Part 15: Security.

Uploaded on:
Category: Sales / Marketing
Part 15: Security Section 15: Security The Security Issue Program Dangers Framework and System Dangers Cryptography as a Security Apparatus Client Validation Actualizing Security Safeguards Firewalling to Ensure Frameworks and Systems PC Security Characterizations
Slide 1

Part 15: Security

Slide 2

Chapter 15: Security The Security Problem Program Threats System and Network Threats Cryptography as a Security Tool User Authentication Implementing Security Defenses Firewalling to Protect Systems and Networks Computer-Security Classifications An Example: Windows XP

Slide 3

Objectives To talk about security dangers and assaults To clarify the basics of encryption, confirmation, and hashing To inspect the employments of cryptography in registering To depict the different countermeasures to security assaults

Slide 4

The Security Problem A framework is secure if its assets are utilized and got to as expected under all circumstances. Complete security can\'t be accomplished.

Slide 5

The Security Problem Security must consider outer environment of the framework, and ensure the framework assets Intruders (saltines) endeavor to rupture security Threat is potential security infringement Eg, a revelation of a defenselessness Attack is endeavor to break security Attack can be coincidental or malignant Easier to secure against inadvertent than pernicious abuse

Slide 6

Security Violations Categories Breach of classification Involves unapproved perusing of information (robbery of data) Ex: taking Mastercard data or character data for fraud Breach of trustworthiness Unauthorized alteration of information Can bring about going of risk to a blameless gathering Can bring about change of business application Breach of accessibility Unauthorized decimation of information Ex: damaging of a site page Often to brag rights

Slide 7

Security Violations Categories (cont) Theft of administration Unauthorized utilization of assets Ex: utilizing someones PC as a porn server Denial of administration Preventing true blue utilization of the framework DOS is once in a while unintentional The first web worm turned into a DOS when a bug neglected to postpone its fast spread.

Slide 8

Security Violations Methods (see next slide) Masquerading (break confirmation) One member in a correspondence puts on a show to be another person Could be another host or individual. Objective is to get entrance that they would not ordinarily be permitted Or could attempt to raise their benefits Replay assault Replay a caught trade of information Sometimes the replay is the assault: ex: rehash of a solicitation to exchange cash Message alteration : supplant some information in the replay to acquire access for unapproved client. Man-in-the-center assault Attacker sits in the information stream of a correspondence Masquerades as the sender to the recipient and the other way around Session seizing A dynamic comunication session is caught.

Slide 9

Standard Security Attacks

Slide 10

Security Measure Levels Security must happen at four levels to be successful: Physical Physically secure the PCs Human Avoid social building Phishing: a true blue looking email or site page misdirects a client into entering secret data dumpster jumping: looking through refuse, discovering telephone directories, and so on Operating System The framework must shield itself from coincidental or intentional security breaks. Ex: a runaway procedure Stack flood Network Intercepting information going between comptuers Security is as week as the weakest chain

Slide 11

Program Threats The most widely recognized objective of saltines: Write a program that makes a rupture of security Or reason an ordinary procedure to change its conduct and make a break Example: Useful to sign into a framework without approval More valuable to desert a secondary passage daemon that gives data or permits simple get to regardless of the possibility that the first adventure is blocked.

Slide 12

Program Threats Trojan Horse Code fragment that abuses its surroundings Exploits components for permitting projects composed by clients to be executed by different clients Spyware, pop-up program windows, clandestine channels Examples Text-proofreader system may incorporate code to look the document to be altered for certain pivotal words These are then spared in a shrouded record available to the content\'s inventor supervisor.

Slide 13

Program Threats Trojan Horse more samples: Long pursuit ways (the PATH natural variable) If not every way is secure, could execute wrong program Example: utilization of the "." in the way (look current catalog) If you go to a companion\'s index and execute an order, the charge may be keep running from her registry This would give the project her consents Could erase her documents, and so on

Slide 14

Program Threats Trojan Horse (cont) More cases: Example: a program that imitates a login program User sign in at a terminal and notification that he as evidently mistyped his watchword He tries again and is effective What truly happened? His record name/secret key were stolen by the login emulator that was left running by the criminal. The emulator put away his data, printed out a login mistake message, and left. Client then got the genuine brief. Assurance: Use non-trappable key grouping (ctrl-alt-erase) Have the OS print an utilization message toward the end of an intuitive session rather than only another login brief

Slide 15

Program Threats Trojan Horse (cont) More illustrations: Spyware . Here and there goes with a program that the client has decided to introduce Sometimes with freeware/shareware once in a while with business programming Goals: Download advertisements to show on the client\'s framework Create pop-up windows when certain destinations are gone by Capture information from the client\'s framework and return it to a focal website. Spread Channel assault Surreptitious correspondence happens A spyware daemon is stacked It contacts a focal site and is given a message and a rundown of beneficiary locations It conveys the spam message to those clients from the tainted machine 80% of spam was conveyed along these lines in 2004!

Slide 16

Program Threats Trojan Horse more cases (cont) Spyware . Genuine issue: infringement of the guideline of minimum benefit Usually a client of a working framework does not have to introduce system daemons Such daemons are introduced by means of two slip-ups First: a client may decide to keep running with a larger number of benefits than should be expected (eg, as overseer) This permits programs that she rushes to have more access to the framework than is essential Second: an OS may permit of course a larger number of benefits than an ordinary client needs.

Slide 17

Program Threats Trap Door The fashioner of a project or framework may leave a gap in the product that just she is equipped for utilizing. Utilized as a part of the film War Games . Case: system perceives a particular client identifier or secret key that evades typical security methods Example: developer for a bank may incorporate adjusting slips in their code and have the subsequent half-penny kept in their record Could be incorporated in a Compiler produces standard item code Also incorporates the trap entryway. Elusive: seeking the source code won\'t uncover the trap entryway; it is just in the compiler!

Slide 18

Program Threats Logic Bomb Program that starts a security episode in specific situations Under typical circumstances there is no security gap. At the point when a predefined arrangement of parameters were met, the security opening is made. Illustration: developer composes code that verifies whether she is still utilized If not, a daemon is generated to permit remote access or to harm the site.

Slide 19

Program Threats Stack and Buffer Overflow Most basic procedure for assailant from outside the framework to increase unapproved access to the objective framework. Misuses a bug in a system flood either the stack or memory supports Usually software engineer fail to code limits keeping an eye on an info field Attacker sends more information than the project expects

Slide 20

Program Threats Stack and Buffer Overflow Using trial & blunder (or analyzing code if open source), aggressor composes a system to do the accompanying: Overflow a data field, order line contention, or info cradle for a system (like a system daemon) until it composes into the stack Overwrite the present return address and addition the abuse\'s location code stacked in step 3. Compose a basic arrangement of code for the following space in the stack that incorporates the orders that the aggressor wishes to execute Example to bring forth a shell Result is a root shell or other special charge execution.

Slide 21

Program Threats Stack and Buffer Overflow illustration: Web-page structure expects a client name in a field Attacker sends the client name, in addition to additional characters to flood the cradle and achieve the stack Plus, another return location to stack onto the stack, in addition to the code the aggressor needs to run. At the point when the cushion perusing subroutine comes back from execution, the arrival location is the adventure code and the code is run. See next slide

Slide 22

C Program with Buffer-flood Condition #include < stdio.h > #define BUFFER SIZE 256 int main(int argc, roast *argv[]) { char buffer[BUFFER SIZE]; if (argc < 2) return - 1; else { strcpy(buffer,argv[1]); return 0; } } Creates a character exhibit Copies the summon\'s substance line parameter into the cushion. This works fine the length of the information parameter is not as much as BUFFER SIZE (additionally require one byte to store \'\0\')

Slide 23

C Program with Buffer-flood Condition #include < stdio.h > #define BUFFER SIZE 256 int main(int argc, scorch *argv[]) { char buffer[BUFFER SIZE]; if (argc < 2) return - 1; else { strcpy(buffer,argv[1]); return 0; } } Creates a character cluster Copies the charge\'s substance line parameter into the support. Suppose it is possible that the order line parameter is too long. strcpy will duplicate from argv[1] until it hits a "\0" or until the project crashes!

Slide 24

C Program with Buffer-flood Condition #include < stdio.h > #define BUFFER SIZE 256 int main(int argc, roast *argv[]) { char buffer[BUFFER SIZE]; if (argc < 2) return - 1; else { strcpy(buffer,argv[1]); return 0; } } Creates a character exhibit Copies the order\'s substance line parameter into the cushion. To anticipate: use strncpy rather than strcpy: str

View more...