Upload
clara-heath
View
233
Download
0
Tags:
Embed Size (px)
Citation preview
Linux Networking and Security
Chapter 7
Security, Ethics, and Privacy
Security, Ethics, and Privacy
List security risks typical in modern networked computer systems
Understand how to assess risk and create a security policy
Describe the function of top security-awareness organizations
Outline government’s security and privacy role Locate Linux products designed especially
for security-conscious environments
Introducing Computer Security and Privacy
Computer security is a large and specialized field, separate in many ways from the day-to-day operation of a network server
There are many unauthorized computer access events due to the fact that the more broadly a computer is networked, the more potential for access to that computer
This broad access is what represents the power of networked computers, but also represents opportunities for malicious intent
The Privacy Debate
Any personal information stored on a computer is threatened by someone cracking the system where it is stored
A great deal of personal information must be stored on computers to make government and businesses function efficiently
Laws and government regulations control who can access your credit records; businesses typically provide privacy policies
The Privacy Debate
The Privacy Debate
Privacy policies usually contain information similar to one of the following: We don’t collect or save any information about visitors to our
web site We collect information in order to complete a sale or register
users, but we do not share that data We collect information on visitors and use patterns to determine
if a visitor might be interested in some of our other products We collect information and share it with our partners who may
have products that interest you
Ethics and System Administrators
The burden of ethical use of data typically falls on the system administrator
Ethics deals with the issue of doing the right thing at the right time, for the right reason
Ethics codes were developed to define the role of system administrators in organizations and to increase the respectability and raise standards of behavior in the profession
Support organizations for system administrators include SAIR/GNU and SAGE
Risk Assessment andSecurity Policies
The best approach to security is to make a system highly secure without undue annoyance to authorized users
“Security through obscurity” assumes that if no one knows about your system, you are safe, but this approach must be avoided
Hardware, software and data are primary targets of attack, but of these three, data presents the most serious threat
Risk Assessment andSecurity Policies
Crackers break into systems: In order to steal data (such as credit card) for their own use To corrupt data, maybe unintentionally, but often for malicious
reasons To block access to the system, as in a Denial-of-Service (DoS)
attack
Crackers are not the only threat to systems, a majority of security incidents result from the actions of users within an organization
Risk Assessment andSecurity Policies
Standard computer attack techniques: Password cracking involves obtaining a password by using a
password guessing program or by guessing based on a user’s personal information
Trojan horse attacks occur when an illicit program is run from an untrustworthy source
Buffer overflow attacks rely on a weakness in the design of a program dealing with buffer (memory space) management
Denial-of-Service attacks try to overwhelm your system so that valid users cannot access it
Risk Assessment andSecurity Policies
Security should begin with a careful analysis of the assets being protected and their value These assets can include reputation, revenue generation, secret
data, or other factors
Security is often divided into four layers: Physical security - physical access to Linux server User security - user authorization and privileges File security - file access limitations Network security - secure network configuration
Social Security
Computer security includes an aspect which is really about people, knowing why they act as they do and knowing whom to trust
This is true from the perspective of the system administrator and the cracker
The system administrator must be keenly aware of how to implement measures that will thwart the activities and access attempts of the cracker
Social Security
The system administrator must proceed with caution regarding where they obtain Linux, since the Linux kernel taken from the Internet could have been altered by a cracker to permit access via a source code back door A back door is a method of accessing a program that is known to
its creator but not to other users
The Linux code must be continually upgraded with security patches to prevent attacks
Social Security
Not only must the system administrator be savvy as to the plans of crackers, but also the users of any system due to a tactic called social engineering used by crackers Social engineering involves a cracker manipulating a system
user to extract needed access information Often a cracker will simply obtain a user’s name and call them in
order to obtain information, or they could walk past an employee’s workstation and gather information from posted data
Creating a Security Policy
A security policy is a written document that may do any of the following: Analyze what assets are at risk Provide network danger statistics to end users Provide security procedures Outline user access levels Compile specific actions to make the system secure after reboot Outline procedures to follow when an intrusion by a cracker has
been detected
Security-Focused Organizations
Two key ways that an organization can stay security-focused are: Upgrading the Linux system regularly using information from
security organizations whenever a security issue is discovered Taking advantage of professional organizations which act as
clearinghouses for recent security information; they help organizations learn more about security and how to implement what is learned
Upgrading Your Linux System
Your first goal is to keep your system upgraded, including the Linux kernel and programs that run on Linux
Most of the updates for security problems come in the form of a patch
The best way to stay informed about upgrades and patches is to subscribe to the security notification service of a reputable Linux vendor
The Security Experts
Two organizations are known as bastions of computer security information: The CERT Coordination Center (CERT/CC) is a federally funded
software engineering institute operated by Carnegie-Mellon University
The System Administration, Networking, and Security (SANS) Institute is a prestigious and well-regarded education and research organization whose staff includes most of the leading security experts in the country
The Security Experts
The Security Experts
The U.S. Government and Computer Security
Because computer security is increasingly viewed as part of our national security, the U.S. federal government continues to increase its involvement with the computer security industry
Two examples of new roles the government is playing are prosecutor of computer crimes and an information clearinghouse to encourage good security practices
Security and the Law
When congress passed the Computer Fraud and Abuse Act, it became a crime to access a computer without authorization
Additional laws have been passed to help stop the acts of crackers, including the Computer Security Act, the National Information Infrastructure Protection Act and the Patriot Act
Since crackers are difficult to prosecute, the FBI now has special computer crime units
Government Agency Resources
The following list describes some key resources for learning about U.S. government involvement with computer crime: The FBI’s National Computer Crime Squad The U.S. Department of Justice, Criminal Division The FBI’s National Infrastructure Protection Center (NIPC) The Department of the Treasury runs the Secret Service and the
Financial Crimes Enforcement Network (FinCEN)
Security-Focused Linux Products
The National Security Agency has released an experimental version of Linux called NSA security-enhanced Linux
Trustix released Trustix Secure Linux, which is a thoroughly configured server with tight security
Another more security-conscious Linux is the Bastille Linux hardening package (to harden a package is to make it more cracker secure)
Security-Focused Linux Products
Chapter Summary
An amazing number and variety of unauthorized computer access events continually plague network servers all over the world
Computer security is a serious field that pits crackers against administrators seeking to protect their employer’s assets
Computer crime statistics are hard to gather, but billions of dollars are spent annually to recover from unauthorized access
Privacy concerns make computer security a personal issue for anyone using the Internet
Chapter Summary
System administrators are in a position of great trust and power because of the information they control
Codes of ethics help system administrators understand professional expectations that can help them create lasting careers and serve both internal and external customers effectively
Difficult security decisions are best made before a crisis arises, based on a considered long-term view of consequences of each possible course of action
Organizations such as SAGE and SANS can help system administrators learn more about security from experts and colleagues
Chapter Summary
A proactive approach to security, rather that “security through obscurity,” yields the best results in protecting information systems from attack
Hardware, software, and data are all possible subjects of attack, though data is the most likely target
Crackers may try to steal data, corrupt data, or deny access to your system by legitimate users. Having written a security policy document helps you prepare for all types of attacks by justifying the need for security efforts, informing users of security concerns, and providing security breach guidance
Chapter Summary
Social engineering is a potential tool of crackers who contact end users and manipulate them to extract needed information
You must keep your Linux system upgraded with any security patches to prevent attacks via a known problem with software that you are using
Many laws now exist to allow prosecution of computer crimes Security products for Linux may help you improve your security
posture, though you must be careful about trusting products that you have not tested