Network Security: Standard System Attacks

• Week 9 focuses on Network Security.

Introduction

• Computer systems are increasingly vulnerable despite having better security systems.
• Vulnerability comes from worldwide Internet access to computer systems.
• Encryption algorithms, access controls, digital signatures, and biometrics are forms of computer and network security.

Standard System Attacks

• Viruses are small computer programs that alter computer operation, deleting and corrupting data, program files or operating system files
• Parasitic viruses attach to files
• Macro viruses reside in macro files attached to applications and install when executed.
• Stealth viruses attach to the operating system.
• Boot sector viruses reside in removable media; these can infect a computer when it is started.
• Polymorphic viruses mutate, changing their encryption keys, making them difficult to detect.
• Computer worms copy themselves from one system to another over a network without human intervention.
• Worms often propagate through email.
• Viruses and worms are typically transported as Trojan horses, disguised inside harmless code.
• Social engineering and exploiting known vulnerabilities in operating systems or application software are two popular forms of attacks.
• Software companies issue patches for vulnerabilities; these can either fix the vulnerability or create more holes which can then be exploited.
• Common attack vectors include email attachments and scanning computer ports connected to the Internet.
• Denial-of-service (DoS) attacks disable a server by overwhelming it with requests.
• A ping storm is a condition in which the Internet ping program sends a flood of packets to a server.
• E-mail bombing is when one sends an excessive amount of unwanted e-mail.
• Smurfing is a technique using IP broadcast addressing operations to attack a network.
• Smurfing relates to spoofing and is often used in denial of service attacks.
• A user creates a packet that appears to be something else or from someone else when spoofing
• Phishing involves hackers creating emails that look as if they are coming from a legit source but are trying to get the user to give up ID and password info.
• Pharming redirects unknowing users to bogus look-alike websites.
• Stealing, guessing, and intercepting passwords is a tried and true form of attack.
• Botnets are malicious programs that take over operations on a compromised computer.
• Rootkits are programs that have been installed deep within a user's operating system and defy detection.
• Keyloggers secretly capture and record keystrokes made at a user's keyboard.

Physical Protection

• Physical protection is needed from environmental damage and from physical security breaches.
• Electrical protection and noise protection are needed.

Physical Protection (continued)

• Surveillance and proper placement of security cameras can deter theft and vandalism as well as provide a record of activities.
• Intrusion detection is a field of study in which specialists try to prevent intrusion and try to determine if a computer system has been violated by dataflow monitoring
• Honeypots are an indirect form of surveillance where network personnel create a trap, watching for unscrupulous activity

Controlling Access / Access Rights

• Controlling access involves deciding who has access to what, limiting time of day access, Limiting day of week access and Limiting access from a location
• Access rights include being able to Read, write, delete, print, copy, and execute Most network operating systems have a powerful system for assigning access rights

Passwords and ID Systems

• Passwords are the most common form of security and the most abused.
• Simple rules help support safe passwords, including changing password often, picking a good random password of at least 8 characters, not sharing passwords or writing them down and Don't select names and familiar objects as passwords
• Many new forms of "passwords" are emerging, including fingerprints, face prints, retina scans and iris scans, voice prints, ear prints and combinations of forms of identification called multifactor identification

Auditing

• Creating a computer or paper audit can help detect wrongdoing and also be used as a deterrent
• Many network operating systems allow the administrator to audit most types of transactions
• Criminals have been caught because of computer-based audits

Basic Encryption and Decryption Techniques

• Cryptography creates and uses encryption and decryption techniques.
• Plaintext is the clear, unencrypted data before any encryption is performed.
• Ciphertext is the encrypted data after encryption has been performed.
• Keys are unique pieces of information used to create ciphertext and decrypt it back into plaintext.

Monoalphabetic Substitution- Based Ciphers

• Monoalphabetic substitution-based ciphers replace a character or characters with a different character or characters, based upon some key
• Example replacement from abcdefghijklmnopqrstuvwxyz to POIUYTREWQLKJHGFDSAMNBVCXZ so that "how about lunch at noon" becomes "EGVPO GNMKN HIEPM HGGH"
• If someone intercepts a simple key, they can decrypt the whole conversation

Polyalphabetic Substitution- Based Ciphers

• Polyalphabetic ciphers are similar to monoalphabetic ciphers except multiple alphabetic strings are used to encode the plaintext
• A matrix of strings uses 26 rows by 26 characters or columns.
• A key such as COMPUTERSCIENCE is placed repeatedly over the plaintext COMPUTERSCIENCECOMPUTERSCIENCECOMPUTER thisclassondatacommunicationsisthebest
• To encode the message, take the first letter of the plaintext, t, and the corresponding key character immediately above it, C. Look in the 26x26 matrix where the row C intersects column t where the ciphertext character V is present and then continue with the other characters in plaintext

Transposition-Based Ciphers

• Transposition-based ciphers do not preserve the order of the plaintext.
• For a the key COMPUTER, number the letters in alphabetical order: 14358726
• The read the ciphertext down the columns, starting with the column numbered 1, followed by column number 2

Public Key Cryptography

• Public key cryptography is a robust encryption technique using two keys.
• Public Key encrypts the message and another private key decrypts.
• It is not possible to deduce one key from the other
• Secure Sockets Layer on the Internet is an example

Digital Signatures

• Used to authenticate the owner of the document
• Document to be signed goes through a complex mathematical computation that generates a hash
• The hash is encoded with the owner's private key, and then stored
• In future, hash is decoded using the owner's public key and both are compared to prove the document belongs to the owner
• Some countries accepts digitally signed documents as legal proof.

Firewalls

• A system that supports an access control policy between two networks.
• Limit the types of transactions that can enter or leave a system.
• Can be programmed to control IP addresses and TCP port numbers.

Three Basic Types of Firewalls

• Packet filter firewall – essentially a router that has been programmed to filter out or allow certain IP addresses or TCP port numbers, and can scan viruses or detect spoofing
• Proxy server – more advanced firewall that acts as a doorman into a corporate network with Any external transaction requesting something from the corporate network must enter through the proxy server but makes accesses slower
• Application layer – inspects all packets coming into or leaving a connection using the application layer of the TCP/IP protocol suite and the the most advanced fire wall, operating at packet filtering

Wireless LAN Security

• Broadcasting network traffic over the airwaves has created new security issues for data transmissions with WLANs are far more exposed to intrusion because the medium is not contained.
• Attacks include hardware theft, AP impersonation, passive monitoring and Denial of service (DoS)

802.11 Security

• Authentication is when the Process verifies that the client device has permission to access the network is verified, and each WLAN client can be given the SSID of the network manually or automatically plus Turning off SSID broadcast can also protect your network against someone finding it unintentionally
• Privacy ensures that transmissions are not read by unauthorized users using data encryption

802.11 Security (cont.)

• Wired Equivalent Privacy (WEP) is a Data encryption specification for wireless devices with two versions: 64-bit and 128-bit encryption although the 128 is easy to decrypt and seldom used today
• Wi-Fi Protected Access: Standard for network authentication and encryption, uses a 128-bit pre-shared key (PSK) and PSK uses a different encryption key for each client device, for each packet, and for each session
• Wi-Fi Protected Access 2: version of WPA that has been certified by the IEEE to be compatible with IEEE 802.11i
• Define a robust security network association (RSNA) and Provide Mutual authentication between client devices and AP • Controlled access to the network, Establishment of security keys and Key management

Additional WLAN Security Strategies

• Reduce WLAN transmission power.
• Change the default security settings on the APs.
• Employ antivirus and antispyware software.
• Separate WLAN transmissions from wired network traffic.
• Put a firewall between the WLAN and the wired LAN.