated to Internet Standard. At this point, the specification is assigned an STD number as well as an RFC number.

• Finally, when a protocol becomes obsolete, it is assigned to the Historic state.

Internet Standards Categories

• All Internet standards fall into one of two categories:

1. Technical specification (TS): A TS defines a protocol, service, procedure, convention, or format. Most Internet standards are TSs.

2. Applicability statement (AS): An AS specifies how, and under what circumstances, one or more TSs may be applied to support a particular Internet capability.

• An AS identifies one or more TSs that are relevant to the

capability, and may specify values or ranges for particular parameters associated with a TS or functional subsets of a TS that are relevant for the capability.

Other RFC Types • There are numerous RFCs that are not destined to

become Internet standards. • Such RFCs are designated as Best Current Practice

(BCP). • Approval of BCPs follows essentially the same process

for approval of Proposed Standards. • A three-stage process for BCPs;

– A BCP goes from Internet draft status to approved BCP in one step.

– A protocol or other specification that is not considered ready for standardization may be published as an Experimental RFC. Specification may be resubmitted.

– When research appears to enjoy enough community interest to be considered valuable, then the RFC will be designated a Proposed Standard.

• Finally, an Informational Specification is published for the general information of the Internet community.

Chapter is over…

• Thank You….

• Be regular otherwise your tension is obviously going to increase as time passes….

• Assignment Submission?????